fix: subdomain mode — don't rewrite file-like paths as pod subdomains - #308
Conversation
In subdomain mode, buildResourceUrl was rewriting /mashlib.js on the base domain to https://mashlib.js.basedomain/, which never has a matching ACL, so all files directly under the base domain 401'd. Regression from ec4cf5b (March 3) which loosened the regex to handle bare pod-root paths (/alice) but accidentally swallowed filenames too. Fix: only treat a path segment as a pod name if it has no dot. Pod names are DNS labels (no dots); filenames have extensions. - / no rewrite (unchanged) - /alice → alice.basedomain/ (pod routing preserved) - /alice/foo/bar → alice.basedomain/foo/bar (preserved) - /.well-known/foo no rewrite (unchanged) - /mashlib.js, /index.html, /terms.html — no rewrite, served from root Closes #307 11 new unit tests covering base-domain files, pod routing, already-on-subdomain, and subdomain-disabled modes.
There was a problem hiding this comment.
Pull request overview
Fixes a subdomain-mode regression where buildResourceUrl incorrectly rewrote base-domain file-like paths (e.g. /mashlib.js) into pod subdomains, causing WAC checks to evaluate against the wrong resource URL and return 401.
Changes:
- Update
buildResourceUrlto only treat the first path segment as a pod name when it is a DNS-label-like segment (not dot-prefixed and containing no.). - Export
buildResourceUrlso it can be unit-tested directly. - Add regression/unit tests covering base-domain root files, dotfiles, and expected pod-routing behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/auth/middleware.js |
Tightens pod-name detection to avoid rewriting root-level filenames into subdomains; exports buildResourceUrl for direct testing. |
test/subdomain-base-files.test.js |
Adds regression tests for #307 ensuring root-level base-domain files are not rewritten, while pod routing remains intact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| function makeRequest({ urlPath, hostname, baseDomain, subdomainsEnabled = true, podName = null, protocol = 'https' }) { | ||
| return { | ||
| protocol, | ||
| hostname, | ||
| headers: { host: hostname }, | ||
| subdomainsEnabled, | ||
| baseDomain, | ||
| podName | ||
| }; |
There was a problem hiding this comment.
makeRequest accepts a urlPath option but never uses it when constructing the request object (and buildResourceUrl takes the path separately). Consider removing urlPath from the helper signature/call sites to avoid confusion, or include it on the returned request if you intended to model request.url/request.raw.url more closely.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
In subdomain mode, files directly under the base domain root returned 401 because
buildResourceUrlrewrote/mashlib.jstohttps://mashlib.js.basedomain/— a URL with no matching ACL.Why
Regression from ec4cf5b (March 2026) which loosened the pod-routing regex to match bare pod-roots (
/alicewithout trailing slash). That change also started matching filenames.Fix
One-line: also exempt path segments containing a dot. Pod names are DNS labels (no dots); filenames have extensions.
Behaviour matrix
//alice→ alice.domain/✓→ alice.domain/✓/alice/foo/bar→ alice.domain/foo/bar✓→ alice.domain/foo/bar✓/.well-known/x/mashlib.js→ mashlib.js.domain/✗ (401)/index.html→ index.html.domain/✗ (401)/terms.html→ terms.html.domain/✗ (401)Closes #307
Test plan
test/subdomain-base-files.test.js