openvibers/openvibe.connect Commits

Old control host: only page loads redirect; webhooks, API, MCP tokens and discovery still answer (#71)

OP OpenVibers committed 5 days ago · 4db4b46ed8 · 2 files, +10 −1

Since BASE_URL moved to connect.openvibe.link, every request to connect.openvibe.website got a 302, including webhook
POSTs to /h/, Bearer API calls and MCP clients' /oauth/token. Senders do not follow those (and a 302 turns POST into
GET). Now only GET/HEAD page loads move; machine paths and every other method answer on the old name.

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 85aa8b1..fbf1982 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -220,7 +220,11 @@ async function createApp(opts = {}) {
      app.use((req, res, next) => {
          const host = String(req.headers.host || '').toLowerCase().replace(/:\d+$/, '');
          const canonical = new URL(config.baseUrl).hostname;
--        if (['connect.openvibe.link', 'connect.openvibe.website'].includes(host) && host !== canonical) {
++        // Only a browser's page load moves to the canonical control host. Machines keep working on the old name:
++        // webhook senders (/h/), Bearer API calls, MCP clients' token and registration calls and agent discovery do
++        // not follow a 302 (and a 302 turns a POST into a GET), so every other method and those paths answer here.
++        const page = (req.method === 'GET' || req.method === 'HEAD') && !/^\/(?:h|api|\.well-known)(?:\/|$)/.test(req.path);
++        if (['connect.openvibe.link', 'connect.openvibe.website'].includes(host) && host !== canonical && page) {
              return res.redirect(302, `${config.baseUrl}${req.originalUrl}`);
          }
          return next();
ddiff --git a/test/link-hosts.test.js b/test/link-hosts.test.js
iindex 9ff6dc8..a477014 100644
---- a/test/link-hosts.test.js
++++ b/test/link-hosts.test.js
@@@ -121,6 +121,11 @@ function upgrade(t, host, cookie) {
              const old = await n.share('connect.openvibe.website', '/auth/login?next=%2Fshares');
              assert.equal(old.status, 302);
              assert.equal(old.headers.location, 'https://connect.openvibe.link/auth/login?next=%2Fshares');
++            // Machines are not redirected: a webhook, an API call and agent discovery answer on the old name.
++            for (const [method, path] of [['POST', '/h/hk_missing'], ['GET', '/api/v1/shares'], ['GET', '/.well-known/agent.json'], ['POST', '/oauth/token']]) {
++                const r = await n.share('connect.openvibe.website', path, { method });
++                assert.notEqual(r.status, 302, `${method} ${path} on the old control host must not redirect`);
++            }
              const login = await n.share('connect.openvibe.link', '/auth/login?next=%2Fshares');
              const authorize = new URL(login.headers.location);
              assert.equal(authorize.searchParams.get('redirect_uri'), 'https://connect.openvibe.link/auth/callback');