[codex] Add scoped EPG security trust controls (#1054)

* Add scoped EPG security trust controls

* fix: address scoped trust review feedback

---------

Co-authored-by: 4gray <fourgray@proton.me>

apps/electron-backend/src/app/util/secure-https.ts

@@ -1,5 +1,6 @@
 import { Agent } from 'node:https';
 import type { LookupFunction } from 'node:net';
+import { normalizeHost } from '@iptvnator/shared/interfaces';
 import type { ValidatedRequestAgentFactory } from './validated-axios';
 
 const INSECURE_TLS_ENV = 'IPTVNATOR_ALLOW_INSECURE_TLS';
@@ -18,6 +19,20 @@ export function isInsecureTlsAllowed(): boolean {
     return value === '1' || value === 'true';
 }
 
+function shouldTrustInvalidCertificateForHost(
+    url: URL | undefined,
+    trustedHosts: readonly string[]
+): boolean {
+    if (!url) {
+        return false;
+    }
+
+    const host = normalizeHost(url.hostname);
+    return trustedHosts.some(
+        (trustedHost) => normalizeHost(trustedHost) === host
+    );
+}
+
 /**
  * Builds the agent factory used for remote playlist fetches.
  *
@@ -25,12 +40,22 @@ export function isInsecureTlsAllowed(): boolean {
  * (see {@link isInsecureTlsAllowed}). The validated request layer supplies a
  * DNS lookup pinned to the addresses approved for each redirect hop.
  */
-export function createPlaylistAgentFactory(): ValidatedRequestAgentFactory & {
-    createHttpsAgent(lookup?: LookupFunction): Agent;
+export function createPlaylistAgentFactory(
+    options: {
+        trustedInsecureTlsHosts?: readonly string[];
+    } = {}
+): ValidatedRequestAgentFactory & {
+    createHttpsAgent(lookup?: LookupFunction, url?: URL): Agent;
 } {
-    const rejectUnauthorized = !isInsecureTlsAllowed();
+    const trustedHosts = options.trustedInsecureTlsHosts ?? [];
 
     return {
-        createHttpsAgent: (lookup) => new Agent({ lookup, rejectUnauthorized }),
+        createHttpsAgent: (lookup, url) =>
+            new Agent({
+                lookup,
+                rejectUnauthorized:
+                    !isInsecureTlsAllowed() &&
+                    !shouldTrustInvalidCertificateForHost(url, trustedHosts),
+            }),
     };
 }