From 090edc5c2ceb098da7c372ad45360455aa9a9248 Mon Sep 17 00:00:00 2001
From: Lotus CI <ci@lotusguild.org>
Date: Mon, 19 Oct 2026 12:37:53 -0400
Subject: [PATCH] feat(lotus): accept decorations from chat.lotusguild.org
 (matrix #22)

Decorations moved off Nextcloud to https://chat.lotusguild.org/decorations.
Add that origin to ALLOWED_DECORATION_ORIGINS (first, so tests use it);
keep drive.lotusguild.org until no host build points there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
---
 src/lotus/lotusDecorations.test.ts | 30 ++++++++++++++++++++++++++++++
 src/lotus/lotusDecorations.ts      |  4 ++++
 2 files changed, 34 insertions(+)

diff --git a/src/lotus/lotusDecorations.test.ts b/src/lotus/lotusDecorations.test.ts
index 633c8a9a..47f15fb6 100644
--- a/src/lotus/lotusDecorations.test.ts
+++ b/src/lotus/lotusDecorations.test.ts
@@ -83,6 +83,36 @@ test("[lotus #28] safeImageUrl only accepts the pinned decoration CDN origin (or
   stop();
 });
 
+test("[matrix #22] both the new decoration host and the old Nextcloud one are accepted", () => {
+  const stop = startLotusDecorations();
+  const { result } = renderHook(() => useLotusDecoration("@alice:example.org"));
+
+  pushDecorations({
+    "@alice:example.org":
+      "https://chat.lotusguild.org/decorations/joystick.png",
+  });
+  expect(result.current).toBe(
+    "https://chat.lotusguild.org/decorations/joystick.png",
+  );
+
+  pushDecorations({
+    "@alice:example.org":
+      "https://drive.lotusguild.org/public.php/dav/files/x/cinny-decorations/joystick.png",
+  });
+  expect(result.current).toBe(
+    "https://drive.lotusguild.org/public.php/dav/files/x/cinny-decorations/joystick.png",
+  );
+
+  // A look-alike subdomain is a different origin.
+  pushDecorations({
+    "@alice:example.org":
+      "https://chat.lotusguild.org.evil.example/joystick.png",
+  });
+  expect(result.current).toBeUndefined();
+
+  stop();
+});
+
 test("[lotus #17] the roster survives a handler remount within the same page session", () => {
   const stop1 = startLotusDecorations();
   pushDecorations({
diff --git a/src/lotus/lotusDecorations.ts b/src/lotus/lotusDecorations.ts
index 0859dcc4..f5729655 100644
--- a/src/lotus/lotusDecorations.ts
+++ b/src/lotus/lotusDecorations.ts
@@ -45,7 +45,11 @@ export function useLotusDecoration(userId: string): string | undefined {
 // to the actual decoration CDN origin(s) — cinny's `DECORATION_CDN`
 // (`avatarDecorations.ts`) — plus `blob:`, which EC itself may use for local
 // previews. Exported so a future CDN move is a one-line edit here.
+//
+// matrix #22: decorations moved off Nextcloud to chat.lotusguild.org/decorations
+// (first entry). drive.lotusguild.org stays until no host build points there.
 export const ALLOWED_DECORATION_ORIGINS: readonly string[] = [
+  "https://chat.lotusguild.org",
   "https://drive.lotusguild.org",
 ];