Wildcard origins + auth host configured per origin row (⋮ menu, 🔑 indicator)

frontend/auth/admin/AdminApp.vue

@@ -484,14 +484,15 @@ function createRealm() {
     origins: [],
     originValidation: [],
     wellKnownCheck: null,
-    authHostValidation: null,
   })
 }
 
 function openRealm(realm) {
   // One combined list for editing: in-domain sites and related origins,
-  // classified by hostname. Strip https:// scheme for editing.
-  const origins = [...(realm.origins || []), ...(realm.related_origins || [])]
+  // classified by hostname. The default is always shown explicitly as the
+  // '*.rp_id' wildcard entry. Strip https:// scheme for editing.
+  const stored = realm.origins || []
+  const origins = [...(stored.length ? stored : ['*.' + realm.rp_id]), ...(realm.related_origins || [])]
     .map(o => o.replace(/^https:\/\//, ''))
   openDialog('realm-edit', {
     isNew: false,
@@ -501,7 +502,6 @@ function openRealm(realm) {
     origins,
     originValidation: origins.map(() => null),
     wellKnownCheck: null,
-    authHostValidation: null,
   })
 }
 
@@ -945,13 +945,19 @@ async function submitDialog() {
       const auth_host = d.auth_host?.trim() || ''
       // The combined origins list is split by hostname: entries on the
       // rp-id domain form the in-domain allow-list, entries elsewhere are
-      // related origins (ROR). Bare hostnames are sent as-is; the backend
+      // related origins (ROR). Wildcards ('*.app.example.com') classify by
+      // their base domain. Bare hostnames are sent as-is; the backend
       // normalizes them with https://.
       const origins = []
       const related_origins = []
       for (const o of (d.origins || []).map(o => o.trim()).filter(o => o)) {
         let hn = null
-        try { hn = new URL(o.startsWith('http') ? o : 'https://' + o).hostname } catch { continue }
+        if (o.startsWith('*.')) {
+          hn = o.slice(2).replace(/\.+$/, '')
+        } else {
+          try { hn = new URL(o.startsWith('http') ? o : 'https://' + o).hostname } catch { continue }
+        }
+        if (!hn) continue
         if (hn === rp_id || hn.endsWith('.' + rp_id)) origins.push(o)
         else related_origins.push(o)
       }