Fix API meta public origin #50

New issue

Closed

opened 2026-06-30 13:55:34 -05:00 by erik · 3 comments

erik commented

2026-06-30 13:55:34 -05:00

Owner

Summary

Production /api/v1/meta reports internal/default URLs instead of the public Slugkit origin after the npm-backed template migration.

Steps to reproduce

Deploy slugkit.com with ACTIVITYPUB_PUBLIC_ORIGIN=https://slugkit.com behind k3s/ingress.
Request https://slugkit.com/api/v1/meta.
Inspect site.url, api.baseUrl, and api.openapiUrl.

Expected behavior

site.url uses the public site origin, https://slugkit.com.
api.baseUrl uses https://slugkit.com/api/v1.
api.openapiUrl uses https://slugkit.com/api/v1/openapi.json.
Behavior is covered by tests for proxied/production requests.

Actual behavior

site.url falls back to http://localhost:3000 when site_config has no persisted row.
api.baseUrl and api.openapiUrl can be derived as http://slugkit.com/... from the proxied request URL.
ACTIVITYPUB_PUBLIC_ORIGIN=https://slugkit.com is present in the runtime environment but is not applied by the API meta route.

Acceptance criteria

API meta generation prefers the configured public origin when available, especially ACTIVITYPUB_PUBLIC_ORIGIN.
Live/proxied requests report HTTPS public URLs in site.url, api.baseUrl, and api.openapiUrl.
Existing persisted site config values are preserved or intentionally reconciled with the public origin.
Tests cover default local behavior and production/proxied public-origin behavior.
npm run build and npm test pass.

Dependencies

None

## Summary Production `/api/v1/meta` reports internal/default URLs instead of the public Slugkit origin after the npm-backed template migration. ## Steps to reproduce 1. Deploy `slugkit.com` with `ACTIVITYPUB_PUBLIC_ORIGIN=https://slugkit.com` behind k3s/ingress. 2. Request `https://slugkit.com/api/v1/meta`. 3. Inspect `site.url`, `api.baseUrl`, and `api.openapiUrl`. ## Expected behavior - `site.url` uses the public site origin, `https://slugkit.com`. - `api.baseUrl` uses `https://slugkit.com/api/v1`. - `api.openapiUrl` uses `https://slugkit.com/api/v1/openapi.json`. - Behavior is covered by tests for proxied/production requests. ## Actual behavior - `site.url` falls back to `http://localhost:3000` when `site_config` has no persisted row. - `api.baseUrl` and `api.openapiUrl` can be derived as `http://slugkit.com/...` from the proxied request URL. - `ACTIVITYPUB_PUBLIC_ORIGIN=https://slugkit.com` is present in the runtime environment but is not applied by the API meta route. ## Acceptance criteria - [ ] API meta generation prefers the configured public origin when available, especially `ACTIVITYPUB_PUBLIC_ORIGIN`. - [ ] Live/proxied requests report HTTPS public URLs in `site.url`, `api.baseUrl`, and `api.openapiUrl`. - [ ] Existing persisted site config values are preserved or intentionally reconciled with the public origin. - [ ] Tests cover default local behavior and production/proxied public-origin behavior. - [ ] `npm run build` and `npm test` pass. ## Dependencies - None

erik added the

bug

priority:medium

status:inprogress

labels

2026-06-30 13:55:34 -05:00

erik commented

2026-06-30 14:01:17 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T19:00:45.844Z

Review update

PR: erik/slugkit.com#51 is open for task-9fb83661-api-meta-public-origin into main.
Result: approved.
Verified: API meta now applies ACTIVITYPUB_PUBLIC_ORIGIN, proxied production metadata reports HTTPS public URLs, persisted site URLs are preserved unless a public origin is configured, and npm run build / npm test passed.
Follow-up: merge approval is required before release/deploy verification.

_Synced from todu comment by @todu on 2026-06-30T19:00:45.844Z_ ### Review update - PR: `erik/slugkit.com#51` is open for `task-9fb83661-api-meta-public-origin` into `main`. - Result: approved. - Verified: API meta now applies `ACTIVITYPUB_PUBLIC_ORIGIN`, proxied production metadata reports HTTPS public URLs, persisted site URLs are preserved unless a public origin is configured, and `npm run build` / `npm test` passed. - Follow-up: merge approval is required before release/deploy verification.

erik commented

2026-06-30 14:18:10 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T19:15:42.635Z

Production verification

Merged: PR erik/slugkit.com#51 merged into main.
Release: created and pushed web-v0.1.34; Forgejo Actions task #40 succeeded for commit c52d7c0.
Deployment: k3s deployment slugkit-com updated to image evcraddock/slugkit-com:0.1.34 and rollout completed successfully.
Live health: https://slugkit.com/health returns version 0.1.34.
Live meta: https://slugkit.com/api/v1/meta now reports site.url=https://slugkit.com, api.baseUrl=https://slugkit.com/api/v1, and api.openapiUrl=https://slugkit.com/api/v1/openapi.json.
Production doctor: authenticated slug --site slugkit.com doctor --json passed config, health, meta, packages, openapi, and auth checks.

_Synced from todu comment by @todu on 2026-06-30T19:15:42.635Z_ ### Production verification - Merged: PR `erik/slugkit.com#51` merged into `main`. - Release: created and pushed `web-v0.1.34`; Forgejo Actions task `#40` succeeded for commit `c52d7c0`. - Deployment: k3s deployment `slugkit-com` updated to image `evcraddock/slugkit-com:0.1.34` and rollout completed successfully. - Live health: `https://slugkit.com/health` returns version `0.1.34`. - Live meta: `https://slugkit.com/api/v1/meta` now reports `site.url=https://slugkit.com`, `api.baseUrl=https://slugkit.com/api/v1`, and `api.openapiUrl=https://slugkit.com/api/v1/openapi.json`. - Production doctor: authenticated `slug --site slugkit.com doctor --json` passed config, health, meta, packages, openapi, and auth checks.

erik

2026-06-30 14:29:23 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-30 14:29:24 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T19:29:08.562Z

Close gate: READY

Acceptance criteria verified from recent review and production comments:

API meta now applies ACTIVITYPUB_PUBLIC_ORIGIN / configured public origin.
Live production /api/v1/meta reports site.url=https://slugkit.com, api.baseUrl=https://slugkit.com/api/v1, and api.openapiUrl=https://slugkit.com/api/v1/openapi.json.
Persisted site URLs are preserved unless a public origin is configured.
Tests cover default local behavior and proxied/production public-origin behavior.
npm run build and npm test passed.
PR erik/slugkit.com#51 was merged, release web-v0.1.34 deployed, rollout completed, live health reports 0.1.34, and authenticated production doctor passed config, health, meta, packages, openapi, and auth checks.

Closing task as done.

_Synced from todu comment by @todu on 2026-06-30T19:29:08.562Z_ ### Close gate: READY Acceptance criteria verified from recent review and production comments: - API meta now applies `ACTIVITYPUB_PUBLIC_ORIGIN` / configured public origin. - Live production `/api/v1/meta` reports `site.url=https://slugkit.com`, `api.baseUrl=https://slugkit.com/api/v1`, and `api.openapiUrl=https://slugkit.com/api/v1/openapi.json`. - Persisted site URLs are preserved unless a public origin is configured. - Tests cover default local behavior and proxied/production public-origin behavior. - `npm run build` and `npm test` passed. - PR `erik/slugkit.com#51` was merged, release `web-v0.1.34` deployed, rollout completed, live health reports `0.1.34`, and authenticated production doctor passed config, health, meta, packages, openapi, and auth checks. Closing task as done.