fix: support dev server previews over relay

packages/web/server/lib/relay/tunnel-host.test.js

@@ -1,7 +1,7 @@
 import { describe, test, expect } from 'bun:test';
 import http from 'node:http';
 
-import { createTunnelHost } from './tunnel-host.js';
+import { createTunnelHost, isAllowedRelayWebSocketPath } from './tunnel-host.js';
 import { decodeTunnelFrame, encodeTunnelFrame, encodeJsonPayload, TunnelFrameType } from './tunnel-codec.js';
 
 const startLoopback = () =>
@@ -145,3 +145,11 @@ describe('tunnel-host HTTP body forwarding', () => {
     await loopback.stop();
   });
 });
+
+describe('relay host WebSocket allowlist', () => {
+  test('allows only the exact dev-server tunnel path', () => {
+    expect(isAllowedRelayWebSocketPath('/api/dev-tunnel')).toBe(true);
+    expect(isAllowedRelayWebSocketPath('/api/dev-tunnel/')).toBe(false);
+    expect(isAllowedRelayWebSocketPath('/api/database/ws')).toBe(false);
+  });
+});