@wopr-network/platform-ui-core 1.27.2 → 1.27.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wopr-network/platform-ui-core",
-  "version": "1.27.2",
+  "version": "1.27.3",
   "description": "Brand-agnostic AI agent platform UI — deploy as any brand via env vars",
   "repository": {
     "type": "git",

package/src/lib/api-config.ts

@@ -1,62 +1,51 @@
 /**
  * Centralized API base URL configuration.
  *
- * Set NEXT_PUBLIC_API_URL to the platform root (e.g. "http://localhost:3001").
- * All API clients derive their paths from this single value.
+ * The API URL is derived at runtime from the hostname — no NEXT_PUBLIC_API_URL
+ * env var needed. Convention: UI at `<domain>` → API at `api.<domain>`.
+ * Staging: `staging.<domain>` → `staging.api.<domain>`.
  *
- * In production runtime, validates that the URL is a public HTTPS endpoint.
- * This prevents internal Docker hostnames from leaking into the browser bundle.
+ * Falls back to NEXT_PUBLIC_API_URL if set (local dev), then localhost.
  */
 
 import { getBrandConfig } from "./brand-config";
 
-const INTERNAL_HOSTNAME_RE =
-  /^(localhost|127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|.*\.local$)/i;
-
-function isInternalHostname(hostname: string): boolean {
-  return INTERNAL_HOSTNAME_RE.test(hostname) || !hostname.includes(".");
-}
-
-function validateProductionApiUrl(url: string | undefined): void {
-  const isProductionRuntime =
-    process.env.NODE_ENV === "production" &&
-    process.env.NEXT_RUNTIME === "nodejs" &&
-    process.env.NEXT_PHASE !== "phase-production-build" &&
-    !process.env.E2E_MOCK_API;
-
-  if (!isProductionRuntime) return;
-
-  if (!url) {
-    throw new Error(
-      "NEXT_PUBLIC_API_URL is not set. In production it must be a public HTTPS URL. An internal hostname or localhost will not work in the browser.",
-    );
-  }
-
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(
-      `NEXT_PUBLIC_API_URL ("${url}") is not a valid URL. In production it must be a public HTTPS URL.`,
-    );
+/**
+ * Derive the platform API URL from the current hostname.
+ * Works on both client (window.location) and server (brand config domain).
+ */
+function resolveApiUrl(): string {
+  // 1. Explicit env var — local dev, tests, or override
+  const envUrl = process.env.NEXT_PUBLIC_API_URL;
+  if (envUrl) return envUrl;
+
+  // 2. Client-side: derive from browser hostname
+  if (typeof window !== "undefined") {
+    const host = window.location.hostname;
+    const proto = window.location.protocol;
+    // localhost → local dev
+    if (host === "localhost" || host === "127.0.0.1") {
+      return "http://localhost:3001";
+    }
+    // staging.X.com → staging.api.X.com
+    if (host.startsWith("staging.")) {
+      const base = host.replace(/^staging\./, "");
+      return `${proto}//staging.api.${base}`;
+    }
+    // X.com → api.X.com
+    return `${proto}//api.${host}`;
   }
 
-  if (isInternalHostname(parsed.hostname)) {
-    throw new Error(
-      `NEXT_PUBLIC_API_URL ("${url}") contains an internal hostname ("${parsed.hostname}"). In production it must be a public HTTPS URL.`,
-    );
+  // 3. Server-side: derive from brand config domain
+  const domain = getBrandConfig().domain;
+  if (domain && domain !== "localhost" && domain.includes(".")) {
+    return `https://api.${domain}`;
   }
 
-  if (parsed.protocol !== "https:") {
-    throw new Error(
-      `NEXT_PUBLIC_API_URL ("${url}") uses ${parsed.protocol} but production requires https. Set it to the public HTTPS URL.`,
-    );
-  }
+  return "http://localhost:3001";
 }
 
-validateProductionApiUrl(process.env.NEXT_PUBLIC_API_URL);
-
-export const PLATFORM_BASE_URL = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:3001";
+export const PLATFORM_BASE_URL = resolveApiUrl();
 
 /** Base URL for REST API calls (platform root + /api). */
 export const API_BASE_URL = `${PLATFORM_BASE_URL}/api`;

package/src/proxy.ts

@@ -5,9 +5,24 @@ import { sanitizeRedirectUrl } from "@/lib/utils";
 
 const log = logger("middleware");
 
-const apiOrigin = process.env.NEXT_PUBLIC_API_URL
-  ? new URL(process.env.NEXT_PUBLIC_API_URL).origin
-  : "";
+/** Derive API origin from request hostname. Convention: api.<domain>. */
+function getApiOrigin(host: string): string {
+  // Explicit override for local dev
+  if (process.env.NEXT_PUBLIC_API_URL) {
+    try {
+      return new URL(process.env.NEXT_PUBLIC_API_URL).origin;
+    } catch {
+      /* fall through */
+    }
+  }
+  if (!host || host === "localhost" || host.startsWith("localhost:")) return "";
+  const hostname = host.split(":")[0];
+  if (hostname.startsWith("staging.")) {
+    const base = hostname.replace(/^staging\./, "");
+    return `https://staging.api.${base}`;
+  }
+  return `https://api.${hostname}`;
+}
 
 /**
  * Only add upgrade-insecure-requests when actually serving over HTTPS.
@@ -25,8 +40,9 @@ const apiOrigin = process.env.NEXT_PUBLIC_API_URL
 const NONCE_STYLES_ENABLED = true;
 
 /** Build the CSP header value with a per-request nonce. */
-function buildCsp(nonce: string, requestUrl?: string): string {
+function buildCsp(nonce: string, requestUrl?: string, requestHost?: string): string {
   const isHttps = requestUrl ? requestUrl.startsWith("https://") : false;
+  const api = getApiOrigin(requestHost ?? "");
   return [
     "default-src 'self'",
     `script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https://js.stripe.com`,
@@ -35,7 +51,7 @@ function buildCsp(nonce: string, requestUrl?: string): string {
       : ["style-src 'self' 'unsafe-inline'"]),
     "img-src 'self' data: blob:",
     "font-src 'self'",
-    `connect-src 'self' https://api.stripe.com${apiOrigin ? ` ${apiOrigin}` : ""}`,
+    `connect-src 'self' https://api.stripe.com${api ? ` ${api}` : ""}`,
     "frame-src https://js.stripe.com",
     "frame-ancestors 'none'",
     "base-uri 'self'",
@@ -165,7 +181,7 @@ export default async function middleware(request: NextRequest) {
 
   // Generate a per-request nonce for CSP
   const nonce = crypto.randomUUID();
-  const cspHeaderValue = buildCsp(nonce, request.url);
+  const cspHeaderValue = buildCsp(nonce, request.url, request.headers.get("host") ?? "");
 
   /** Apply CSP and cache-busting headers to any response before returning it. */
   function withCsp(response: NextResponse): NextResponse {