fix: allow Docker API hostname in production

tests/test_api_server_security.py

@@ -19,10 +19,12 @@ if SCRIPTS not in sys.path:
 
 import jyotish_api_server  # noqa: E402
 from jyotish_api_server import (  # noqa: E402
+    DEFAULT_ALLOWED_HOSTS,
     DEFAULT_ALLOWED_ORIGINS,
     BadRequest,
     JyotishAPIHandler,
     _load_local_module,
+    _parse_allowed_hosts,
     _parse_allowed_origins,
 )
 
@@ -38,6 +40,7 @@ class _FakeHeaders(dict):
 
 class _FakeServer:
     allowed_origins = DEFAULT_ALLOWED_ORIGINS
+    allowed_hosts = DEFAULT_ALLOWED_HOSTS
 
 
 class _ResponseCaptureHandler(JyotishAPIHandler):
@@ -171,6 +174,23 @@ def test_env_cors_parser_ignores_empty_entries() -> None:
     }
 
 
+def test_internal_docker_host_must_be_explicitly_allowed() -> None:
+    handler = _handler()
+    handler.headers = _FakeHeaders({'Host': 'api:5200'})
+    handler.path = '/health'
+    handler.server = _FakeServer()
+
+    with pytest.raises(jyotish_api_server.Forbidden, match='Host'):
+        handler._enforce_request_security()
+
+    handler.server.allowed_hosts = {'api'}
+    handler._enforce_request_security()
+
+
+def test_env_host_parser_normalizes_configured_hosts() -> None:
+    assert _parse_allowed_hosts('API, ,localhost') == {'api', 'localhost'}
+
+
 def test_get_internal_errors_are_json_wrapped() -> None:
     handler = _ResponseCaptureHandler()
 

tests/test_railway_deployment.py

@@ -23,3 +23,9 @@ def test_web_image_copies_postcss_config_before_building_frontend() -> None:
 
     assert config_copy in web
     assert web.index(config_copy) < web.index("RUN npm run build")
+
+
+def test_server_compose_allows_only_the_internal_api_hostname() -> None:
+    compose = (ROOT / "deploy" / "docker-compose.server.yml").read_text(encoding="utf-8")
+
+    assert "JYOTISH_ALLOWED_HOSTS: localhost,127.0.0.1,::1,api" in compose