nca-ai-cms-astro-plugin 1.1.5 → 1.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nca-ai-cms-astro-plugin",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",

package/src/api/articles/create.ts

@@ -19,13 +19,6 @@ const CreateArticleSchema = z.object({
 // POST /api/articles/create - Generate content + image and save in one call
 export const POST: APIRoute = async ({ request }) => {
   try {
-    // CSRF: reject cross-origin requests
-    const origin = request.headers.get('origin');
-    const requestUrl = new URL(request.url);
-    if (origin && new URL(origin).origin !== requestUrl.origin) {
-      return jsonError('Forbidden', 403);
-    }
-
     let body: unknown;
     try {
       body = await request.json();

package/src/pages/robots.txt.ts

@@ -1,4 +1,5 @@
 import type { APIContext } from 'astro';
+import { getPublicOrigin } from '../utils/originUtils.js';
 
 export function generateRobotsTxt(siteUrl: string): string {
   const base = siteUrl.replace(/\/+$/, '');
@@ -14,7 +15,7 @@ Sitemap: ${base}/sitemap.xml
 }
 
 export function GET(context: APIContext): Response {
-  const siteUrl = context.site?.toString() ?? context.url.origin;
+  const siteUrl = getPublicOrigin(context);
   const body = generateRobotsTxt(siteUrl);
 
   return new Response(body, {

package/src/pages/sitemap.xml.ts

@@ -1,6 +1,7 @@
 import type { APIContext } from 'astro';
 import { ArticleService } from '../services/ArticleService';
 import type { ArticleData } from '../services/ArticleService';
+import { getPublicOrigin } from '../utils/originUtils.js';
 
 const STATIC_PAGES = ['/', '/impressum', '/ueber-ai-cms'];
 
@@ -43,7 +44,7 @@ ${[...staticEntries, ...articleEntries].join('\n')}
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const siteUrl = context.site?.toString() ?? context.url.origin;
+  const siteUrl = getPublicOrigin(context);
   const service = new ArticleService();
   const articles = await service.list();
 

package/src/utils/originUtils.ts

@@ -0,0 +1,15 @@
+import type { APIContext } from 'astro';
+
+export function getPublicOrigin(context: APIContext): string {
+  if (context.site) {
+    return context.site.toString().replace(/\/+$/, '');
+  }
+
+  const proto = context.request.headers.get('x-forwarded-proto');
+  const host = context.request.headers.get('x-forwarded-host');
+  if (proto && host) {
+    return `${proto}://${host}`;
+  }
+
+  return context.url.origin;
+}

package/update.md

@@ -1,3 +1,23 @@
+# v1.1.6
+
+## Fix: reverse proxy compatibility
+
+### Removed: broken CSRF check in `/api/articles/create`
+- The origin comparison (`request.headers.get('origin')` vs `request.url`) fails behind reverse proxies (Traefik/Nginx) because `request.url` resolves to the internal container URL
+- Route is already protected by auth middleware — CSRF check was redundant
+- Fixes 403 Forbidden when generating articles in production
+
+### New: `getPublicOrigin()` utility
+- Resolves the correct external URL behind reverse proxies
+- Priority: `context.site` → `X-Forwarded-Proto`/`X-Forwarded-Host` → `context.url.origin`
+- Nginx already sets these headers on all proxy locations
+
+### Fixed: robots.txt and sitemap.xml URLs
+- Both files used `context.url.origin` which returned `http://127.0.0.1:4321` behind proxy
+- Now use `getPublicOrigin()` to produce correct external URLs
+
+---
+
 # v1.1.5
 
 ## Refactor: Settings import/export with merge semantics