Sylvain Duchesne
738d59596a
The test deployment keeps one base URL per environment, as the sibling ActivityPods apps do, so a pull-request preview lives on a single host: the app at the root, the backend under /api on the same host, its /.well-known routes at the origin root, the proxy passing paths through unchanged. SemApps already works that way — it mounts every route it adds under the base URL's path and keeps /.well-known at the root — but Festipod's own pieces were written for a backend at the root of its own origin: its routes (/app, /as/actor/app, /catalog) were mounted at fixed paths, the public-surface allow-list matched fixed paths (so under /api every request would have been refused), and the Solid-OIDC client_id joined the raw request path to the base URL, which would have repeated the base path (/api/api/...). base-path.js derives the base path from SEMAPPS_HOME_URL; the routes are mounted under it; the allow-list matches paths relative to it, the two /.well-known endpoints against the full path; the client_id is the requested URI rebuilt from the base URL as written, equal byte for byte to the actor URI and to what the front end derives. At the root every gate decision is identical to before (compared over ~8M method/path cases). The rights matrix probes /.well-known at the backend's origin root. Verified: bun test (424 pass); the full gate at the root; and the built images behind a local proxy routing /api and /.well-known unstripped with the Host header kept — login flow, rights matrix 98/98, revocation.
36 lines
1.9 KiB
JavaScript
36 lines
1.9 KiB
JavaScript
// The path the backend is served under, read from its base URL (SEMAPPS_HOME_URL): `/` when the
|
|
// backend owns its origin (http://localhost:3003 locally), `/api/` when it shares the front end's
|
|
// origin (https://<host>/api/, the Coolify layout, where one base URL per environment keeps pull
|
|
// request previews on a single host). The proxy in front passes the path through unchanged; SemApps
|
|
// mounts every route it adds under the base path, except the `/.well-known` ones, which stay at the
|
|
// origin root. Festipod's own routes and its public-surface allow-list follow the same split.
|
|
|
|
const urlJoin = require('url-join');
|
|
|
|
/** basePathOf(baseUrl) → the base URL's path, always ending with `/` (`/` when it has none or is unset). */
|
|
function basePathOf(baseUrl) {
|
|
if (!baseUrl) return '/';
|
|
const { pathname } = new URL(baseUrl);
|
|
return pathname.endsWith('/') ? pathname : `${pathname}/`;
|
|
}
|
|
|
|
/** underBasePath(basePath, path) → the absolute `path` (e.g. `/catalog`) as mounted under `basePath`. */
|
|
function underBasePath(basePath, path) {
|
|
return basePath + path.replace(/^\/+/, '');
|
|
}
|
|
|
|
/**
|
|
* requestUri(baseUrl, requestPath) → the absolute URI a request was made to. `requestPath` is the raw
|
|
* path the gateway received (moleculer-web's `originalUrl`), base path included: the base path is
|
|
* taken off before joining it to the base URL, which would otherwise repeat it. Joining (rather than
|
|
* resolving with `new URL`) keeps the base URL exactly as written — host case, explicit port — so the
|
|
* result matches the URIs the backend mints from the same base URL, its actor's first.
|
|
*/
|
|
function requestUri(baseUrl, requestPath) {
|
|
const basePath = basePathOf(baseUrl);
|
|
const relative = requestPath.startsWith(basePath) ? requestPath.slice(basePath.length - 1) : requestPath;
|
|
return urlJoin(baseUrl, relative);
|
|
}
|
|
|
|
module.exports = { basePathOf, underBasePath, requestUri };
|