mango-cms 0.3.27 → 0.3.29

package/lib/devProxyGateway.js

@@ -34,13 +34,31 @@ export const DEFAULT_STAGING_PREFIX = 'staging.'
 export const BRANCH_HEADER = 'x-vibe-branch'
 export const BRANCH_COOKIE = 'vibe_branch'
 
-// Pure: pull the selected branch out of a request's headers (header first, then
-// the `vibe_branch` cookie). Returns '' when none is present so the resolver can
-// fall back to the site's configured default branch.
+// Pure: pull the selected branch out of a request. Precedence (high → low):
+//   1. x-vibe-branch header (set by fetch/XHR after the picker)
+//   2. ?branch=<name> URL search param (deliberate URL navigation, HAP-1175)
+//   3. vibe_branch cookie (set by the picker after selection)
+// Returns '' when none is present so the resolver can fall back to the site's
+// configured default branch.
 export function parseBranchFromReq(req) {
     const headerVal = req?.headers?.[BRANCH_HEADER]
     if (headerVal) return String(Array.isArray(headerVal) ? headerVal[0] : headerVal).trim()
 
+    const url = req?.url || ''
+    const q = url.indexOf('?')
+    if (q !== -1) {
+        for (const pair of url.slice(q + 1).split('&')) {
+            const eq = pair.indexOf('=')
+            const key = eq === -1 ? pair : pair.slice(0, eq)
+            if (key === 'branch') {
+                const val = eq === -1 ? '' : pair.slice(eq + 1)
+                if (val) {
+                    try { return decodeURIComponent(val.trim()) } catch { return val.trim() }
+                }
+            }
+        }
+    }
+
     const cookieHeader = req?.headers?.cookie || ''
     for (const pair of String(cookieHeader).split(';')) {
         const idx = pair.indexOf('=')
@@ -56,6 +74,52 @@ export function parseBranchFromReq(req) {
     return ''
 }
 
+// Pure: does this request carry a DELIBERATE branch signal (HAP-1175)?
+//
+// The gateway uses this — not "is there any Cookie/Authorization header" — to
+// decide whether to attempt per-branch resolution. Random session cookies left
+// over from prior visits do NOT count; only signals the app sets on purpose:
+//
+//   1. the `x-vibe-branch` request header (set by fetch/XHR after the picker)
+//   2. a non-empty `?branch=` URL search param (deliberate URL navigation)
+//   3. a non-empty `vibe_branch` cookie (set by the picker after selection)
+//
+// Returns true iff at least one of those carries a non-empty value. A request
+// with only unrelated cookies (e.g. `foo=bar`, `connect.sid=...`) returns false
+// so the gateway defaults it to the shared fallback front, not the resolver.
+export function hasBranchSignal(req) {
+    const headerVal = req?.headers?.[BRANCH_HEADER]
+    if (headerVal && String(Array.isArray(headerVal) ? headerVal[0] : headerVal).trim()) {
+        return true
+    }
+
+    const url = req?.url || ''
+    const q = url.indexOf('?')
+    if (q !== -1) {
+        for (const pair of url.slice(q + 1).split('&')) {
+            const eq = pair.indexOf('=')
+            const key = eq === -1 ? pair : pair.slice(0, eq)
+            if (key === 'branch') {
+                const val = eq === -1 ? '' : pair.slice(eq + 1)
+                if (val) return true
+            }
+        }
+    }
+
+    const cookieHeader = req?.headers?.cookie || ''
+    if (cookieHeader) {
+        for (const pair of String(cookieHeader).split(';')) {
+            const idx = pair.indexOf('=')
+            if (idx === -1) continue
+            if (pair.slice(0, idx).trim() === BRANCH_COOKIE) {
+                if (pair.slice(idx + 1).trim()) return true
+            }
+        }
+    }
+
+    return false
+}
+
 // Pure: does this request's Host header look like a staging request, and what
 // site slug does it resolve to?
 //
@@ -282,9 +346,22 @@ export function createHttpResolver({
  *   - Matching staging host → resolve via Mango → http-proxy to the workspace port.
  *   - WebSocket upgrade (Vite HMR) → same resolution → proxy.ws to the same port.
  *   - Non-staging host → 404 with a clear message (no misroute).
- *   - Resolver errors (401/403/404/502) → surfaced as the resolver's HTTP status.
+ *   - Resolver errors (403/404/502) → surfaced as the resolver's HTTP status.
  *   - Upgrade-time resolver failure → socket destroyed (Vite retries the WS).
  *
+ * Page-load auth (HAP-1175, supersedes HAP-1173): a top-level browser navigation
+ * MUST never 401, regardless of what cookies it carries. Real browsers attach
+ * stale session cookies from prior visits on every request, so a "has Cookie →
+ * try the resolver" gate locks out every returning user (the original HAP-1173
+ * fix only solved the cookie-less case). The new contract: the gateway defaults
+ * ALL requests to `fallbackPort` (the shared front) and only resolves a per-
+ * branch workspace when the request carries a DELIBERATE branch signal — the
+ * `vibe_branch` cookie the picker sets after selection, the `x-vibe-branch`
+ * header on fetch/XHR, or a `?branch=` URL search param. If a signaled resolve
+ * fails (no auth, no workspace, resolver error), the request STILL falls back
+ * to the shared front rather than 401-ing. Hard errors only surface in
+ * "lockdown" mode where no `fallbackPort` is configured.
+ *
  * Returns { server, proxy, close() } — caller owns server.listen(port, host).
  */
 export function createStagingGatewayServer({
@@ -295,6 +372,7 @@ export function createStagingGatewayServer({
     backendPort,
     resolverPath,
     timeoutMs,
+    fallbackPort,
     onError,
 } = {}) {
     if (!http || typeof http.createServer !== 'function') {
@@ -306,9 +384,13 @@ export function createStagingGatewayServer({
     if (!Number.isInteger(backendPort)) {
         throw new Error('createStagingGatewayServer: backendPort (integer) is required')
     }
+    if (fallbackPort != null && (!Number.isInteger(fallbackPort) || fallbackPort <= 0 || fallbackPort > 65535)) {
+        throw new Error('createStagingGatewayServer: fallbackPort, if set, must be an integer in 1..65535')
+    }
 
     const resolve = createHttpResolver({ backendPort, resolverPath, timeoutMs, http })
     const proxy = httpProxy.createProxyServer({ ws: true, xfwd: true })
+    const fallbackTarget = Number.isInteger(fallbackPort) ? `http://127.0.0.1:${fallbackPort}` : null
 
     const log = (where, err, req) => {
         if (typeof onError === 'function') onError(where, err, req)
@@ -342,8 +424,28 @@ export function createStagingGatewayServer({
             sendError(res, 404, `Unknown host: ${req?.headers?.host || '(missing Host header)'}`)
             return
         }
+        // HAP-1175: default route is the shared fallback front. Only requests
+        // that carry a deliberate branch signal (vibe_branch cookie, x-vibe-branch
+        // header, or ?branch= URL param) attempt per-branch resolution. A returning
+        // browser with stale session cookies but no branch signal — the case that
+        // re-broke staging in HAP-1175 — passes straight through here.
+        if (!hasBranchSignal(req)) {
+            if (fallbackTarget) {
+                proxy.web(req, res, { target: fallbackTarget })
+                return
+            }
+            sendError(res, 401, 'Vibe staging: no branch signal and no fallback configured')
+            return
+        }
         const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
         if (outcome.error) {
+            // HAP-1175: even with a branch signal, a failed resolve falls back
+            // to the shared front rather than 401-ing the page load. Hard errors
+            // surface only in lockdown mode (no fallback configured).
+            if (fallbackTarget) {
+                proxy.web(req, res, { target: fallbackTarget })
+                return
+            }
             sendError(res, outcome.status || 502, outcome.message || outcome.error)
             return
         }
@@ -356,9 +458,26 @@ export function createStagingGatewayServer({
             try { socket.destroy() } catch { /* noop */ }
             return
         }
+        // HAP-1175: same default-to-fallback rule as handleRequest. The Vite
+        // HMR upgrade for the shared shell rides without a branch signal; only
+        // after the picker fires does the next upgrade carry x-vibe-branch and
+        // resolve per-branch.
+        if (!hasBranchSignal(req)) {
+            if (fallbackTarget) {
+                proxy.ws(req, socket, head, { target: fallbackTarget })
+                return
+            }
+            try { socket.destroy() } catch { /* noop */ }
+            return
+        }
         const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
         if (outcome.error) {
-            // Don't write an HTTP response onto an upgrade socket — Vite retries.
+            // Failed resolve on an upgrade: prefer the fallback over destroying
+            // the socket so HMR keeps working through the shared front.
+            if (fallbackTarget) {
+                proxy.ws(req, socket, head, { target: fallbackTarget })
+                return
+            }
             try { socket.destroy() } catch { /* noop */ }
             return
         }

package/lib/staging-gateway.js

@@ -18,6 +18,13 @@
  *   STAGING_HOST_PREFIX  (default "staging.")  Prefix fallback for slug demux.
  *   RESOLVER_PATH   (default /system/vibe/staging-resolve)
  *   RESOLVER_TIMEOUT_MS (default 2000, int)
+ *   FALLBACK_PORT   (default 7121, int)  Where to send any request without a
+ *                                        deliberate branch signal (vibe_branch
+ *                                        cookie, x-vibe-branch header, or
+ *                                        ?branch= URL param), or any signaled
+ *                                        request whose resolution fails. The
+ *                                        shared front (HAP-1175). Set to 0 to
+ *                                        disable and 401 those requests instead.
  *
  * Usage (typical droplet pm2):
  *   BACKEND_PORT=7122 LISTEN_PORT=7123 \
@@ -40,6 +47,19 @@ function intEnv(name, fallback) {
     return n
 }
 
+function fallbackPortEnv() {
+    // Allow `FALLBACK_PORT=0` to opt out (page-loads → 401, the pre-1173 behavior).
+    const raw = process.env.FALLBACK_PORT
+    if (raw === undefined) return 7121
+    if (raw === '' || raw === '0') return null
+    const n = parseInt(raw, 10)
+    if (!Number.isInteger(n) || n <= 0 || n > 65535) {
+        console.error(`[staging-gateway] FALLBACK_PORT must be a port in 1..65535 or 0/empty (got "${raw}")`)
+        process.exit(1)
+    }
+    return n
+}
+
 const BACKEND_PORT = intEnv('BACKEND_PORT', null)
 if (BACKEND_PORT === null) {
     console.error('[staging-gateway] BACKEND_PORT (int) is required')
@@ -52,6 +72,7 @@ const STAGING_DOMAIN = process.env.STAGING_DOMAIN || ''
 const STAGING_HOST_PREFIX = process.env.STAGING_HOST_PREFIX || undefined
 const RESOLVER_PATH = process.env.RESOLVER_PATH || undefined
 const RESOLVER_TIMEOUT_MS = intEnv('RESOLVER_TIMEOUT_MS', 2000)
+const FALLBACK_PORT = fallbackPortEnv()
 
 const { server, close } = createStagingGatewayServer({
     http,
@@ -61,6 +82,7 @@ const { server, close } = createStagingGatewayServer({
     backendPort: BACKEND_PORT,
     resolverPath: RESOLVER_PATH,
     timeoutMs: RESOLVER_TIMEOUT_MS,
+    fallbackPort: FALLBACK_PORT,
     onError: (where, err) => {
         console.error(`[staging-gateway] ${where} error: ${err?.message || err}`)
     },
@@ -70,6 +92,11 @@ server.listen(LISTEN_PORT, LISTEN_HOST, () => {
     const target = STAGING_DOMAIN || `${STAGING_HOST_PREFIX || 'staging.'}*`
     console.log(`[staging-gateway] listening on ${LISTEN_HOST}:${LISTEN_PORT}`)
     console.log(`[staging-gateway]   ${target}  ->  per-branch Vibe workspace (resolved via 127.0.0.1:${BACKEND_PORT})`)
+    if (FALLBACK_PORT) {
+        console.log(`[staging-gateway]   no branch signal / failed resolve  ->  127.0.0.1:${FALLBACK_PORT}`)
+    } else {
+        console.log('[staging-gateway]   fallback disabled (no branch signal → 401, failed resolve → resolver status)')
+    }
 })
 
 function shutdown(signal) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mango-cms",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "type": "module",
   "main": "./index.js",
   "exports": {