feat(extension-auth): accept Firefox identity redirect hosts for extension auth

[ManthanNimodiya]

Firefox's identity.launchWebAuthFlow redirects to https://.extensions.allizom.org/.

Generalizes validateExtensionRedirectUri to a host-suffix table and adds optional CAP_FIREFOX_EXTENSION_ID (packages/env).

Chrome pinning and the localhost-dev escape hatch unchanged. Independent of the other PRs.
(For production later: the hash for gecko id extension@cap.so is 324e9362f26688ae2eb9a75d1beae53ef6b8d0d2.)

Greptile Summary

This PR adds Firefox identity redirect support to extension auth. The main changes are:

• Adds optional CAP_FIREFOX_EXTENSION_ID to server env validation.
• Replaces the Chrome-only redirect suffix with a browser identity-host table.
• Updates the extension consent heading to use browser-neutral wording.

Confidence Score: 5/5

This looks safe to merge after a small config-normalization cleanup.

• The auth redirect checks keep the existing HTTPS, suffix, configured-id, and localhost-only fallback behavior.
• The remaining issue can reject a valid Firefox setup when the env value is copied with uppercase characters.

packages/web-backend/src/Extension/Http.ts

Important Files Changed

Filename	Overview
packages/env/server.ts	Adds the optional Firefox redirect subdomain env var alongside the existing Chrome extension id setting.
packages/web-backend/src/Extension/Http.ts	Generalizes extension redirect validation across Chrome and Firefox identity hosts and updates the consent page copy.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/web-backend/src/Extension/Http.ts:51
**Mixed-Case Firefox Id Rejection**

`URL.hostname` is normalized to lowercase before `extensionId` is sliced, but the new Firefox id comes straight from `CAP_FIREFOX_EXTENSION_ID`. If that env var is copied with uppercase characters, the configured-id check rejects the real Firefox redirect host and the extension auth flow always returns a bad request.

```suggestion
		const configuredExtensionId = identityHost
			.getConfiguredExtensionId()
			?.toLowerCase();
```

_{Reviews (1): Last reviewed commit: "feat(extension-auth): accept Firefox ide..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)

[greptile-apps]

Mixed-Case Firefox Id Rejection

URL.hostname is normalized to lowercase before extensionId is sliced, but the new Firefox id comes straight from CAP_FIREFOX_EXTENSION_ID. If that env var is copied with uppercase characters, the configured-id check rejects the real Firefox redirect host and the extension auth flow always returns a bad request.

Suggested change

	const configuredExtensionId = identityHost.getConfiguredExtensionId();
	const configuredExtensionId = identityHost
	.getConfiguredExtensionId()
	?.toLowerCase();

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/web-backend/src/Extension/Http.ts
Line: 51

Comment:
**Mixed-Case Firefox Id Rejection**

`URL.hostname` is normalized to lowercase before `extensionId` is sliced, but the new Firefox id comes straight from `CAP_FIREFOX_EXTENSION_ID`. If that env var is copied with uppercase characters, the configured-id check rejects the real Firefox redirect host and the extension auth flow always returns a bad request.

```suggestion
		const configuredExtensionId = identityHost
			.getConfiguredExtensionId()
			?.toLowerCase();
```

How can I resolve this? If you propose a fix, please make it concise.

[tembo]

Might be worth rejecting non-default ports / credentials here to keep the redirect URI shape tight (and avoid surprises if browser behavior changes).

Suggested change

	if (url.protocol !== "https:" || !identityHost) {
	if (
	url.protocol !== "https:" ||
	url.port !== "" ||
	url.username ||
	url.password ||
	!identityHost
	) {
	return yield* new HttpApiError.BadRequest();
	}

[tembo]

Since the comment says the leading label identifies the extension installation, it could be good to explicitly reject multi-label hosts (e.g. a.b.chromiumapp.org).

Suggested change

	const extensionId = url.hostname.slice(0, -identityHost.suffix.length);
	const configuredExtensionId = identityHost.getConfiguredExtensionId();
	const extensionId = url.hostname.slice(0, -identityHost.suffix.length);
	if (extensionId.includes(".")) {
	return yield* new HttpApiError.BadRequest();
	}
	const configuredExtensionId = identityHost.getConfiguredExtensionId();