feat(mobile): add custom headers configuration in sign-in screen (#2103)

* feat(mobile): add custom headers configuration in sign-in screen

Add ability for mobile app users to configure custom HTTP headers that are
sent with every API request. This enables users to add authentication headers,
proxy headers, or other custom headers required by their server setup.

Changes:
- Add customHeaders field to mobile app settings schema
- Create CustomHeadersModal component for managing headers
- Update sign-in screen with link to configure custom headers
- Modify tRPC provider to merge custom headers with Authorization header

The custom headers are stored securely in the app settings and persist
across sessions.

* fix keyboard

* add custom headers to other callsites

---------

Co-authored-by: Claude <noreply@anthropic.com>

4 files changed, 21 insertions, 4 deletions

diff --git a/apps/mobile/lib/hooks.ts b/apps/mobile/lib/hooks.ts
index beeab391..38ecebea 100644
--- a/apps/mobile/lib/hooks.ts
+++ b/apps/mobile/lib/hooks.ts
@@ -1,13 +1,12 @@
 import { ImageURISource } from "react-native";
 
 import useAppSettings from "./settings";
+import { buildApiHeaders } from "./utils";
 
 export function useAssetUrl(assetId: string): ImageURISource {
   const { settings } = useAppSettings();
   return {
     uri: `${settings.address}/api/assets/${assetId}`,
-    headers: {
-      Authorization: `Bearer ${settings.apiKey}`,
-    },
+    headers: buildApiHeaders(settings.apiKey, settings.customHeaders),
   };
 }
diff --git a/apps/mobile/lib/settings.ts b/apps/mobile/lib/settings.ts
index 4399e04a..aa931b9e 100644
--- a/apps/mobile/lib/settings.ts
+++ b/apps/mobile/lib/settings.ts
@@ -15,6 +15,7 @@ const zSettingsSchema = z.object({
     .optional()
     .default("reader"),
   showNotes: z.boolean().optional().default(false),
+  customHeaders: z.record(z.string(), z.string()).optional().default({}),
 });
 
 export type Settings = z.infer<typeof zSettingsSchema>;
@@ -34,6 +35,7 @@ const useSettings = create<AppSettingsState>((set, get) => ({
       theme: "system",
       defaultBookmarkView: "reader",
       showNotes: false,
+      customHeaders: {},
     },
   },
   setSettings: async (settings) => {
diff --git a/apps/mobile/lib/upload.ts b/apps/mobile/lib/upload.ts
index 0eeab380..06f007f7 100644
--- a/apps/mobile/lib/upload.ts
+++ b/apps/mobile/lib/upload.ts
@@ -9,6 +9,7 @@ import {
 
 import type { Settings } from "./settings";
 import { api } from "./trpc";
+import { buildApiHeaders } from "./utils";
 
 export function useUploadAsset(
   settings: Settings,
@@ -43,7 +44,7 @@ export function useUploadAsset(
         "POST",
         `${settings.address}/api/assets`,
         {
-          Authorization: `Bearer ${settings.apiKey}`,
+          ...buildApiHeaders(settings.apiKey, settings.customHeaders),
           "Content-Type": "multipart/form-data",
         },
         [
diff --git a/apps/mobile/lib/utils.ts b/apps/mobile/lib/utils.ts
index bfb6c9ed..ce729826 100644
--- a/apps/mobile/lib/utils.ts
+++ b/apps/mobile/lib/utils.ts
@@ -42,3 +42,18 @@ export function condProps(
     return condition ? { ...acc, ...props } : acc;
   }, {});
 }
+
+/**
+ * Build HTTP headers for API requests, merging Authorization and custom headers.
+ * This ensures all direct HTTP calls (uploads, downloads, health checks) respect
+ * the user's custom header configuration.
+ */
+export function buildApiHeaders(
+  apiKey: string | undefined,
+  customHeaders: Record<string, string> = {},
+): Record<string, string> {
+  return {
+    ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    ...customHeaders,
+  };
+}