/r/ redirects: add bsky.app to domain allowlist

redirect.py

@@ -38,6 +38,9 @@ _negotiator = ContentNegotiator(acceptable=[
     AcceptParameters(ContentType(as2.CONTENT_TYPE_LD)),
 ])
 
+DOMAIN_ALLOWLIST = frozenset((
+    'bsky.app',
+))
 
 @app.get(r'/r/<path:to>')
 @flask_util.cached(cache, CACHE_TIME, headers=['Accept'])
@@ -79,6 +82,8 @@ def redir(to):
                    to_domain))
     for domain in domains:
         if domain:
+            if domain in DOMAIN_ALLOWLIST:
+                break
             g.user = Web.get_by_id(domain)
             if g.user:
                 logger.info(f'Found web user for domain {domain}')

tests/test_redirect.py

@@ -51,6 +51,11 @@ class RedirectTest(testutil.TestCase):
         got = self.client.get('/r/http://bar.com/baz')
         self.assertEqual(404, got.status_code)
 
+    def test_redirect_html_domain_allowlist(self):
+        got = self.client.get('/r/http://bsky.app/baz')
+        self.assertEqual(301, got.status_code)
+        self.assertEqual('http://bsky.app/baz', got.headers['Location'])
+
     def test_redirect_single_slash(self):
         got = self.client.get('/r/https:/user.com/bar')
         self.assertEqual(301, got.status_code)