erik/erikvancraddock.com
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

API metadata advertises HTTP URLs on HTTPS website #21

New issue
Open
opened 2026-10-13 11:09:20 -05:00 by erik · 5 comments
erik commented 2026-10-13 11:09:20 -05:00
Owner
Copy link

Summary

The production website serves its API over HTTPS but advertises HTTP API URLs in its metadata. This blocks Rott website connection verification. Observed October 13, 2026; underlying cause is not yet established.

Steps to reproduce

  1. Run curl -sS https://erikvancraddock.com/api/v1/meta (no credentials required).
  2. Inspect api.baseUrl and api.openapiUrl in the HTTP 200 response.
  3. Attempt to connect Rott 0.1.0 build 1 to https://erikvancraddock.com.

Expected behavior

  • Metadata advertises https://erikvancraddock.com/api/v1 and https://erikvancraddock.com/api/v1/openapi.json, consistent with the public HTTPS endpoint.

Actual behavior

  • site.url is https://erikvancraddock.com.
  • api.baseUrl is http://erikvancraddock.com/api/v1.
  • api.openapiUrl is http://erikvancraddock.com/api/v1/openapi.json.
  • Rott rejects the advertised API address with SlugKit input: API requires HTTPS during anonymous metadata discovery. This does not establish API-key validity.
  • Reported software is slugkit-template 0.3.13 and @evcraddock/slug-api 0.1.1.

Acceptance criteria

  • Identify the cause of incorrect public API scheme generation.
  • The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs.
  • Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks.
## Summary The production website serves its API over HTTPS but advertises HTTP API URLs in its metadata. This blocks Rott website connection verification. Observed October 13, 2026; underlying cause is not yet established. ## Steps to reproduce 1. Run `curl -sS https://erikvancraddock.com/api/v1/meta` (no credentials required). 2. Inspect `api.baseUrl` and `api.openapiUrl` in the HTTP 200 response. 3. Attempt to connect Rott 0.1.0 build 1 to `https://erikvancraddock.com`. ## Expected behavior - Metadata advertises `https://erikvancraddock.com/api/v1` and `https://erikvancraddock.com/api/v1/openapi.json`, consistent with the public HTTPS endpoint. ## Actual behavior - `site.url` is `https://erikvancraddock.com`. - `api.baseUrl` is `http://erikvancraddock.com/api/v1`. - `api.openapiUrl` is `http://erikvancraddock.com/api/v1/openapi.json`. - Rott rejects the advertised API address with `SlugKit input: API requires HTTPS` during anonymous metadata discovery. This does not establish API-key validity. - Reported software is slugkit-template 0.3.13 and @evcraddock/slug-api 0.1.1. ## Acceptance criteria - [ ] Identify the cause of incorrect public API scheme generation. - [ ] The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs. - [ ] Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks.
erik commented 2026-10-13 11:09:20 -05:00
Author
Owner
Copy link

Synced from todu comment by @todu on 2026-10-13T16:06:19.373Z

Investigation handoff

  • Verified: curl -sS https://erikvancraddock.com/api/v1/meta returns HTTP 200 over HTTPS without credentials.
  • Returned site.url uses HTTPS, but api.baseUrl is http://erikvancraddock.com/api/v1 and api.openapiUrl is http://erikvancraddock.com/api/v1/openapi.json.
  • Rott uses the correct HTTPS website address. Anonymous discovery rejects the advertised HTTP base; this failure does not establish API-key validity.
  • Rott reference: Client::discover in crates/rott-core/src/slugkit/client.rs calls Endpoint::advertised in crates/rott-core/src/slugkit/endpoint.rs. Parsing that HTTP base triggers API requires HTTPS.
  • The demonstrated website defect is incorrect API metadata. Root cause remains unverified; public-origin configuration and reverse-proxy scheme handling are investigation leads only.
  • The migration-notes link is unrelated to this rejection.
  • No production changes were made. Erik will have someone else implement the fix.
  • After correction, verify the HTTPS metadata URLs and confirm Rott proceeds beyond discovery without weakening HTTPS checks.
_Synced from todu comment by @todu on 2026-10-13T16:06:19.373Z_ ### Investigation handoff - Verified: `curl -sS https://erikvancraddock.com/api/v1/meta` returns HTTP 200 over HTTPS without credentials. - Returned `site.url` uses HTTPS, but `api.baseUrl` is `http://erikvancraddock.com/api/v1` and `api.openapiUrl` is `http://erikvancraddock.com/api/v1/openapi.json`. - Rott uses the correct HTTPS website address. Anonymous discovery rejects the advertised HTTP base; this failure does not establish API-key validity. - Rott reference: `Client::discover` in `crates/rott-core/src/slugkit/client.rs` calls `Endpoint::advertised` in `crates/rott-core/src/slugkit/endpoint.rs`. Parsing that HTTP base triggers `API requires HTTPS`. - The demonstrated website defect is incorrect API metadata. Root cause remains unverified; public-origin configuration and reverse-proxy scheme handling are investigation leads only. - The migration-notes link is unrelated to this rejection. - No production changes were made. Erik will have someone else implement the fix. - After correction, verify the HTTPS metadata URLs and confirm Rott proceeds beyond discovery without weakening HTTPS checks.
erik commented 2026-10-13 11:20:04 -05:00
Author
Owner
Copy link

Synced from todu comment by @todu on 2026-10-13T16:17:37.126Z

Review update

  • PR: #22 — open; reviewed commit 9bccbbf0d306d19a9b364be4e72dc12ecebd77a9.
  • Summary: The scoped fix uses the configured public site origin instead of the proxy-facing request origin. Persisted configuration retains precedence over file-backed defaults. The regression coverage includes internal HTTP requests, hostile Host/Forwarded headers, local HTTP, explicit ports, and configured paths. Documentation matches the implementation. No code correctness or security defect found in the reviewed diff; Rott and HTTPS checks are unchanged.
  • Verification evidence: Parent reports passing build, typecheck, lint, test:ci (399 tests), npm test (475 tests), targeted API tests (12 tests), and git diff --check. These checks were not rerun by this reviewer.

Acceptance criteria

  • met — Identify the cause of incorrect public API scheme generation. @evcraddock/slug-api@0.1.1 uses new URL(input.requestUrl).origin; the previous route passed context.req.url. Thus proxy-facing HTTP determines advertised API URLs despite HTTPS site configuration. The replacement passes site.url.
  • partial — The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs. The route regression tests assert both required HTTPS URLs with persisted production-style site configuration and HTTP requests. This proves local generation, not the deployed production response; production deployment and verification have not occurred.
  • not-evident — Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks. No Rott discovery run/result is supplied. Leaving Rott and HTTPS validation unchanged supports the safety constraint but does not confirm discovery proceeds.

Blocking issues (2)

  1. Production verification remains incomplete: following human-approved merge/release/deployment, verify the anonymous production metadata response advertises https://erikvancraddock.com/api/v1 and https://erikvancraddock.com/api/v1/openapi.json.
  2. Rott discovery verification remains absent: after deployment, demonstrate discovery proceeds beyond API requires HTTPS without weakening HTTPS checks. Discovery does not establish API-key validity.
  • Warnings: None.
  • Final verdict: changes-requested, required by the common review rule for a not-evident acceptance criterion. This is an acceptance-evidence gap, not a request for speculative repository edits or weakened criteria.
  • Criteria totals: 3 total, 1 met, 2 incomplete (1 partial, 1 not-evident).
  • Follow-up: Human-approved rollout and the two acceptance checks are required before task completion. Keep the PR and task open; no merge, deployment, task closure, or criteria changes were performed by this reviewer.
_Synced from todu comment by @todu on 2026-10-13T16:17:37.126Z_ ### Review update - PR: https://forge.caradoc.com/erik/erikvancraddock.com/pulls/22 — open; reviewed commit `9bccbbf0d306d19a9b364be4e72dc12ecebd77a9`. - Summary: The scoped fix uses the configured public site origin instead of the proxy-facing request origin. Persisted configuration retains precedence over file-backed defaults. The regression coverage includes internal HTTP requests, hostile Host/Forwarded headers, local HTTP, explicit ports, and configured paths. Documentation matches the implementation. No code correctness or security defect found in the reviewed diff; Rott and HTTPS checks are unchanged. - Verification evidence: Parent reports passing build, typecheck, lint, test:ci (399 tests), npm test (475 tests), targeted API tests (12 tests), and git diff --check. These checks were not rerun by this reviewer. #### Acceptance criteria - **met** — Identify the cause of incorrect public API scheme generation. `@evcraddock/slug-api@0.1.1` uses `new URL(input.requestUrl).origin`; the previous route passed `context.req.url`. Thus proxy-facing HTTP determines advertised API URLs despite HTTPS site configuration. The replacement passes `site.url`. - **partial** — The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs. The route regression tests assert both required HTTPS URLs with persisted production-style site configuration and HTTP requests. This proves local generation, not the deployed production response; production deployment and verification have not occurred. - **not-evident** — Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks. No Rott discovery run/result is supplied. Leaving Rott and HTTPS validation unchanged supports the safety constraint but does not confirm discovery proceeds. #### Blocking issues (2) 1. Production verification remains incomplete: following human-approved merge/release/deployment, verify the anonymous production metadata response advertises `https://erikvancraddock.com/api/v1` and `https://erikvancraddock.com/api/v1/openapi.json`. 2. Rott discovery verification remains absent: after deployment, demonstrate discovery proceeds beyond `API requires HTTPS` without weakening HTTPS checks. Discovery does not establish API-key validity. - Warnings: None. - Final verdict: **changes-requested**, required by the common review rule for a not-evident acceptance criterion. This is an acceptance-evidence gap, not a request for speculative repository edits or weakened criteria. - Criteria totals: 3 total, 1 met, 2 incomplete (1 partial, 1 not-evident). - Follow-up: Human-approved rollout and the two acceptance checks are required before task completion. Keep the PR and task open; no merge, deployment, task closure, or criteria changes were performed by this reviewer.
erik commented 2026-10-13 11:20:04 -05:00
Author
Owner
Copy link

Synced from todu comment by @todu on 2026-10-13T16:15:58.162Z

Implementation update

  • Root cause confirmed: slug-api@0.1.1 generates API URLs from the request origin; the metadata route supplied the proxy-facing HTTP request even though the configured site URL uses HTTPS.
  • Fixed metadata generation to use the configured site URL, preserving local HTTP/ports and ignoring request Host/Forwarded headers. No Rott or HTTPS-validation changes.
  • Added 7 metadata regression cases and updated the existing route expectation and API documentation.
  • Verified build, typecheck, lint, CI tests (399 passed), full suite including integrations (475 passed), and diff whitespace checks.
  • PR: #22 (commit 9bccbbf).
  • Production metadata and Rott discovery acceptance checks remain pending approved merge/release/deployment; this is not task completion.
_Synced from todu comment by @todu on 2026-10-13T16:15:58.162Z_ ### Implementation update - Root cause confirmed: `slug-api@0.1.1` generates API URLs from the request origin; the metadata route supplied the proxy-facing HTTP request even though the configured site URL uses HTTPS. - Fixed metadata generation to use the configured site URL, preserving local HTTP/ports and ignoring request Host/Forwarded headers. No Rott or HTTPS-validation changes. - Added 7 metadata regression cases and updated the existing route expectation and API documentation. - Verified build, typecheck, lint, CI tests (399 passed), full suite including integrations (475 passed), and diff whitespace checks. - PR: https://forge.caradoc.com/erik/erikvancraddock.com/pulls/22 (commit `9bccbbf`). - Production metadata and Rott discovery acceptance checks remain pending approved merge/release/deployment; this is not task completion.
erik commented 2026-10-13 11:30:50 -05:00
Author
Owner
Copy link

Synced from todu comment by @todu on 2026-10-13T16:27:48.042Z

Merge and release preparation

  • Human approved merging PR #22 with production/Rott acceptance evidence deferred until rollout. PR merged at 1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb; local main fast-forwarded and merged feature branches cleaned up.
  • Human selected patch release 0.3.14. Clean/current main, absent release tag, and required Forgejo secret names were verified. Fresh npm ci/build/lint/full tests (475 passing) and Docker production-image health/homepage/version validation passed; generated files remain unchanged and the disposable validation container was removed.
  • Read-only production inspection confirms version 0.3.13, one ready Recreate replica, matching app/init image 20261005T222145Z, HTTPS public origin and HSTS max-age 300. Flux timestamp image automation is active.
  • No schema, migration, database, media, runtime configuration or secret changes are included. Release-specific production publication approval is still required; no tag pushed and no deployment performed.
  • Existing dependency advisories remain: npm ci reports 20 (10 moderate, 10 high); production image installation reports 8 (6 moderate, 2 high). No dependency remediation was attempted in this scoped metadata fix.
_Synced from todu comment by @todu on 2026-10-13T16:27:48.042Z_ ### Merge and release preparation - Human approved merging PR #22 with production/Rott acceptance evidence deferred until rollout. PR merged at `1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb`; local main fast-forwarded and merged feature branches cleaned up. - Human selected patch release `0.3.14`. Clean/current main, absent release tag, and required Forgejo secret names were verified. Fresh npm ci/build/lint/full tests (475 passing) and Docker production-image health/homepage/version validation passed; generated files remain unchanged and the disposable validation container was removed. - Read-only production inspection confirms version 0.3.13, one ready Recreate replica, matching app/init image `20261005T222145Z`, HTTPS public origin and HSTS max-age 300. Flux timestamp image automation is active. - No schema, migration, database, media, runtime configuration or secret changes are included. Release-specific production publication approval is still required; no tag pushed and no deployment performed. - Existing dependency advisories remain: npm ci reports 20 (10 moderate, 10 high); production image installation reports 8 (6 moderate, 2 high). No dependency remediation was attempted in this scoped metadata fix.
erik commented 2026-10-13 11:46:58 -05:00
Author
Owner
Copy link

Synced from todu comment by @todu on 2026-10-13T16:42:52.405Z

Production deployment verified

  • Human explicitly approved publishing web-v0.3.14 and its automatic production deployment after reviewing the source SHA, validations, restart/rollback plan and existing dependency advisories.
  • Published tag points to 1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb. Forgejo Actions job #80, Build and publish Docker image, completed successfully (4m55s): https://forge.caradoc.com/erik/erikvancraddock.com/actions.
  • Published image tags: evcraddock/erikvancraddock-web:0.3.14, :20261013T163002Z, and :latest. Flux selected the timestamp and updated both app/init images automatically; no direct cluster changes were made.
  • Rollout completed with one ready replica, zero container restarts, and deployed image digest sha256:020f77874f85f951726de2551e6d0058241ffcced3df87b86b09ba82a8550fc4. Brief HTTP 503 responses occurred during the expected Recreate restart/ingress propagation; subsequent public checks succeeded.
  • Public HTTPS /health and /api/v1/health return HTTP 200 and version 0.3.14.
  • Public HTTPS /api/v1/meta returns HTTP 200 with api.baseUrl=https://erikvancraddock.com/api/v1 and api.openapiUrl=https://erikvancraddock.com/api/v1/openapi.json; software version is 0.3.14.
  • Root-cause and production metadata acceptance criteria are now verified. Rott discovery confirmation remains pending operator retry; no Rott changes, weakened HTTPS checks, credential collection or authenticated production mutations were performed. Task remains open pending that evidence and separate close-gate approval.
_Synced from todu comment by @todu on 2026-10-13T16:42:52.405Z_ ### Production deployment verified - Human explicitly approved publishing `web-v0.3.14` and its automatic production deployment after reviewing the source SHA, validations, restart/rollback plan and existing dependency advisories. - Published tag points to `1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb`. Forgejo Actions job #80, Build and publish Docker image, completed successfully (4m55s): https://forge.caradoc.com/erik/erikvancraddock.com/actions. - Published image tags: `evcraddock/erikvancraddock-web:0.3.14`, `:20261013T163002Z`, and `:latest`. Flux selected the timestamp and updated both app/init images automatically; no direct cluster changes were made. - Rollout completed with one ready replica, zero container restarts, and deployed image digest `sha256:020f77874f85f951726de2551e6d0058241ffcced3df87b86b09ba82a8550fc4`. Brief HTTP 503 responses occurred during the expected Recreate restart/ingress propagation; subsequent public checks succeeded. - Public HTTPS `/health` and `/api/v1/health` return HTTP 200 and version `0.3.14`. - Public HTTPS `/api/v1/meta` returns HTTP 200 with `api.baseUrl=https://erikvancraddock.com/api/v1` and `api.openapiUrl=https://erikvancraddock.com/api/v1/openapi.json`; software version is `0.3.14`. - Root-cause and production metadata acceptance criteria are now verified. Rott discovery confirmation remains pending operator retry; no Rott changes, weakened HTTPS checks, credential collection or authenticated production mutations were performed. Task remains open pending that evidence and separate close-gate approval.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
web-v0.3.22
web-v0.3.21
web-v0.3.20
web-v0.3.19
web-v0.3.18
web-v0.3.17
web-v0.3.16
web-v0.3.15
web-v0.3.14
web-v0.3.13
web-v0.3.12
web-v0.3.11
web-v0.3.10
web-v0.3.9
web-v0.3.8
web-v0.3.7
web-v0.3.6
web-v0.3.5
web-v0.3.4
web-v0.3.3
web-v0.3.2
web-v0.3.1
web-v0.3.0
Labels
Clear labels   
bug

   
priority:high

   
status:active

   
status:inprogress
No labels
bug
priority:high
status:active
status:inprogress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
erik/erikvancraddock.com#21
No description provided.