Palash DebnathandClaude Opus 4.8
1b08c03da9
Docker users reported Settings -> Engines failing with 'Failed to load engines: Failed to fetch'. Two problems: (1) the two API-base resolvers diverged (client.ts honored VITE_API_URL; apiBase.ts honored VITE_OMNIVOICE_API), and the docs documented VITE_OMNIVOICE_API -- which the Engines request path ignored; (2) VITE_* is inlined at BUILD time, so a prebuilt ghcr.io image has no working runtime override at all for reverse-proxy / split-origin deploys. - backend: when OMNIVOICE_PUBLIC_API_BASE is set, inject it into index.html as window.__OMNIVOICE_API_BASE__ (core/spa_inject.py; validated to a plain http(s) URL so it can't break out of the <script>). Unset (default) -> StaticFiles serves index.html untouched (same-origin, zero overhead). - frontend: both resolvers (client.ts _resolveApiBase + utils/apiBase.ts) now read the runtime global FIRST, then VITE_OMNIVOICE_API/VITE_API_URL, then fall through to same-origin. client.ts also strips trailing slashes and recognises __TAURI_INTERNALS__ (parity with apiBase.ts/external.ts). - docs: docker.md + troubleshooting.md document OMNIVOICE_PUBLIC_API_BASE as the runtime override that works on the prebuilt image (the old VITE_OMNIVOICE_API docker run -e example never worked -- build-time inlining). - tests: spa_inject helpers (inject + URL validation/breakout); resolver precedence for the runtime global + VITE_OMNIVOICE_API in both test files. Default same-origin behavior is unchanged on every platform; override is opt-in. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
44 lines
1.9 KiB
Python
44 lines
1.9 KiB
Python
"""Runtime API-base injection helpers (Docker / reverse-proxy deployments).
|
|
|
|
A prebuilt image can't take a build-time VITE_* override, so the backend
|
|
injects OMNIVOICE_PUBLIC_API_BASE into index.html as a window global. These
|
|
test the pure helpers without booting the app.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from core.spa_inject import inject_api_base, is_valid_public_api_base
|
|
|
|
|
|
def test_valid_public_api_base_accepts_http_urls():
|
|
assert is_valid_public_api_base("https://api.example.com")
|
|
assert is_valid_public_api_base("http://10.0.0.5:3900")
|
|
assert is_valid_public_api_base("https://voice.example.com/api")
|
|
|
|
|
|
def test_valid_public_api_base_rejects_unsafe_or_empty():
|
|
assert not is_valid_public_api_base("")
|
|
assert not is_valid_public_api_base("not a url")
|
|
assert not is_valid_public_api_base("javascript:alert(1)")
|
|
# No script breakout possible — angle brackets / quotes are rejected.
|
|
assert not is_valid_public_api_base('https://x"</script><script>evil()')
|
|
assert not is_valid_public_api_base("https://x</script>")
|
|
|
|
|
|
def test_inject_api_base_into_head():
|
|
doc = "<html><head><title>x</title></head><body></body></html>"
|
|
out = inject_api_base(doc, "https://api.example.com")
|
|
assert '<head><script>window.__OMNIVOICE_API_BASE__="https://api.example.com";</script>' in out
|
|
assert out.count("<head>") == 1 # injected once, original head preserved
|
|
|
|
|
|
def test_inject_api_base_prepends_when_no_head():
|
|
out = inject_api_base("<body>x</body>", "http://10.0.0.5:3900")
|
|
assert out.startswith('<script>window.__OMNIVOICE_API_BASE__="http://10.0.0.5:3900";</script>')
|
|
|
|
|
|
def test_inject_api_base_json_encodes_value():
|
|
# json.dumps wraps in double quotes; combined with is_valid_public_api_base
|
|
# the value can't contain a quote, so the snippet is always well-formed.
|
|
out = inject_api_base("<head></head>", "https://a/b")
|
|
assert '="https://a/b";' in out
|