fix(web): use public api origin for browser-side SSE subscriber #216

Merged

YousifShkara merged 1 commit from fix/BUNYIP-192-sse-public-origin into main

2026-06-24 11:55:43 +02:00

YousifShkara commented

2026-06-24 11:50:27 +02:00

Owner

The SSE subscriber injected into every authenticated shell opened
new EventSource(api_origin + '/v1/events') against cfg.api_url,
which is the SERVER-SIDE outbound origin (e.g. http://bunyip-api-app:4401
on docker compose). On HTTPS production pages the browser refused that
URL as Mixed Content; the dashboard never received live updates.

Split the two: BUNYIP_API_URL keeps its role as the BFF's outbound
origin to bunyip-api; new BUNYIP_API_PUBLIC_ORIGIN is the URL the
BROWSER hits and is what install_sse_api_origin now pins. Defaults
to api_url so dev (where loopback IS the public URL) is unaffected.
Production sets BUNYIP_API_PUBLIC_ORIGIN=https://api.<apex> on the
bunyip-web compose service to point the EventSource at Traefik's
HTTPS-terminated public hostname.

#BUNYIP-192

The SSE subscriber injected into every authenticated shell opened `new EventSource(api_origin + '/v1/events')` against `cfg.api_url`, which is the SERVER-SIDE outbound origin (e.g. `http://bunyip-api-app:4401` on docker compose). On HTTPS production pages the browser refused that URL as Mixed Content; the dashboard never received live updates. Split the two: `BUNYIP_API_URL` keeps its role as the BFF's outbound origin to bunyip-api; new `BUNYIP_API_PUBLIC_ORIGIN` is the URL the BROWSER hits and is what `install_sse_api_origin` now pins. Defaults to `api_url` so dev (where loopback IS the public URL) is unaffected. Production sets `BUNYIP_API_PUBLIC_ORIGIN=https://api.<apex>` on the bunyip-web compose service to point the EventSource at Traefik's HTTPS-terminated public hostname. #BUNYIP-192

YousifShkara self-assigned this

2026-06-24 11:50:27 +02:00

YousifShkara added 1 commit

2026-06-24 11:50:27 +02:00

fix(web): use public api origin for browser-side SSE subscriber

E2E / Playwright against deployment (pull_request) Successful in 45s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 4m50s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

fad749cab2

The SSE subscriber injected into every authenticated shell opened
`new EventSource(api_origin + '/v1/events')` against `cfg.api_url`,
which is the SERVER-SIDE outbound origin (e.g. `http://bunyip-api-app:4401`
on docker compose). On HTTPS production pages the browser refused that
URL as Mixed Content; the dashboard never received live updates.

Split the two: `BUNYIP_API_URL` keeps its role as the BFF's outbound
origin to bunyip-api; new `BUNYIP_API_PUBLIC_ORIGIN` is the URL the
BROWSER hits and is what `install_sse_api_origin` now pins. Defaults
to `api_url` so dev (where loopback IS the public URL) is unaffected.
Production sets `BUNYIP_API_PUBLIC_ORIGIN=https://api.<apex>` on the
bunyip-web compose service to point the EventSource at Traefik's
HTTPS-terminated public hostname.

#BUNYIP-192

YousifShkara merged commit f71fda0380 into main

2026-06-24 11:55:43 +02:00

YousifShkara deleted branch fix/BUNYIP-192-sse-public-origin

2026-06-24 11:55:43 +02:00

YousifShkara referenced this pull request from a commit

2026-06-24 11:55:43 +02:00

Merge pull request 'fix(web): use public api origin for browser-side SSE subscriber' (#216) from fix/BUNYIP-192-sse-public-origin into main