From 123b41d32b9c14302f0be0066bebe404caf0c594 Mon Sep 17 00:00:00 2001
From: Calvin Secrest <dev@calvinsecrest.com>
Date: Sun, 31 Aug 2025 19:01:06 -0400
Subject: [PATCH] add hardcoded localhost allowlist

---
 README.md                           | 1 +
 scripts/hardcoded-url-allowlist.txt | 5 +++++
 scripts/list-hardcoded-urls.sh      | 6 ++++++
 3 files changed, 12 insertions(+)
 create mode 100644 scripts/hardcoded-url-allowlist.txt

diff --git a/README.md b/README.md
index cfab9bc..88bfbf0 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,7 @@ Run the following script to detect any hardcoded `localhost` references before c
 ```
 
 The script lists offending lines and exits with a nonzero status if any are found.
+Existing references known to be safe are tracked in `scripts/hardcoded-url-allowlist.txt`.
 
 ## License
 MIT License – Feel free to modify and share. 📜
diff --git a/scripts/hardcoded-url-allowlist.txt b/scripts/hardcoded-url-allowlist.txt
new file mode 100644
index 0000000..f7be69e
--- /dev/null
+++ b/scripts/hardcoded-url-allowlist.txt
@@ -0,0 +1,5 @@
+FEDERATION_GUIDE.md
+backend/federation/federationSyncJob.js
+frontend/user_login.js
+frontend/federationStatusCLI.js
+README.md
diff --git a/scripts/list-hardcoded-urls.sh b/scripts/list-hardcoded-urls.sh
index 5378fb6..a323572 100755
--- a/scripts/list-hardcoded-urls.sh
+++ b/scripts/list-hardcoded-urls.sh
@@ -1,9 +1,15 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+ALLOWLIST_FILE="$(dirname "$0")/hardcoded-url-allowlist.txt"
+
 matches=$(grep -R --line-number --exclude-dir=node_modules --exclude-dir=.git -E "http://localhost|localhost:5000" || true)
 matches=$(echo "$matches" | grep -v 'scripts/list-hardcoded-urls.sh' || true)
 
+if [[ -f "$ALLOWLIST_FILE" ]]; then
+  matches=$(echo "$matches" | grep -F -v -f "$ALLOWLIST_FILE" || true)
+fi
+
 if [[ -n "$matches" ]]; then
   echo "$matches"
   echo "Hardcoded localhost URLs detected."