OpenAgents

Resolve API URLs from the request origin #6

Closed AtlantisPleb opened this 15h ago 1 comment

Outcome

Every API URL reflects the request origin and trusted proxy configuration.

Current behavior

Environment-specific responses can advertise the production origin when generated from staging.

Contract

Generate issue-family and project URLs from the effective request origin after trusted proxy handling.

Acceptance criteria

Staging never advertises production URLs.
Production keeps canonical HTTPS URLs.
Untrusted forwarded headers cannot replace the origin.
Tests cover direct and proxied requests.

Verification

Run focused controller tests, mix precommit, and exact-candidate staging response checks.

Dependencies

None.

AtlantisPleb opened this issue 15h ago
A AtlantisPleb Author 8h ago
Implemented and on main (3801479).
- New OpenAgentsWeb.Plugs.RequestOrigin plug assigns :url_base from the conn scheme, host, and port, and is wired into every /api/v3 pipeline.
- Issue-family, label, and milestone JSON now build url/html_url from that origin instead of the hardcoded production host. Staging responses advertise staging URLs; production keeps canonical HTTPS because rewrite_on: [:x_forwarded_proto] rewrites the scheme through the trusted proxy.
- Untrusted forwarded headers (X-Forwarded-Host et al.) are never consulted, so they cannot replace the origin.
Tests: request-host reflection, forwarded-header rejection, and updated label/milestone URL expectations. Full mix precommit passes (2,051 tests).
closed this as completed 8h ago