Summary

buildResourceUrl in src/auth/middleware.js uses request.hostname which in Fastify returns the hostname without port (e.g. localhost). But ACLs reference full URLs with port (e.g. http://localhost:4443/alice/public/premium.json).

The constructed resourceUrl http://localhost/alice/... never matches the ACL's accessTo of http://localhost:4443/alice/..., so conditional authorizations (like PaymentCondition) fail even when they should pass.

Reproduction

1. jss start --pay (runs on port 4443)
2. Create resource and ACL with accessTo: http://localhost:4443/alice/public/premium.json
3. PaymentCondition with amount 0, deposit sats, try to access
4. Gets 402 even though balance exists — because URL doesn't match

Fix

Use request.headers.host (includes port) instead of request.hostname (strips port) in buildResourceUrl.

Impact

Affects all ACL matching on non-standard ports. Default port 4443 is always affected. Only port 80/443 would accidentally work since browsers omit those from Host headers.