json-rest-api 1.0.24 → 1.0.25

package/docs/GUIDE/GUIDE_X_URL_Management.md

@@ -2,316 +2,155 @@
 
 ## Overview
 
-The JSON REST API automatically generates appropriate URLs for all resources in JSON:API responses. URLs are calculated **per-request** based on the incoming request headers, ensuring correct URLs in all deployment scenarios without configuration.
+JSON REST API generates JSON:API links and `Location` headers from explicit library configuration. By default, generated URLs are relative to the configured transport `mountPath`.
 
-## How It Works
+Request headers such as `Host`, `X-Forwarded-Host`, and `X-Forwarded-Proto` are not trusted for URL generation. This keeps links from reflecting attacker-controlled request headers.
 
-### Automatic URL Detection
+## Default Relative Links
 
-URLs in responses (links, hrefs) are automatically generated based on:
-
-1. **Protocol**: Detected from `X-Forwarded-Proto` header or request protocol
-2. **Host**: Detected from `X-Forwarded-Host` or `Host` header  
-3. **Mount Path**: Where your API routes are mounted (e.g., `/api`)
+For a standard Express or Fastify setup:
 
 ```javascript
-// Example: Simple setup - no URL configuration needed!
 await api.use(RestApiPlugin);
 await api.use(RestApiKnexPlugin, { knex });
 await api.use(ExpressPlugin, { mountPath: '/api' });
 ```
 
-### Different Deployment Scenarios
+Generated links use the mount path:
 
-#### Local Development
-```
-Request: GET http://localhost:3000/api/books
-Response links: http://localhost:3000/api/books/1
+```json
+{
+  "data": {
+    "type": "books",
+    "id": "123",
+    "links": {
+      "self": "/api/books/123"
+    }
+  }
+}
 ```
 
-#### Production with Domain
-```
-Request: GET https://api.example.com/api/books
-Response links: https://api.example.com/api/books/1
-```
+This is the recommended default for most deployments. Browsers and HTTP clients resolve the relative links against the origin they already used to call the API.
 
-#### Behind Reverse Proxy (Nginx/Apache)
-```nginx
-# Nginx configuration
-proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header X-Forwarded-Host $host;
-proxy_pass http://backend:3000;
-```
+## Absolute Public Links
 
-```
-Request headers:
-  X-Forwarded-Proto: https
-  X-Forwarded-Host: api.example.com
-Response links: https://api.example.com/api/books/1
-```
+When clients require absolute public URLs, configure the connector with `publicBaseUrl`. The value is the complete public URL prefix for generated API links, including any public path prefix such as `/api`.
 
-#### Multi-Tenant SaaS
-Each tenant gets their own domain in responses automatically:
+```javascript
+await api.use(ExpressPlugin, {
+  mountPath: '/api',
+  publicBaseUrl: 'https://api.example.com/api'
+});
 ```
-Tenant A request: GET https://customer-a.api.com/api/books
-Response links: https://customer-a.api.com/api/books/1
 
-Tenant B request: GET https://customer-b.api.com/api/books  
-Response links: https://customer-b.api.com/api/books/1
+Fastify uses the same option:
+
+```javascript
+await api.use(FastifyPlugin, {
+  app,
+  mountPath: '/api',
+  publicBaseUrl: 'https://api.example.com/api'
+});
 ```
 
-## Advanced: Custom URL Override
+Generated links then use the configured public base URL:
+
+```json
+{
+  "links": {
+    "self": "https://api.example.com/api/books/123"
+  }
+}
+```
 
-For complex deployments (API gateways, CDNs, etc.), you can override URL generation using hooks.
+Trailing slashes on `publicBaseUrl` are normalized before links are built.
 
-### Recommended Method: API Hooks (Best Practice)
+## Per-Request Overrides
 
-Define a hook when creating your API to handle URL overrides:
+For multi-tenant deployments or API gateways with request-specific public URLs, set `context.urlPrefixOverride` in a `transport:request` hook. Only set this from trusted configuration or validated request metadata.
 
 ```javascript
-const api = new Api({ 
-  name: 'my-api',
-  
-  // Define hooks at API creation time
+await api.customize({
   hooks: {
-    'transport:request': [
-      async (payload) => {
-        const { context, req } = payload;
-        
-        // Example: Override based on custom header
-        if (req?.headers?.['x-public-url']) {
-          context.urlPrefixOverride = req.headers['x-public-url'];
+    'transport:request': {
+      functionName: 'tenant-url-prefix',
+      handler: async ({ context }) => {
+        const tenantId = context.auth?.tenantId;
+        const tenantPublicUrls = {
+          tenant_a: 'https://tenant-a.example.com/api',
+          tenant_b: 'https://tenant-b.example.com/api'
+        };
+
+        if (tenantPublicUrls[tenantId]) {
+          context.urlPrefixOverride = tenantPublicUrls[tenantId];
         }
-        
-        // Example: API versioning
-        if (req?.headers?.['x-api-version'] === 'v2') {
-          context.urlPrefixOverride = 'https://api.example.com/v2';
-        }
-        
-        // Example: Multi-tenant based on host
-        const host = req?.hostname;
-        if (host?.includes('tenant-a')) {
-          context.urlPrefixOverride = 'https://tenant-a.api.com/api';
-        }
-        
-        // Example: Environment-based override
-        if (process.env.PUBLIC_API_URL) {
-          context.urlPrefixOverride = process.env.PUBLIC_API_URL;
-        }
-        
-        return payload;
       }
-    ]
+    }
   }
 });
-
-// Then use plugins normally
-await api.use(RestApiPlugin);
-await api.use(RestApiKnexPlugin, { knex });
-await api.use(ExpressPlugin, { mountPath: '/api' });
 ```
 
-### Alternative Method: Express Middleware
-
-If you cannot use hooks, you can use Express middleware before mounting the API:
+Express middleware can also set `req.urlPrefixOverride` before the API router runs:
 
 ```javascript
+const allowedPublicUrls = new Set([
+  'https://api.example.com/api',
+  'https://partner.example.com/api'
+]);
+
 app.use((req, res, next) => {
-  // Set urlPrefixOverride on the request
-  if (req.headers['x-public-url']) {
-    req.urlPrefixOverride = req.headers['x-public-url'];
+  const requestedPublicUrl = req.get('x-public-url');
+  if (allowedPublicUrls.has(requestedPublicUrl)) {
+    req.urlPrefixOverride = requestedPublicUrl;
   }
   next();
 });
 
-// Then mount your API
-app.use(api.http.express.router);
+api.http.express.mount(app);
 ```
 
-### Common Use Cases for Override
-
-1. **API Gateway with Path Rewriting**
-   ```javascript
-   hooks: {
-     'transport:request': [async (payload) => {
-       if (payload.req?.headers?.['x-forwarded-prefix'] === '/v2') {
-         payload.context.urlPrefixOverride = 'https://api.company.com/v2';
-       }
-       return payload;
-     }]
-   }
-   ```
-
-2. **CDN with Different Public URL**
-   ```javascript
-   hooks: {
-     'transport:request': [async (payload) => {
-       if (payload.req?.headers?.['x-cdn-host']) {
-         payload.context.urlPrefixOverride = `https://${payload.req.headers['x-cdn-host']}/api`;
-       }
-       return payload;
-     }]
-   }
-   ```
-
-3. **Multi-Tenant SaaS**
-   ```javascript
-   hooks: {
-     'transport:request': [async (payload) => {
-       const { context, req } = payload;
-       const tenant = req?.hostname?.split('.')[0];
-       if (tenant && tenant !== 'api') {
-         context.urlPrefixOverride = `https://${tenant}.api.com/api`;
-       }
-       return payload;
-     }]
-   }
-   ```
-
-4. **Environment-Based URLs**
-   ```javascript
-   hooks: {
-     'transport:request': [async (payload) => {
-       // Force production URLs in staging for testing
-       if (process.env.NODE_ENV === 'staging' && process.env.PRODUCTION_URL) {
-         payload.context.urlPrefixOverride = process.env.PRODUCTION_URL;
-       }
-       return payload;
-     }]
-   }
-   ```
-
-## What You DON'T Need to Configure
-
-❌ **No need for:**
-- Static URL configuration
-- Per-environment URL settings
-- Manual protocol detection
-- Proxy configuration in the API
-
-The system automatically handles:
-- HTTP vs HTTPS detection
-- Domain detection from headers
-- Proxy headers (`X-Forwarded-*`)
-- Port numbers
-- Mount paths
-
-## URL Generation Examples
-
-### Resource URLs
-```javascript
-// Generated in responses as:
-{
-  "type": "books",
-  "id": "123",
-  "attributes": { ... },
-  "links": {
-    "self": "https://api.example.com/api/books/123"  // Automatically generated
-  }
-}
-```
+Do not copy arbitrary `Host`, `X-Forwarded-Host`, or custom public URL headers into `urlPrefixOverride`. If a reverse proxy supplies public URL metadata, validate it against trusted configuration first.
 
-### Relationship URLs
-```javascript
-{
-  "relationships": {
-    "author": {
-      "links": {
-        "self": "https://api.example.com/api/books/123/relationships/author",
-        "related": "https://api.example.com/api/books/123/author"
-      }
-    }
-  }
-}
-```
+## Priority Order
 
-### Pagination URLs
-```javascript
-{
-  "links": {
-    "self": "https://api.example.com/api/books?page[number]=2",
-    "first": "https://api.example.com/api/books?page[number]=1",
-    "prev": "https://api.example.com/api/books?page[number]=1",
-    "next": "https://api.example.com/api/books?page[number]=3",
-    "last": "https://api.example.com/api/books?page[number]=10"
-  }
-}
-```
+URL prefix resolution uses this order:
 
-## Benefits of Per-Request URL Generation
+1. `context.urlPrefixOverride`
+2. Connector `publicBaseUrl`
+3. Connector `mountPath`
+4. Empty string
 
-1. **Zero Configuration**: Works correctly out of the box
-2. **Multi-Domain Safe**: Each request gets appropriate URLs
-3. **Proxy Friendly**: Automatically handles reverse proxies
-4. **Flexible**: Override when needed for complex scenarios
-5. **Stateless**: No global state that can be contaminated
+The same helper is used for resource links, relationship links, pagination links, and connector `Location` headers.
 
-## Troubleshooting
+## Reverse Proxies
 
-### URLs are showing localhost in production
-- Ensure your reverse proxy is setting `X-Forwarded-Host` and `X-Forwarded-Proto` headers
-- Check that these headers are being passed through to your application
+A reverse proxy should still forward requests to the Node.js application normally, but URL generation does not require forwarding public host headers.
 
-### Need different URLs for different environments
-- Use the `urlPrefixOverride` pattern with environment variables
-- Set `PUBLIC_API_URL` environment variable appropriately
+Use explicit configuration for public links:
 
-### API Gateway stripping paths
-- Use middleware to set `req.urlPrefixOverride` with the full public path
-- Include any path prefixes that the gateway strips
+```javascript
+await api.use(ExpressPlugin, {
+  mountPath: '/api',
+  publicBaseUrl: process.env.PUBLIC_API_URL
+});
+```
 
-## Complete Working Example
+Set `PUBLIC_API_URL` to the externally visible API prefix, for example `https://api.example.com/api`.
 
-Here's a full example showing URL override with hooks:
+## Troubleshooting
 
-```javascript
-import { Api } from 'hooked-api';
-import { RestApiPlugin, RestApiKnexPlugin, ExpressPlugin } from 'json-rest-api';
-import express from 'express';
+### Links are relative
 
-// Create API with URL override hook
-const api = new Api({ 
-  name: 'my-api',
-  hooks: {
-    'transport:request': [
-      async (payload) => {
-        const { context, req } = payload;
-        
-        // Check for custom public URL header
-        if (req?.headers?.['x-public-url']) {
-          context.urlPrefixOverride = req.headers['x-public-url'];
-        }
-        
-        return payload;
-      }
-    ]
-  }
-});
+This is the default behavior. Configure `publicBaseUrl` if your clients require absolute URLs.
 
-// Install plugins
-await api.use(RestApiPlugin);
-await api.use(RestApiKnexPlugin, { knex });
-await api.use(ExpressPlugin, { mountPath: '/api' });
+### Links are missing a public path prefix
 
-// Define resources...
-await api.addResource('books', { /* schema */ });
+Include the public path prefix in `publicBaseUrl`.
 
-// Create Express app
-const app = express();
-app.use(api.http.express.router);
-app.listen(3000);
+```javascript
+publicBaseUrl: 'https://api.example.com/v2'
 ```
 
-Now your API automatically handles:
-- `curl http://localhost:3000/api/books` → URLs: `http://localhost:3000/api/books/1`
-- `curl -H "X-Public-URL: https://cdn.example.com/api" http://localhost:3000/api/books` → URLs: `https://cdn.example.com/api/books/1`
-
-## Summary
-
-The JSON REST API's URL management system provides:
-- **Automatic detection** for 99% of use cases
-- **Hook-based override** for complex deployments
-- **Per-request isolation** preventing cross-domain issues
-- **No configuration** required for standard deployments
+### Multi-tenant links need different hosts
 
-Just set your `mountPath` in the Express plugin and optionally define hooks for custom scenarios!
+Use `context.urlPrefixOverride` from trusted tenant or auth state. Avoid deriving tenant URLs directly from untrusted request host headers.

package/docs/GUIDE/GUIDE_X_Writing_Plugins.md

@@ -106,6 +106,8 @@ addHook('knexQueryFiltering', 'scope-by-workspace', {}, async ({ context }) => {
 
 `knexQueryFiltering` is the right seam for filtering. It is **not** the right seam for turning ad hoc SQL aliases into first-class fields.
 
+For mandatory resource visibility, prefer the supported [`RowPolicyPlugin`](GUIDE_X_Row_Policies.md) contract over registering a raw filtering hook. It validates resource configuration, requires an explicit allow/deny decision, provides logical field translation, exposes query-purpose metadata, and is exercised across pagination counts, single-record preflights, includes, and relationship loading.
+
 ### `addScopeMethod`
 
 Use this when a plugin needs a reusable method on every resource or selected resources.

package/docs/GUIDE/index.md

@@ -28,7 +28,7 @@ Welcome to the comprehensive guide for JSON REST API. This guide will walk you t
 ### Additional Topics
 
 - **[File Uploads](GUIDE_X_File_Uploads.md)**  
-  Handle file uploads with multiple backends (file system, S3).
+  Handle file uploads with local storage and a mock S3-style demo adapter.
 
 - **[Bulk Operations](GUIDE_X_Bulk_Operations.md)**  
   Handle multiple records efficiently with bulk create, update, and delete operations.
@@ -39,6 +39,9 @@ Welcome to the comprehensive guide for JSON REST API. This guide will walk you t
 - **[Autofiltering](GUIDE_X_Autofiltering.md)**  
   Scope datasets automatically using configured context values, without baking in auth semantics.
 
+- **[Row Policies](GUIDE_X_Row_Policies.md)**
+  Apply mandatory server-side visibility predicates before pagination, counts, includes, and relationship loading.
+
 - **[Knex Schema and Migrations](GUIDE_X_Knex_Schema_And_Migrations.md)**  
   Create tables, inspect live table snapshots, and generate create or additive diff migrations from table-backed resource scopes.
 

package/fixing_plan.md

@@ -0,0 +1,112 @@
+# Fixing Plan
+
+Checklist-style plan for addressing the audit findings. Items marked as requiring approval change public behavior, public API, or dependencies.
+
+## High Priority
+
+- [x] Fix AnyAPI custom `idProperty` canonical mapping.
+  - [x] Treat `schemaInfo.idProperty` as an alias of logical `id` in the canonical storage adapter.
+  - [x] Skip custom id fields such as `item_id` when building DB attribute selections.
+  - [x] Ensure cursor, sort, projection, sparse fieldset, and include paths translate both `id` and `idProperty` to `logical_id`.
+  - [x] Add AnyAPI tests for custom-id `post`, `get`, `query`, sparse fields, and cursor pagination.
+
+- [x] Fix AnyAPI PUT create parity.
+  - [x] Branch `helpers.dataPut` on `context.isCreate`.
+  - [x] In create mode, insert into `any_records` with tenant, resource, logical id, and translated attributes.
+  - [x] Keep the current update path for update mode.
+  - [x] Add legacy Knex and AnyAPI parity tests for `PUT /resource/:id` create, including custom IDs.
+
+- [x] Fix pagination link query-string round trips.
+  - [x] Replace manual query-string concatenation with one serializer that is the inverse of `parseJsonApiQuery`.
+  - [x] Use `URLSearchParams` for keys and values.
+  - [x] Map internal `queryParams.filters` back to public JSON:API `filter[...]`.
+  - [x] Add tests that parse generated `links.next` and prove filters, fields, sort, include, and page params survive round trip.
+
+- [x] Fix relationship PATCH cardinality validation.
+  - [x] Generate relationship-aware request contracts from relationship metadata.
+  - [x] Allow to-one relationship PATCH data to be `null` or one resource identifier only.
+  - [x] Allow to-many relationship data to be arrays only.
+  - [x] Make `processRelationships()` throw when a belongsTo relationship receives an array.
+  - [x] Add API and transport tests for invalid to-one arrays and invalid to-many scalars.
+
+- [x] Run `afterCommit` for relationship routes.
+  - [x] After `postRelationship`, `patchRelationship`, and `deleteRelationship` commit their own transaction, run `afterCommit`.
+  - [x] Preserve rollback behavior through `afterRollback`.
+  - [x] Verify Socket.IO deferred relationship broadcasts work, or define a separate relationship notification policy.
+  - [x] Add tests with an `afterCommit` hook counter and Socket.IO relationship-write subscription behavior.
+
+- [x] Decide and fix post-commit hook failure semantics.
+  - [x] Split transaction work from post-commit side effects.
+  - [x] Once `commit()` succeeds, do not call rollback handling.
+  - [x] Surface post-commit hook errors while preserving already-committed data.
+  - [x] Add tests proving the row remains committed and the response/error semantics are intentional.
+
+## Medium Priority
+
+- [x] Fix AnyAPI pagination fixture cleanup.
+  - [x] Register `cursor_products` and `cursor_items` with `storageMode.registerTable()` in `createCursorPaginationApi`.
+  - [x] Add a focused cleanup test proving `cleanTables(knex, ['cursor_products'])` deletes matching `any_records`.
+  - [x] Keep metadata-derived cleanup mappings as a later refactor if a broader helper change is approved.
+
+- [x] Fix file temp and orphan cleanup.
+  - [x] Wrap file processing in `try/finally` so detector temp files are cleaned after validation failures.
+  - [x] Track successfully uploaded URLs on `context`.
+  - [x] On rollback or later write error, call storage `delete(url)` where available.
+  - [x] Document `delete(url)` as the rollback-capable storage contract.
+  - [x] Add tests for invalid MIME cleanup and post-upload DB/validation rollback cleanup.
+
+- [x] Harden `LocalStorage` path containment.
+  - [x] Sanitize or reject custom basenames containing `/`, `\`, drive prefixes, or empty names.
+  - [x] Replace `startsWith(resolvedDir)` containment with `path.relative(resolvedDir, resolvedPath)`.
+  - [x] Add tests for sibling-prefix traversal such as `../uploads_evil/pwn`.
+
+- [x] Fix untrusted proxy URL generation. Requires maintainer approval.
+  - [x] Stop trusting `Host` and `X-Forwarded-*` by default for absolute links.
+  - [x] Prefer relative links unless `urlPrefixOverride` or an explicit public base URL is configured.
+  - [x] If forwarded headers remain supported, gate them behind `trustProxy` and allowed host/proto validation. Resolved by not supporting forwarded headers for URL generation.
+  - [x] Add Express and Fastify tests with hostile `Host` and `X-Forwarded-Host` headers.
+
+- [x] Fix `S3Storage` non-mock behavior. Dependency/public behavior choice requires maintainer approval.
+  - [x] Smallest safe fix: throw a clear "real S3 storage is not implemented" error when `mockMode: false`.
+  - [x] Reject full AWS SDK support for this pass because it adds dependency, credential, and public behavior scope.
+  - [x] Add tests for mock mode and the chosen non-mock behavior.
+
+## Low Priority
+
+- [x] Make field setter errors fail closed.
+  - [x] Change setter error handling to throw by default.
+  - [x] Do not add an opt-in non-fatal mode without a real use case.
+  - [x] Add a rollback test where a setter throws and no row is persisted.
+
+- [x] Normalize return-record boolean compatibility.
+  - [x] Create one shared return-record normalizer.
+  - [x] Normalize `true -> 'full'`, `false -> 'no'`, and keep valid strings unchanged.
+  - [x] Use the shared normalizer in plugin install and per-call setup.
+  - [x] Update tests and docs to prefer `'no'`, `'minimal'`, and `'full'` while preserving boolean compatibility.
+
+## Contract Drift
+
+- [x] Fix Socket.IO public exports and docs.
+  - [x] Export `SocketIOPlugin` from `index.js`.
+  - [x] Fix docs to import `Api` from `hooked-api`, not `json-rest-api`.
+  - [x] Remove invalid deep imports such as `json-rest-api/plugins/socketio`, or add formal package subpath exports. Subpath exports require maintainer approval.
+  - [x] Add a public import smoke test.
+
+- [x] Align S3 documentation with implementation.
+  - [x] Since real S3 is not implemented, make README and guide text state that the included adapter is mock/demo only.
+  - [x] Leave production S3 as a future approved dependency/API design rather than documenting unsupported behavior.
+
+- [x] Finish relationship validation contract consolidation.
+  - [x] Move relationship-route schemas into the same request-contract surface as resource routes.
+  - [x] Do this after the cardinality fix so the centralized contract is correct rather than merely centralized.
+
+## Verification Checklist
+
+- [x] `npm test`
+- [x] `npm run lint`
+- [x] `npm run test:anyapi`
+- [x] `npm run verify`
+- [x] Narrow repro for AnyAPI custom `idProperty`
+- [x] Narrow repro for relationship route `afterCommit`
+- [x] Narrow repro for pagination link round trip
+- [x] Import smoke test for public exports

package/index.js

@@ -11,10 +11,12 @@
 // Core plugins
 export { RestApiPlugin } from './plugins/core/rest-api-plugin.js'
 export { AutoFilterPlugin } from './plugins/core/rest-api-autofilter-plugin.js'
+export { RowPolicyPlugin } from './plugins/core/rest-api-row-policy-plugin.js'
 export { QueryProjectionsPlugin } from './plugins/core/rest-api-query-projections-plugin.js'
 export { FileHandlingPlugin } from './plugins/core/file-handling-plugin.js'
 export { CorsPlugin } from './plugins/core/rest-api-cors-plugin.js'
 export { LabelPlugin } from './plugins/core/rest-api-label-plugin.js'
+export { SocketIOPlugin } from './plugins/core/socketio-plugin.js'
 
 // Database plugins
 export { RestApiKnexPlugin } from './plugins/core/rest-api-knex-plugin.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.24",
+  "version": "1.0.25",
   "main": "index.js",
   "type": "module",
   "scripts": {

package/plugins/core/bulk-operations-plugin.js

@@ -193,11 +193,12 @@ export const BulkOperationsPlugin = {
               transaction
             }, recordContext)
 
-            // If patch doesn't return full record, fetch it
-            let resultData = result.data
-            if (!resultData && result.id) {
+            // If patch doesn't return a full record, fetch the updated record.
+            const resultId = result?.data?.id || result?.id || operation.id
+            let resultData = result?.data
+            if (!resultData && resultId) {
               const fetchedRecord = await scope.get({
-                id: result.id,
+                id: resultId,
                 transaction
               }, recordContext)
               resultData = fetchedRecord.data

package/plugins/core/connectors/express-plugin.js

@@ -66,6 +66,7 @@ export const ExpressPlugin = {
     // Get mountPath from options (this is now a transport concern)
     const mountPath = expressOptions.mountPath || ''
     const basePath = mountPath // Keep basePath for internal use
+    const publicBaseUrl = expressOptions.publicBaseUrl || ''
     const strictContentType = expressOptions.strictContentType !== false
     const requestSizeLimit = expressOptions.requestSizeLimit || '1mb'
 
@@ -73,7 +74,8 @@ export const ExpressPlugin = {
     vars.transport = {
       type: 'express',
       matchAll: '*', // Express wildcard pattern for matching all routes
-      mountPath // Transport-specific mount path
+      mountPath, // Transport-specific mount path
+      publicBaseUrl
     }
 
     // Register file detector if enabled
@@ -142,6 +144,7 @@ export const ExpressPlugin = {
         reply: res,
         source: 'express',
         mountPath: basePath,
+        publicBaseUrl,
         requestData,
         createContext,
         urlPrefixOverride: req.urlPrefixOverride
@@ -240,6 +243,7 @@ export const ExpressPlugin = {
                 reply: res,
                 source: 'express',
                 mountPath: basePath,
+                publicBaseUrl,
                 requestData,
                 createContext,
                 urlPrefixOverride: req.urlPrefixOverride
@@ -262,6 +266,7 @@ export const ExpressPlugin = {
               routeMeta,
               helpers,
               mountPath: basePath,
+              publicBaseUrl,
               runHooks
             })
             res.set(outcome.headers)

package/plugins/core/connectors/fastify-plugin.js

@@ -70,12 +70,14 @@ export const FastifyPlugin = {
     api.http.fastify = { app }
 
     const mountPath = fastifyOptions.mountPath || ''
+    const publicBaseUrl = fastifyOptions.publicBaseUrl || ''
     const strictContentType = fastifyOptions.strictContentType !== false
 
     vars.transport = {
       type: 'fastify',
       matchAll: '*',
-      mountPath
+      mountPath,
+      publicBaseUrl
     }
 
     registerVendorJsonParser(app)
@@ -140,6 +142,7 @@ export const FastifyPlugin = {
             reply,
             source: 'fastify',
             mountPath,
+            publicBaseUrl,
             requestData,
             createContext
           })
@@ -174,6 +177,7 @@ export const FastifyPlugin = {
             routeMeta,
             helpers,
             mountPath,
+            publicBaseUrl,
             runHooks
           })