def is_origin_allowed(origin: str | None, registered_domain: str) -> bool:
    """
    Validates an incoming HTTP Origin header against a tenant's registered domain.
    Handles protocols (http://, https://), hostnames, and ports (e.g. 127.0.0.1:5500).
    """
    if not origin or not registered_domain:
        return False
    
    clean_origin = origin.strip().lower()
    if clean_origin.startswith("http://"):
        clean_origin = clean_origin[7:]
    elif clean_origin.startswith("https://"):
        clean_origin = clean_origin[8:]
    clean_origin = clean_origin.split("/")[0]

    clean_registered = registered_domain.strip().lower()
    if clean_registered.startswith("http://"):
        clean_registered = clean_registered[7:]
    elif clean_registered.startswith("https://"):
        clean_registered = clean_registered[8:]
    clean_registered = clean_registered.split("/")[0]

    # Exact match (e.g. "127.0.0.1:5500" == "127.0.0.1:5500" or "example.com" == "example.com")
    if clean_origin == clean_registered:
        return True
        
    # Match hostname ignoring port if registered domain has no port specified
    origin_host = clean_origin.split(":")[0]
    registered_host = clean_registered.split(":")[0]
    if origin_host == registered_host:
        return True

    # Allow local dev origins (localhost / 127.0.0.1) for local testing
    if origin_host in ("localhost", "127.0.0.1"):
        return True

    return False