@nanobpm/urban 0.32.0 → 0.32.2

package/dist/runtime/core/modules/api.js

@@ -156,6 +156,25 @@ export function mountApi(ctx, app) {
     const dir = binding.dir ?? "operations";
     const surfaceEject = binding.eject === true;
     const specRoutePath = `${docsBase}/openapi.json`;
+    // The Swagger UI page is served at `docsBase` (no trailing slash — the slash variant 308-
+    // redirects onto it), so its browser-relative base is the PARENT directory. Hand Swagger UI a
+    // DOCUMENT-relative spec URL and `servers` entry so both rebase onto the app's mount root:
+    // correct at the origin root (CLI :3000) AND under the Nano console reverse proxy
+    // (/console/app-view/<name>/), where a root-absolute "/app/…" escapes the prefix and hits the
+    // console origin instead of the app (issue #151).
+    const lastSegment = (p) => p.split("/").filter(Boolean).pop() ?? "";
+    const parentPath = (p) => {
+        const parts = p.split("/").filter(Boolean);
+        parts.pop();
+        return `/${parts.join("/")}`;
+    };
+    // `${docsBase}/openapi.json` reached relatively from the docs page = `<docs-segment>/openapi.json`.
+    const specDocUrl = `${lastSegment(docsBase)}/openapi.json`;
+    // `servers` can only be relativized when the operations `base` shares the docs page's parent
+    // directory (the default `${base}-docs` sibling). For a fully custom `docs` path under a
+    // different parent, keep the root-absolute base (works direct; try-it-out through the proxy is
+    // the documented limitation in #151).
+    const serversUrl = parentPath(base) === parentPath(docsBase) ? lastSegment(base) : base;
     // Resolve + parse the spec lazily on first request and cache it (mirroring the lazy module load
     // pattern). A malformed/unreadable spec surfaces as a 500 on request — with the reason — rather
     // than failing app boot.
@@ -427,12 +446,13 @@ export function mountApi(ctx, app) {
             return json({ error: errorMessage(e) }, 500);
         }
         // Point Swagger UI "Try it out" at the mounted namespace: operations live under `base`
-        // (e.g. /app/api/invoices), not the spec's bare paths (/invoices). Overriding `servers`
-        // makes the interactive console call the real Urban routes rather than the origin root.
-        return json({ ...d, servers: [{ url: base }] });
+        // (e.g. /app/api/invoices), not the spec's bare paths (/invoices). Overriding `servers` with a
+        // document-relative URL (issue #151) makes the interactive console call the real Urban routes
+        // both at the origin root and under the Nano console reverse proxy.
+        return json({ ...d, servers: [{ url: serversUrl }] });
     };
     const docsTitle = `${ctx.manifest.name ?? "App"} — API docs`;
-    const serveDocs = () => html(swaggerUiPage(docsTitle, specRoutePath));
+    const serveDocs = () => html(swaggerUiPage(docsTitle, specDocUrl));
     // A permanent redirect for the trailing-slash variant (`${docsBase}/`). The router only does
     // exact matches for non-prefix routes, so without this a reverse proxy or browser that appends
     // a slash would 404 on the Swagger UI. 308 preserves the method and points at the canonical

package/dist/runtime/core/modules/pages.js

@@ -369,8 +369,19 @@ function rendererShell(homePage, apiDocsPath) {
     // A persistent "API docs" badge (spec-first apps get their Swagger UI linked from their own
     // UI for free). `target="_blank"` + hardened `rel` so the docs open without giving the docs
     // tab a handle back to this window (reverse-tabnabbing).
+    //
+    // The href must be DOCUMENT-relative, exactly like the `./app/runtime.js` script tag below:
+    // the shell is served at the app's mount root (always a trailing "/"), which is the origin
+    // root for a direct run (CLI on :3000) but a path prefix under the Nano console's reverse
+    // proxy (/console/app-view/<name>/). A root-absolute "/app/api-docs" would escape that prefix
+    // and open the CONSOLE origin (e.g. :8080/app/api-docs) instead of the app's docs. Strip the
+    // single leading slash so it rebases onto the mount root; leave a protocol-relative "//host"
+    // (which apiDocsPath never emits) untouched.
+    const badgeHref = apiDocsPath && apiDocsPath.startsWith("/") && !apiDocsPath.startsWith("//")
+        ? `./${apiDocsPath.slice(1)}`
+        : apiDocsPath;
     const apiDocsBadge = apiDocsPath
-        ? `\n  <a class="pc-apidocs" href="${escapeAttr(apiDocsPath)}" target="_blank" rel="noopener noreferrer">API docs \u2197</a>`
+        ? `\n  <a class="pc-apidocs" href="${escapeAttr(badgeHref)}" target="_blank" rel="noopener noreferrer">API docs \u2197</a>`
         : "";
     return `<!doctype html>
 <html lang="en">
@@ -686,12 +697,21 @@ function renderActionForm(node) {
           msg.textContent = "Field '" + p.action.correlationKeyField + "' is required";
           return;
         }
+        // Send the trimmed key back as the variable too, so the value a worker
+        // reads matches the key the message was correlated on (no leading/trailing
+        // whitespace divergence between correlationKey and variables[field]).
+        variables[p.action.correlationKeyField] = correlationKey;
         await getJSON("/app/actions/message", { method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({ name: p.action.message, correlationKey, variables }) });
         msg.className = "pc-msg ok";
         msg.textContent = "Message published";
       } else {
+        if (!p.action || !p.action.process) {
+          msg.className = "pc-msg err";
+          msg.textContent = "This form has no action configured";
+          return;
+        }
         const res = await getJSON("/app/actions/start/" + encodeURIComponent(p.action.process),
           { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ variables }) });
         msg.className = "pc-msg ok";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/urban",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
   "license": "Apache-2.0",
   "type": "module",

package/src/runtime/core/modules/api.test.ts

@@ -458,9 +458,10 @@ test("serves the OpenAPI spec at {base}-docs/openapi.json, rebased to the mounte
   const doc = JSON.parse(res.body ?? "{}");
   // The doc is served intact...
   assert.ok(doc.paths["/invoices"], "keeps the operation paths");
-  // ...but `servers` is rebased to `base` so Swagger UI "Try it out" hits the real routes
+  // ...but `servers` is rebased to `base` (document-relative, issue #151) so Swagger UI "Try it
+  // out" hits the real routes both at the origin root and under the Nano console reverse proxy
   // (operations mount under /app/api, not the spec's bare /invoices).
-  assert.deepEqual(doc.servers, [{ url: "/app/api" }]);
+  assert.deepEqual(doc.servers, [{ url: "api" }]);
 });
 
 test("serves the Swagger UI page at {base}-docs by default", async () => {
@@ -470,8 +471,10 @@ test("serves the Swagger UI page at {base}-docs by default", async () => {
   assert.match(res.headers?.["content-type"] ?? "", /text\/html/);
   const body = res.body ?? "";
   assert.match(body, /swagger-ui/);
-  // The UI reads the spec route we serve.
-  assert.match(body, /\/app\/api-docs\/openapi\.json/);
+  // The UI reads the spec via a DOCUMENT-relative URL (issue #151) so it resolves through the
+  // Nano console reverse proxy, not a root-absolute path that escapes to the console origin.
+  assert.match(body, /url: "api-docs\/openapi\.json"/);
+  assert.doesNotMatch(body, /url: "\/app\/api-docs\/openapi\.json"/);
 });
 
 test("the trailing-slash docs variant 308-redirects to the canonical path", async () => {

package/src/runtime/core/modules/api.ts

@@ -252,6 +252,25 @@ export function mountApi(ctx: RuntimeContext, app: AppApi): ApiHandle {
   const dir = binding.dir ?? "operations";
   const surfaceEject = binding.eject === true;
   const specRoutePath = `${docsBase}/openapi.json`;
+  // The Swagger UI page is served at `docsBase` (no trailing slash — the slash variant 308-
+  // redirects onto it), so its browser-relative base is the PARENT directory. Hand Swagger UI a
+  // DOCUMENT-relative spec URL and `servers` entry so both rebase onto the app's mount root:
+  // correct at the origin root (CLI :3000) AND under the Nano console reverse proxy
+  // (/console/app-view/<name>/), where a root-absolute "/app/…" escapes the prefix and hits the
+  // console origin instead of the app (issue #151).
+  const lastSegment = (p: string): string => p.split("/").filter(Boolean).pop() ?? "";
+  const parentPath = (p: string): string => {
+    const parts = p.split("/").filter(Boolean);
+    parts.pop();
+    return `/${parts.join("/")}`;
+  };
+  // `${docsBase}/openapi.json` reached relatively from the docs page = `<docs-segment>/openapi.json`.
+  const specDocUrl = `${lastSegment(docsBase)}/openapi.json`;
+  // `servers` can only be relativized when the operations `base` shares the docs page's parent
+  // directory (the default `${base}-docs` sibling). For a fully custom `docs` path under a
+  // different parent, keep the root-absolute base (works direct; try-it-out through the proxy is
+  // the documented limitation in #151).
+  const serversUrl = parentPath(base) === parentPath(docsBase) ? lastSegment(base) : base;
 
   // Resolve + parse the spec lazily on first request and cache it (mirroring the lazy module load
   // pattern). A malformed/unreadable spec surfaces as a 500 on request — with the reason — rather
@@ -538,12 +557,13 @@ export function mountApi(ctx: RuntimeContext, app: AppApi): ApiHandle {
       return json({ error: errorMessage(e) }, 500);
     }
     // Point Swagger UI "Try it out" at the mounted namespace: operations live under `base`
-    // (e.g. /app/api/invoices), not the spec's bare paths (/invoices). Overriding `servers`
-    // makes the interactive console call the real Urban routes rather than the origin root.
-    return json({ ...d, servers: [{ url: base }] });
+    // (e.g. /app/api/invoices), not the spec's bare paths (/invoices). Overriding `servers` with a
+    // document-relative URL (issue #151) makes the interactive console call the real Urban routes
+    // both at the origin root and under the Nano console reverse proxy.
+    return json({ ...d, servers: [{ url: serversUrl }] });
   };
   const docsTitle = `${ctx.manifest.name ?? "App"} — API docs`;
-  const serveDocs = (): HttpResponse => html(swaggerUiPage(docsTitle, specRoutePath));
+  const serveDocs = (): HttpResponse => html(swaggerUiPage(docsTitle, specDocUrl));
   // A permanent redirect for the trailing-slash variant (`${docsBase}/`). The router only does
   // exact matches for non-prefix routes, so without this a reverse proxy or browser that appends
   // a slash would 404 on the Swagger UI. 308 preserves the method and points at the canonical

package/src/runtime/core/modules/pages.test.ts

@@ -98,6 +98,29 @@ test("GET / serves the renderer shell with the home marker", async () => {
   assert.doesNotMatch(res.body ?? "", /src="\/app\/runtime\.js"/);
 });
 
+test("the API docs badge links via a document-relative href (proxy-safe)", async () => {
+  // With an `api` binding, the shell renders a persistent "API docs" badge. Its
+  // href must be DOCUMENT-relative (./app/api-docs), mirroring the runtime.js
+  // script tag, so it resolves against the shell's mount root. A root-absolute
+  // "/app/api-docs" would escape the Nano console's /console/app-view/<name>/
+  // reverse proxy and open the console origin (e.g. :8080/app/api-docs) instead
+  // of the app's own docs — the port-mismatch bug this guards against.
+  const { engine } = fakeEngine();
+  const routes = createPagesRoutes(
+    { pagesDir: "pages", homePage: "home", sourceName: "app", apiDocsPath: "/app/api-docs" },
+    {
+      db: fakeDb(),
+      engine,
+      readPage: async () => JSON.stringify({ title: "Home", nodes: [] }),
+      listPages: async () => ["home"],
+    },
+  );
+  const res = await makeRouter(routes)(req("GET", "/"));
+  assert.match(res.body ?? "", /class="pc-apidocs"/);
+  assert.match(res.body ?? "", /href="\.\/app\/api-docs"/);
+  assert.doesNotMatch(res.body ?? "", /href="\/app\/api-docs"/);
+});
+
 test("the shell styles the app through the shared --nano-* token contract", async () => {
   const res = await dispatch("GET", "/");
   const html = res.body ?? "";
@@ -129,7 +152,7 @@ test("the shell renders an API-docs badge only when an apiDocsPath is provided",
   );
   const withBadge = (await makeRouter(routes)(req("GET", "/"))).body ?? "";
   assert.match(withBadge, /class="pc-apidocs"/);
-  assert.match(withBadge, /href="\/app\/api-docs"/);
+  assert.match(withBadge, /href="\.\/app\/api-docs"/);
   // Opens in a new tab with a hardened rel (no reverse-tabnabbing handle).
   assert.match(withBadge, /rel="noopener noreferrer"/);
 
@@ -146,8 +169,14 @@ test("renderActionForm supports a publishMessage action (message-started process
   assert.match(js, /p\.action\.kind === "publishMessage"/);
   assert.match(js, /variables\[p\.action\.correlationKeyField\]/);
   assert.match(js, /"\/app\/actions\/message"/);
+  // The trimmed correlation key is written back as the variable, so the value a
+  // worker reads matches the key the message was correlated on.
+  assert.match(js, /variables\[p\.action\.correlationKeyField\] = correlationKey/);
   // startProcess remains the default/back-compat branch.
   assert.match(js, /"\/app\/actions\/start\/" \+ encodeURIComponent\(p\.action\.process\)/);
+  // A missing action is reported clearly instead of throwing on p.action.process.
+  assert.match(js, /if \(!p\.action \|\| !p\.action\.process\)/);
+  assert.match(js, /no action configured/);
 });
 
 test("the renderer bridges the console theme over postMessage", async () => {

package/src/runtime/core/modules/pages.ts

@@ -414,8 +414,20 @@ function rendererShell(homePage: string, apiDocsPath?: string): string {
   // A persistent "API docs" badge (spec-first apps get their Swagger UI linked from their own
   // UI for free). `target="_blank"` + hardened `rel` so the docs open without giving the docs
   // tab a handle back to this window (reverse-tabnabbing).
+  //
+  // The href must be DOCUMENT-relative, exactly like the `./app/runtime.js` script tag below:
+  // the shell is served at the app's mount root (always a trailing "/"), which is the origin
+  // root for a direct run (CLI on :3000) but a path prefix under the Nano console's reverse
+  // proxy (/console/app-view/<name>/). A root-absolute "/app/api-docs" would escape that prefix
+  // and open the CONSOLE origin (e.g. :8080/app/api-docs) instead of the app's docs. Strip the
+  // single leading slash so it rebases onto the mount root; leave a protocol-relative "//host"
+  // (which apiDocsPath never emits) untouched.
+  const badgeHref =
+    apiDocsPath && apiDocsPath.startsWith("/") && !apiDocsPath.startsWith("//")
+      ? `./${apiDocsPath.slice(1)}`
+      : apiDocsPath;
   const apiDocsBadge = apiDocsPath
-    ? `\n  <a class="pc-apidocs" href="${escapeAttr(apiDocsPath)}" target="_blank" rel="noopener noreferrer">API docs \u2197</a>`
+    ? `\n  <a class="pc-apidocs" href="${escapeAttr(badgeHref!)}" target="_blank" rel="noopener noreferrer">API docs \u2197</a>`
     : "";
   return `<!doctype html>
 <html lang="en">
@@ -733,12 +745,21 @@ function renderActionForm(node) {
           msg.textContent = "Field '" + p.action.correlationKeyField + "' is required";
           return;
         }
+        // Send the trimmed key back as the variable too, so the value a worker
+        // reads matches the key the message was correlated on (no leading/trailing
+        // whitespace divergence between correlationKey and variables[field]).
+        variables[p.action.correlationKeyField] = correlationKey;
         await getJSON("/app/actions/message", { method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({ name: p.action.message, correlationKey, variables }) });
         msg.className = "pc-msg ok";
         msg.textContent = "Message published";
       } else {
+        if (!p.action || !p.action.process) {
+          msg.className = "pc-msg err";
+          msg.textContent = "This form has no action configured";
+          return;
+        }
         const res = await getJSON("/app/actions/start/" + encodeURIComponent(p.action.process),
           { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ variables }) });
         msg.className = "pc-msg ok";