anbaric-cloud-hosting 1.16.1 → 1.16.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,17 +18,17 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.16.1",
-    "anbaric-plugins": "^1.16.1",
-    "anbaric-tsapi": "^1.16.1",
+    "anbaric-data-store": "^1.16.2",
+    "anbaric-plugins": "^1.16.2",
+    "anbaric-tsapi": "^1.16.2",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.16.1",
-    "anbaric-state-machine": "^1.16.1",
+    "anbaric-impl-cloud": "^1.16.2",
+    "anbaric-state-machine": "^1.16.2",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/hosting/handlers/AppProxyHandler.ts

@@ -1,9 +1,21 @@
+import {IncomingHttpHeaders, OutgoingHttpHeaders, request as httpRequest} from "node:http";
 import {BuildLayer} from "../../app-management/BuildLayer";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
-/* The router's fallback: any unregistered top-level path naming a running
-   app is forwarded to it. */
+/* Headers that describe a single hop and must not be forwarded across the
+   proxy in either direction. */
+const HOP_BY_HOP = new Set([
+    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
+    "te", "trailer", "transfer-encoding", "upgrade",
+]);
+
+/* The router's fallback: any unregistered top-level path naming a running app
+   is reverse-proxied to it. The app is exposed at /<appName>; that prefix is
+   stripped before forwarding (the app sees the sub-path) and surfaced to the
+   app as X-Forwarded-Prefix so it can rebuild public URLs. Request and response
+   headers pass through both ways - notably cookies, Set-Cookie and Location - so
+   sessions and redirects work from app-served HTML. */
 class AppProxyHandler implements RequestHandler {
 
     constructor(private buildLayer : BuildLayer) {}
@@ -16,17 +28,41 @@ class AppProxyHandler implements RequestHandler {
         const appPath = request.url.pathname.slice(`/${appName}`.length) || "/";
         const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.rawBody();
 
-        const upstream = await fetch(`http://${app.appHost}:${app.appPort}${appPath}${request.url.search}`, {
-            method: request.method,
-            headers: { "content-type": request.header("content-type") ?? "application/json" },
-            body: body && body.length > 0 ? new Uint8Array(body) : undefined,
+        await new Promise<void>((resolve, reject) => {
+            const upstream = httpRequest({
+                host: app.appHost,
+                port: app.appPort,
+                method: request.method,
+                path: `${appPath}${request.url.search}`,
+                headers: this.forwardHeaders(request, appName),
+            }, response => {
+                request.rawResponse.writeHead(response.statusCode ?? 502, this.passThrough(response.headers));
+                response.pipe(request.rawResponse);
+                response.on("end", resolve);
+                response.on("error", reject);
+            });
+            upstream.on("error", reject);
+            if (body && body.length > 0) upstream.write(body);
+            upstream.end();
         });
+    }
 
-        const payload = Buffer.from(await upstream.arrayBuffer());
-        request.rawResponse.writeHead(upstream.status, {
-            "content-type": upstream.headers.get("content-type") ?? "application/octet-stream",
-        });
-        request.rawResponse.end(payload);
+    private forwardHeaders(request : Request, appName : string) : OutgoingHttpHeaders {
+        const headers = this.passThrough(request.raw.headers);
+        delete headers.host;
+        headers["x-forwarded-prefix"] = `/${appName}`;
+        headers["x-forwarded-host"] = request.raw.headers.host;
+        headers["x-forwarded-proto"] = "https";
+        return headers;
+    }
+
+    private passThrough(headers : IncomingHttpHeaders) : OutgoingHttpHeaders {
+        const kept : OutgoingHttpHeaders = {};
+        for (const [name, value] of Object.entries(headers)) {
+            if (value === undefined || HOP_BY_HOP.has(name)) continue;
+            kept[name] = value;
+        }
+        return kept;
     }
 
 }

package/src/hosting/handlers/AppsHandler.ts

@@ -27,7 +27,7 @@ class AppsHandler implements RequestHandler {
             case "POST": {
                 const appPort = Number(request.query("port"));
                 if (!Number.isInteger(appPort) || appPort <= 0) {
-                    return request.reply(400, { error: "Expected a numeric port query parameter" });
+                    return request.reply(400, { error: "Expected a numeric ?port query parameter - the app's internal port (\"internalPort\" in .anbaric/app-config.json)" });
                 }
                 const tarball = await request.rawBody();
                 if (tarball.length === 0) return request.reply(400, { error: "Expected a gzipped tarball body" });