fix(install): pass backend GroupServer through, never rewrite to frontend (VAPP-34) #49

Merged
Claude-Run merged 1 commit from fix/vapp-34-no-loopback-rewrite-to-frontend into main 2026-06-26 15:41:55 +02:00
Member

The loopback-rewrite in get_group_install replaced a loopback GroupServer host with the operator's browser host (X-Forwarded-Host/Host), which silently stamped the frontend origin into the agent-facing .vagent GroupServer/ServerURL and routed agents through the frontend instead of straight at the API server (VS-54).

Drop the rewrite from the agent-facing fields entirely (proposed approach (a)). The backend's GroupServer is authoritative and passes through unchanged: vagent and server_url keep the host/scheme/port the backend emitted, byte-identical, for both production (non-loopback) and dev (loopback). A loopback GroupServer is now treated as a server misconfiguration to fix at the source by setting VERVAIN_BASE_URL on the dev server (or external_base_url on vervain-server) per VS-55; we surface that as a non-fatal hint rather than substituting a reachable-but-wrong host. augment_vagent_for_agent derives ServerURL= from the unrewritten authoritative GroupServer.

Remove the now-dead rewrite_loopback_host and replace_authority helpers and their tests; add a test asserting a loopback GroupServer passes through unchanged with no frontend origin leaking into the agent config.

#VAPP-34

The loopback-rewrite in get_group_install replaced a loopback GroupServer host with the operator's browser host (X-Forwarded-Host/Host), which silently stamped the frontend origin into the agent-facing .vagent GroupServer/ServerURL and routed agents through the frontend instead of straight at the API server (VS-54). Drop the rewrite from the agent-facing fields entirely (proposed approach (a)). The backend's GroupServer is authoritative and passes through unchanged: vagent and server_url keep the host/scheme/port the backend emitted, byte-identical, for both production (non-loopback) and dev (loopback). A loopback GroupServer is now treated as a server misconfiguration to fix at the source by setting VERVAIN_BASE_URL on the dev server (or external_base_url on vervain-server) per VS-55; we surface that as a non-fatal hint rather than substituting a reachable-but-wrong host. augment_vagent_for_agent derives ServerURL= from the unrewritten authoritative GroupServer. Remove the now-dead rewrite_loopback_host and replace_authority helpers and their tests; add a test asserting a loopback GroupServer passes through unchanged with no frontend origin leaking into the agent config. #VAPP-34
fix(install): pass backend GroupServer through, never rewrite to frontend (VAPP-34)
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 3m2s
Create release / Create release from merged PR (pull_request) Has been skipped
2b3b2c44e0
The loopback-rewrite in get_group_install replaced a loopback GroupServer host with the operator's browser host (X-Forwarded-Host/Host), which silently stamped the frontend origin into the agent-facing .vagent GroupServer/ServerURL and routed agents through the frontend instead of straight at the API server (VS-54).

Drop the rewrite from the agent-facing fields entirely (proposed approach (a)). The backend's GroupServer is authoritative and passes through unchanged: vagent and server_url keep the host/scheme/port the backend emitted, byte-identical, for both production (non-loopback) and dev (loopback). A loopback GroupServer is now treated as a server misconfiguration to fix at the source by setting VERVAIN_BASE_URL on the dev server (or external_base_url on vervain-server) per VS-55; we surface that as a non-fatal hint rather than substituting a reachable-but-wrong host. augment_vagent_for_agent derives ServerURL= from the unrewritten authoritative GroupServer.

Remove the now-dead rewrite_loopback_host and replace_authority helpers and their tests; add a test asserting a loopback GroupServer passes through unchanged with no frontend origin leaking into the agent config.

#VAPP-34
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/vervain-apps!49
No description provided.