From 901827df7f03ae51b00a521a5076b4b041948741 Mon Sep 17 00:00:00 2001
From: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Date: Fri, 22 May 2026 23:15:04 +0200
Subject: [PATCH] fix(#2575): check DB feature flag override in
 arePrivateProviderUrlsAllowed() (#2595)

Integrated into release/v3.8.2
---
 src/shared/network/outboundUrlGuard.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/shared/network/outboundUrlGuard.ts b/src/shared/network/outboundUrlGuard.ts
index 09385caae0..2344092a4a 100644
--- a/src/shared/network/outboundUrlGuard.ts
+++ b/src/shared/network/outboundUrlGuard.ts
@@ -1,4 +1,5 @@
 import { isIP } from "node:net";
+import { resolveFeatureFlag } from "@/shared/utils/featureFlags";
 
 const TRUE_ENV_VALUES = new Set(["1", "true", "yes", "on"]);
 
@@ -128,6 +129,14 @@ export function arePrivateProviderUrlsAllowed() {
   if (legacyValue && ["false", "0", "no", "off"].includes(legacyValue.trim().toLowerCase()))
     return true;
 
+  // Check feature flag DB override — supports runtime toggle without restart
+  try {
+    const dbValue = resolveFeatureFlag(PRIVATE_PROVIDER_URLS_ENV);
+    if (dbValue && TRUE_ENV_VALUES.has(dbValue.trim().toLowerCase())) return true;
+  } catch {
+    // DB not initialized yet — fall back to env-only check
+  }
+
   return false;
 }