[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Mar 21, 2026 4:19pm
portal (staging)	Ready	Preview, Comment	Mar 21, 2026 4:19pm

[cursor]

PR Summary

Medium Risk
Modifies CORS/Origin validation to allow subdomains and DB-backed custom domains, which affects CSRF/CORS protections and depends on Redis/env configuration. Also refactors directory sync email filtering into a shared module used by both API sync and Google Workspace checks, which could change which users are included/excluded.

Overview
Origin/CORS hardening and flexibility: replaces the static getTrustedOrigins() allowlist usage with an async isTrustedOrigin() check in main.ts CORS and originCheckMiddleware, allowing trusted *.trycomp.ai/*.trust.inc subdomains and verified custom domains loaded from the DB and cached in Upstash Redis (5 min TTL). Error CORS headers are now only applied when isStaticTrustedOrigin() passes.

Directory sync filter reuse: moves Google Workspace sync email include/exclude term parsing/matching into packages/integration-platform (parseSyncFilterTerms, matchesSyncFilterTerms), reuses it in SyncController and the Google Workspace two-factor-auth check, and adds unit tests; related mocks/tests were updated for the new async origin logic and shared exports.

^{Written by Cursor Bugbot for commit 10c467d. This will update automatically on new commits. Configure here.}

[claudfuen]

🎉 This PR is included in version 3.10.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀