openvibers/openvibe.ai Commits

Answer an unknown API path with a problem document, not 403 HTML (#250)

OP OpenVibers committed 12 days ago · 3fd60d4ac7 · 2 files, +8 −4

The vhost refused every /api/ path it does not list with a 403 text/html page before the app saw it, so an API client asking for /api/no-such did not get the problem document the app's 404 promises. The refusal block now answers application/problem+json with ai.not_found and still never proxies the host-local API. The vhost test asserts the block and that it keeps the API off the public vhost.

Changes

ddiff --git a/deploy/nginx/ai.openvibe.services.conf b/deploy/nginx/ai.openvibe.services.conf
iindex 9b7dff4..77bd695 100644
---- a/deploy/nginx/ai.openvibe.services.conf
++++ b/deploy/nginx/ai.openvibe.services.conf
@@@ -159,10 +159,11 @@ server {
          proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; proxy_set_header X-Forwarded-Proto $scheme;
      }
  
--    # ── Service API: host-local only (see header) ───────────
++    # ── Unknown API paths: a problem document, never a page; the API itself stays host-local ──
      location /api/ {
--        return 403;
--        # To expose it (token-guarded) to off-host services instead:
++        default_type application/problem+json;
++        return 404 '{"type":"about:blank","title":"Not Found","status":404,"code":"ai.not_found","detail":"No such route on ai.openvibe.services."}';
++        # To expose the API (token-guarded) to off-host services instead:
          # proxy_pass http://127.0.0.1:4700;
          # proxy_http_version 1.1;
          # proxy_set_header Host $host;
ddiff --git a/test/home.test.js b/test/home.test.js
iindex 8e91a06..12d7185 100644
---- a/test/home.test.js
++++ b/test/home.test.js
@@@ -167,7 +167,10 @@ t.test('the public vhost proxies the home, its files and exactly the developer-a
          for (const hdr of ['X-Real-IP $remote_addr', 'X-Forwarded-For $remote_addr', 'CF-Connecting-IP $remote_addr']) assert.ok(block.includes(hdr), hdr);
      }
      const rest = conf.indexOf('location /api/ {');
--    assert.ok(conf.slice(rest, conf.indexOf('}', rest)).includes('return 403;'), 'the rest of the API stays host-local');
++    const apiRest = conf.slice(rest, conf.indexOf('\n    }', rest));
++    assert.ok(apiRest.includes('default_type application/problem+json;'), 'an unknown API path answers a problem document');
++    assert.ok(/return 404 /.test(apiRest), 'with a 404');
++    assert.ok(!apiRest.includes('proxy_pass'), 'the rest of the API stays host-local');
      assert.ok(!conf.includes('$proxy_add_x_forwarded_for'));
  });