GitNexus/gitnexus-web
samuel mbabhazi 0f3bad23b9
feat(web): resolve a root-relative GITNEXUS_BACKEND_URL against the page origin (#3640)
* feat(web): resolve a root-relative GITNEXUS_BACKEND_URL against the page origin

A GITNEXUS_BACKEND_URL of `/` (or `/prefix`) is injected as-is, and the
web client resolves it against the origin that served the page, so one
gitnexus-web deployment reaches its API on every hostname a reverse
proxy gives it. Protocol-relative values are left to the URL check and
rejected. Documents the two ways to route /api/* behind a proxy.

Closes #3593

* fix(web): reject a backslash-prefixed same-origin path

The URL parser reads a backslash as a slash, so `/\host` resolved against
the page origin became `http://host/`, an origin change. Both the server
check and the client resolution now treat it like `//host`.

* fix(web): keep a configured base ending in /api, and drop the unsupported direct route

normalizeServerUrl stripped a trailing /api from every URL, so a deployment
configured with GITNEXUS_BACKEND_URL=/proxy/api passed health and discovery
and then connected to /proxy/repo. The deployment's own base is now kept as
configured; the /api cleanup stays for hand-entered URLs. A regression covers
health, discovery and repository selection under /proxy/api.

The README no longer offers routing /api/* straight to `gitnexus serve` on a
public hostname: serve refuses to start with GITNEXUS_PUBLIC_ORIGIN set until
it has authentication of its own.

* fix(web): keep only a same-origin base as configured

The bypass in normalizeServerUrl matched any injected default, so an
absolute GITNEXUS_BACKEND_URL ending in /api would have produced a
doubled /api segment, and one carrying credentials would have kept them.
Only a root-relative deployment base is kept now; it is resolved from the
page origin, so it has neither. Absolute injected URLs are normalized as
before.
2026-10-24 08:45:24 +01:00
..
e2e fix: web citation/code panel bugs and serve analyze/route hardening (#3348) 2026-09-23 13:27:22 +01:00
src feat(web): resolve a root-relative GITNEXUS_BACKEND_URL against the page origin (#3640) 2026-10-24 08:45:24 +01:00
test feat(web): resolve a root-relative GITNEXUS_BACKEND_URL against the page origin (#3640) 2026-10-24 08:45:24 +01:00
.gitignore fix: web citation/code panel bugs and serve analyze/route hardening (#3348) 2026-09-23 13:27:22 +01:00
index.html feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
package-lock.json chore(deps)(deps): bump dompurify (#3699) 2026-10-23 21:02:27 +01:00
package.json chore(deps)(deps): bump dompurify (#3699) 2026-10-23 21:02:27 +01:00
playwright.config.ts fix: web citation/code panel bugs and serve analyze/route hardening (#3348) 2026-09-23 13:27:22 +01:00
tsconfig.app.json chore: compile first-party packages with TypeScript 7 (#3311) 2026-09-17 22:16:00 +01:00
tsconfig.json feat: configure prettier with pre-commit hook (#563) 2026-03-28 14:58:04 +00:00
tsconfig.node.json chore: compile first-party packages with TypeScript 7 (#3311) 2026-09-17 22:16:00 +01:00
vercel.json fix: web citation/code panel bugs and serve analyze/route hardening (#3348) 2026-09-23 13:27:22 +01:00
vite.config.ts chore(deps): consolidate ten Dependabot updates and fix compatibility (#3592) 2026-10-15 10:43:04 +01:00
vitest.config.ts chore(deps): consolidate ten Dependabot updates and fix compatibility (#3592) 2026-10-15 10:43:04 +01:00