erik/erikvancraddock.com
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Fix public HTTPS API discovery metadata #22

Merged
erik merged 1 commit from task-4cb7f355-https-api-metadata into main 2026-10-13 11:20:11 -05:00
Conversation 1 Commits 1 Files changed 5 +73 -6
erik commented 2026-10-13 11:15:32 -05:00
Owner
Copy link

Summary

Fixes task-4cb7f355: API metadata advertises HTTP URLs on HTTPS website.

  • Confirmed root cause: @evcraddock/slug-api@0.1.1 computes API URLs from new URL(input.requestUrl).origin, and the local metadata route passed context.req.url. A TLS-terminating proxy supplies an internal HTTP request while the persisted site URL correctly uses HTTPS.
  • Pass the configured site URL to the metadata helper instead, and remove the request URL from the local wrapper signature. Persisted site configuration takes precedence over the file-backed configuration.
  • Do not trust Host/Forwarded headers, force HTTPS for local development, modify Rott, or change authentication/HTTPS checks.
  • Document canonical metadata URLs in src/api/README.md.

Verification

  • Regression reproduced before the fix: persisted HTTPS site URL advertised HTTP URLs for HTTP proxy requests and the wrong host for an alternate request host.
  • Targeted API tests: 12 passed, including 7 new metadata cases.
  • npm run build: passed.
  • npm run typecheck: passed.
  • npm run lint: passed.
  • npm run test:ci: 399 tests passed across 45 files.
  • npm test: 475 tests passed across 52 files, including integrations.
  • git diff --check: passed.

Acceptance criteria / rollout

  • Identify the cause of incorrect public API scheme generation.
  • Production HTTPS metadata advertises the correct HTTPS API and OpenAPI URLs: regression tests prove corrected generation locally; production verification awaits an approved release/deployment.
  • Confirm Rott discovery proceeds beyond this metadata failure without weakening HTTPS checks: no Rott changes made; verification awaits deployment.

After merge, use the gated web release/deployment workflow. Fetch https://erikvancraddock.com/api/v1/meta without credentials and verify api.baseUrl is https://erikvancraddock.com/api/v1 and api.openapiUrl is https://erikvancraddock.com/api/v1/openapi.json. Retry Rott discovery against the HTTPS website and confirm it proceeds beyond API requires HTTPS. Do not infer API-key validity from discovery. Keep the task open until production and Rott verification are complete.

## Summary Fixes task-4cb7f355: API metadata advertises HTTP URLs on HTTPS website. - Confirmed root cause: `@evcraddock/slug-api@0.1.1` computes API URLs from `new URL(input.requestUrl).origin`, and the local metadata route passed `context.req.url`. A TLS-terminating proxy supplies an internal HTTP request while the persisted site URL correctly uses HTTPS. - Pass the configured site URL to the metadata helper instead, and remove the request URL from the local wrapper signature. Persisted site configuration takes precedence over the file-backed configuration. - Do not trust Host/Forwarded headers, force HTTPS for local development, modify Rott, or change authentication/HTTPS checks. - Document canonical metadata URLs in `src/api/README.md`. ## Verification - Regression reproduced before the fix: persisted HTTPS site URL advertised HTTP URLs for HTTP proxy requests and the wrong host for an alternate request host. - Targeted API tests: 12 passed, including 7 new metadata cases. - `npm run build`: passed. - `npm run typecheck`: passed. - `npm run lint`: passed. - `npm run test:ci`: 399 tests passed across 45 files. - `npm test`: 475 tests passed across 52 files, including integrations. - `git diff --check`: passed. ## Acceptance criteria / rollout - [x] Identify the cause of incorrect public API scheme generation. - [ ] Production HTTPS metadata advertises the correct HTTPS API and OpenAPI URLs: regression tests prove corrected generation locally; production verification awaits an approved release/deployment. - [ ] Confirm Rott discovery proceeds beyond this metadata failure without weakening HTTPS checks: no Rott changes made; verification awaits deployment. After merge, use the gated web release/deployment workflow. Fetch `https://erikvancraddock.com/api/v1/meta` without credentials and verify `api.baseUrl` is `https://erikvancraddock.com/api/v1` and `api.openapiUrl` is `https://erikvancraddock.com/api/v1/openapi.json`. Retry Rott discovery against the HTTPS website and confirm it proceeds beyond `API requires HTTPS`. Do not infer API-key validity from discovery. Keep the task open until production and Rott verification are complete.
fix: derive API metadata URLs from the configured public site
All checks were successful
CI / build-lint-test (push) Successful in 1m31s
Details
9bccbbf0d3
erik commented 2026-10-13 11:17:37 -05:00
Author
Owner
Copy link

Review update

  • PR: #22 — open; reviewed commit 9bccbbf0d306d19a9b364be4e72dc12ecebd77a9.
  • Summary: The scoped fix uses the configured public site origin instead of the proxy-facing request origin. Persisted configuration retains precedence over file-backed defaults. The regression coverage includes internal HTTP requests, hostile Host/Forwarded headers, local HTTP, explicit ports, and configured paths. Documentation matches the implementation. No code correctness or security defect found in the reviewed diff; Rott and HTTPS checks are unchanged.
  • Verification evidence: Parent reports passing build, typecheck, lint, test:ci (399 tests), npm test (475 tests), targeted API tests (12 tests), and git diff --check. These checks were not rerun by this reviewer.

Acceptance criteria

  • met — Identify the cause of incorrect public API scheme generation. @evcraddock/slug-api@0.1.1 uses new URL(input.requestUrl).origin; the previous route passed context.req.url. Thus proxy-facing HTTP determines advertised API URLs despite HTTPS site configuration. The replacement passes site.url.
  • partial — The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs. The route regression tests assert both required HTTPS URLs with persisted production-style site configuration and HTTP requests. This proves local generation, not the deployed production response; production deployment and verification have not occurred.
  • not-evident — Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks. No Rott discovery run/result is supplied. Leaving Rott and HTTPS validation unchanged supports the safety constraint but does not confirm discovery proceeds.

Blocking issues (2)

  1. Production verification remains incomplete: following human-approved merge/release/deployment, verify the anonymous production metadata response advertises https://erikvancraddock.com/api/v1 and https://erikvancraddock.com/api/v1/openapi.json.
  2. Rott discovery verification remains absent: after deployment, demonstrate discovery proceeds beyond API requires HTTPS without weakening HTTPS checks. Discovery does not establish API-key validity.
  • Warnings: None.
  • Final verdict: changes-requested, required by the common review rule for a not-evident acceptance criterion. This is an acceptance-evidence gap, not a request for speculative repository edits or weakened criteria.
  • Criteria totals: 3 total, 1 met, 2 incomplete (1 partial, 1 not-evident).
  • Follow-up: Human-approved rollout and the two acceptance checks are required before task completion. Keep the PR and task open; no merge, deployment, task closure, or criteria changes were performed by this reviewer.
### Review update - PR: https://forge.caradoc.com/erik/erikvancraddock.com/pulls/22 — open; reviewed commit `9bccbbf0d306d19a9b364be4e72dc12ecebd77a9`. - Summary: The scoped fix uses the configured public site origin instead of the proxy-facing request origin. Persisted configuration retains precedence over file-backed defaults. The regression coverage includes internal HTTP requests, hostile Host/Forwarded headers, local HTTP, explicit ports, and configured paths. Documentation matches the implementation. No code correctness or security defect found in the reviewed diff; Rott and HTTPS checks are unchanged. - Verification evidence: Parent reports passing build, typecheck, lint, test:ci (399 tests), npm test (475 tests), targeted API tests (12 tests), and git diff --check. These checks were not rerun by this reviewer. #### Acceptance criteria - **met** — Identify the cause of incorrect public API scheme generation. `@evcraddock/slug-api@0.1.1` uses `new URL(input.requestUrl).origin`; the previous route passed `context.req.url`. Thus proxy-facing HTTP determines advertised API URLs despite HTTPS site configuration. The replacement passes `site.url`. - **partial** — The production HTTPS metadata response advertises the correct HTTPS API and OpenAPI URLs. The route regression tests assert both required HTTPS URLs with persisted production-style site configuration and HTTP requests. This proves local generation, not the deployed production response; production deployment and verification have not occurred. - **not-evident** — Confirm Rott discovery proceeds beyond this metadata validation failure without weakening HTTPS checks. No Rott discovery run/result is supplied. Leaving Rott and HTTPS validation unchanged supports the safety constraint but does not confirm discovery proceeds. #### Blocking issues (2) 1. Production verification remains incomplete: following human-approved merge/release/deployment, verify the anonymous production metadata response advertises `https://erikvancraddock.com/api/v1` and `https://erikvancraddock.com/api/v1/openapi.json`. 2. Rott discovery verification remains absent: after deployment, demonstrate discovery proceeds beyond `API requires HTTPS` without weakening HTTPS checks. Discovery does not establish API-key validity. - Warnings: None. - Final verdict: **changes-requested**, required by the common review rule for a not-evident acceptance criterion. This is an acceptance-evidence gap, not a request for speculative repository edits or weakened criteria. - Criteria totals: 3 total, 1 met, 2 incomplete (1 partial, 1 not-evident). - Follow-up: Human-approved rollout and the two acceptance checks are required before task completion. Keep the PR and task open; no merge, deployment, task closure, or criteria changes were performed by this reviewer.
erik merged commit 1eaeb72676 into main 2026-10-13 11:20:11 -05:00
erik deleted branch task-4cb7f355-https-api-metadata 2026-10-13 11:20:11 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
priority:high

   
status:active

   
status:inprogress
No labels
bug
priority:high
status:active
status:inprogress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
erik/erikvancraddock.com!22
No description provided.