openvibers/openvibe.ai Commits

ai.openvibe.services' vhost passes POST /release-metrics to the app (the GET-only catch-all refused open tabs' update reports with a 403) (#142)

OP OpenVibers committed 20 days ago · 41a1af6703 · 2 files, +11 −1

Changes

ddiff --git a/deploy/nginx/ai.openvibe.services.conf b/deploy/nginx/ai.openvibe.services.conf
iindex b8b9b8f..88a402c 100644
---- a/deploy/nginx/ai.openvibe.services.conf
++++ b/deploy/nginx/ai.openvibe.services.conf
@@@ -154,6 +154,13 @@ server {
      location = /sitemap.xml { proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
      location = /llms.txt { proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
      location = /release.json { proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
++    # Open tabs report how their update went (openvibe-shared release-watch → POST /release-metrics, counted in /metrics).
++    # The catch-all below passes GET and HEAD only, so every visitor's report was refused with a 403 (2026-10-24).
++    location = /release-metrics {
++        limit_except POST { deny all; }
++        client_max_body_size 16k;
++        proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr;
++    }
      location /shared/ { proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
  
      location = / {
ddiff --git a/test/vhost-catchall.test.js b/test/vhost-catchall.test.js
iindex a56a269..46846a8 100644
---- a/test/vhost-catchall.test.js
++++ b/test/vhost-catchall.test.js
@@@ -11,4 +11,7 @@ assert.match(catchAll, /limit_except GET HEAD \{ deny all; \}/, 'the catch-all o
  assert.match(catchAll, /proxy_pass http:\/\/127\.0\.0\.1:4700;/, 'and lets the app answer (favicon, 404 page)');
  assert.ok(!/location \/ \{\s*return 404;\s*\}/.test(conf), "nginx's bare 404 page (no lang) is gone");
  assert.match(conf, /location ~\* \^\/metrics\(\/\|\$\) \{ return 404; \}/, '/metrics stays refused');
--console.log('vhost catch-all: GET/HEAD reach the app (favicon, 404 page); other methods refused; /metrics refused');
++const reports = /location = \/release-metrics \{([\s\S]*?)\n    \}/.exec(conf);
++assert.ok(reports && /limit_except POST \{ deny all; \}/.test(reports[1]) && /proxy_pass http:\/\/127\.0\.0\.1:4700;/.test(reports[1]), 'open tabs\' release reports (POST /release-metrics) reach the app');
++assert.ok(conf.indexOf('location = /release-metrics') < conf.lastIndexOf('    location / {'), 'before the GET-only catch-all');
++console.log('vhost catch-all: GET/HEAD reach the app (favicon, 404 page); other methods refused; /metrics refused; POST /release-metrics passes');