feat(extension-auth): accept Firefox identity redirect hosts for extension auth

[ManthanNimodiya]

Firefox's identity.launchWebAuthFlow redirects to https://.extensions.allizom.org/.

Generalizes validateExtensionRedirectUri to a host-suffix table and adds optional CAP_FIREFOX_EXTENSION_ID (packages/env).

Chrome pinning and the localhost-dev escape hatch unchanged. Independent of the other PRs.
(For production later: the hash for gecko id extension@cap.so is 324e9362f26688ae2eb9a75d1beae53ef6b8d0d2.)

Greptile Summary

This PR adds Firefox redirect host support to extension auth. The main changes are:

• Adds optional CAP_FIREFOX_EXTENSION_ID server configuration.
• Generalizes identity redirect validation across Chromium and Firefox host suffixes.
• Normalizes the configured extension id before comparing it with the redirect host.
• Updates the consent page heading to use browser-neutral wording.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
packages/env/server.ts	Adds the optional Firefox extension redirect id to the server env schema.
packages/web-backend/src/Extension/Http.ts	Validates extension auth redirects through a browser suffix table and compares against the normalized configured id.

_{Reviews (2): Last reviewed commit: "fix(extension-auth): normalize configure..." | Re-trigger Greptile}

Context used:

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)

[greptile-apps]

Mixed-Case Firefox Id Rejection

URL.hostname is normalized to lowercase before extensionId is sliced, but the new Firefox id comes straight from CAP_FIREFOX_EXTENSION_ID. If that env var is copied with uppercase characters, the configured-id check rejects the real Firefox redirect host and the extension auth flow always returns a bad request.

Suggested change

	const configuredExtensionId = identityHost.getConfiguredExtensionId();
	const configuredExtensionId = identityHost
	.getConfiguredExtensionId()
	?.toLowerCase();

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/web-backend/src/Extension/Http.ts
Line: 51

Comment:
**Mixed-Case Firefox Id Rejection**

`URL.hostname` is normalized to lowercase before `extensionId` is sliced, but the new Firefox id comes straight from `CAP_FIREFOX_EXTENSION_ID`. If that env var is copied with uppercase characters, the configured-id check rejects the real Firefox redirect host and the extension auth flow always returns a bad request.

```suggestion
		const configuredExtensionId = identityHost
			.getConfiguredExtensionId()
			?.toLowerCase();
```

How can I resolve this? If you propose a fix, please make it concise.

[tembo]

Might be worth rejecting non-default ports / credentials here to keep the redirect URI shape tight (and avoid surprises if browser behavior changes).

Suggested change

	if (url.protocol !== "https:" || !identityHost) {
	if (
	url.protocol !== "https:" ||
	url.port !== "" ||
	url.username ||
	url.password ||
	!identityHost
	) {
	return yield* new HttpApiError.BadRequest();
	}

[tembo]

Since the comment says the leading label identifies the extension installation, it could be good to explicitly reject multi-label hosts (e.g. a.b.chromiumapp.org).

Suggested change

	const extensionId = url.hostname.slice(0, -identityHost.suffix.length);
	const configuredExtensionId = identityHost.getConfiguredExtensionId();
	const extensionId = url.hostname.slice(0, -identityHost.suffix.length);
	if (extensionId.includes(".")) {
	return yield* new HttpApiError.BadRequest();
	}
	const configuredExtensionId = identityHost.getConfiguredExtensionId();

[ManthanNimodiya]

@greptileai