openvibers/openvibe.mail Commits

nginx: serve the agent files, the owner's provider panel and the report page (#34)

OP OpenVibers committed 4 days ago · fedf1a0785 · 2 files, +25 −1

openvibe.email's vhost proxies an allow-list, and four things the app serves were not on it, so nginx answered 404:
llms.txt, llms-full.txt, openapi.json and agent.json (Mail #32), /admin/mail/providers (the owner's panel for
providers and caps: the owner could not reach it), and /report/<id>, the abuse report page every sent message links
to. Each is GET-only; the app still answers 404 to anyone but the owner on the panel.

Changes

ddiff --git a/deploy/nginx/openvibe.email.conf b/deploy/nginx/openvibe.email.conf
iindex e531dee..4df0988 100644
---- a/deploy/nginx/openvibe.email.conf
++++ b/deploy/nginx/openvibe.email.conf
@@@ -96,6 +96,18 @@ server {
          proxy_pass http://127.0.0.1:5250;
      }
  
++    # The owner's provider panel (server/http/pages.js answers 404 to anyone but the owner). It was missing here, so
++    # openvibe.email/admin/mail/providers answered nginx's 404 to the owner too (11-09).
++    location = /admin/mail/providers {
++        limit_except GET HEAD { deny all; }
++        proxy_pass http://127.0.0.1:5250;
++    }
++    # The abuse report page every sent message links to (X-OpenVibe-Report-Abuse); the report posts to /api/v1/.
++    location ~ ^/report/[0-9a-f-]+$ {   # the app checks the 36-character id
++        limit_except GET HEAD { deny all; }
++        proxy_pass http://127.0.0.1:5250;
++    }
++
      # ── the machine answers ─────────────────────────────────
      location = /api/health {
          proxy_pass http://127.0.0.1:5250;
@@@ -105,6 +117,16 @@ server {
          proxy_pass http://127.0.0.1:5250;
      }
  
++    # The machine-readable front door (server/http/discovery.js): what the site is and its public API, for agents.
++    location ~ ^/(llms\.txt|llms-full\.txt|openapi\.json)$ {
++        limit_except GET HEAD { deny all; }
++        proxy_pass http://127.0.0.1:5250;
++    }
++    location = /.well-known/agent.json {
++        limit_except GET HEAD { deny all; }
++        proxy_pass http://127.0.0.1:5250;
++    }
++
      # The release manifest open tabs poll (no-cache, set by the app) to update in place.
      location = /release.json {
          limit_except GET HEAD { deny all; }
ddiff --git a/test/nginx.test.js b/test/nginx.test.js
iindex 3c671e9..ed97321 100644
---- a/test/nginx.test.js
++++ b/test/nginx.test.js
@@@ -37,7 +37,9 @@ test('only the page and its files, the API, the machine answers and the sign-in
          .filter(([, body]) => /proxy_pass\s+http:\/\/127\.0\.0\.1:5250;/.test(body))
          .map(([name]) => name)
          .sort();
--    assert.deepStrictEqual(proxied, ['/', '^/(css|js|shared)/', '^/inbox(/[A-Za-z0-9_-]+)?$', '/api/health', '/api/ready', '/api/v1/', '/auth/', '/auth/me', '/release.json'].sort());
++    assert.deepStrictEqual(proxied, ['/', '^/(css|js|shared)/', '^/inbox(/[A-Za-z0-9_-]+)?$', '/api/health', '/api/ready', '/api/v1/', '/auth/', '/auth/me', '/release.json',
++        // 11-09: the agent files, the owner's provider panel and the report page answered nginx's 404 though the app serves them.
++        '^/(llms\\.txt|llms-full\\.txt|openapi\\.json)$', '/.well-known/agent.json', '/admin/mail/providers', '^/report/[0-9a-f-]+$'].sort());
  
      // A proxy anywhere else (a generic /api/ or / catch-all) would expose more than the door above.
      assert.strictEqual((CONF.match(/proxy_pass\s+/g) || []).length, proxied.length,