unoverse 0.1.129 → 0.1.130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -111,7 +111,17 @@ services:
|
|
|
111
111
|
# SAME :4105 backend as api.<domain>, so default to the api host (one public entry,
|
|
112
112
|
# one cert, no extra DNS). UNOVERSE_URL can still override for a dedicated MCP host.
|
|
113
113
|
- VITE_UNOVERSE_SERVICE_URL=${UNOVERSE_URL:-${DOMAIN:+https://api.${DOMAIN:-}}}
|
|
114
|
-
|
|
114
|
+
# THE BROWSER'S MEMORY UPSTREAM, AND IT IS THE PUBLIC JWT LANE (:4104). Its own
|
|
115
|
+
# variable, because `MEMORY_SERVICE_URL` means the opposite thing to a server-to-
|
|
116
|
+
# server caller: the engine uses that name for the TOKENLESS platform lane (:4114),
|
|
117
|
+
# and the canvas entrypoint was reading the same name for its nginx upstream. The
|
|
118
|
+
# dashboard therefore proxied the browser at :4114, whose /api/* routes do not
|
|
119
|
+
# exist — every memory page call 404'd on every deployed universe.
|
|
120
|
+
#
|
|
121
|
+
# The 404 was the lucky part. The platform lane asserts identity instead of proving
|
|
122
|
+
# it, so a browser reaching it would read and write ANY user's memory with no token.
|
|
123
|
+
# A browser must only ever reach :4104, which authenticates every request.
|
|
124
|
+
- MEMORY_PUBLIC_URL=http://memory:4104
|
|
115
125
|
depends_on:
|
|
116
126
|
- unoverse
|
|
117
127
|
logging: *default-logging
|
package/operator/lib/deploy.sh
CHANGED
|
@@ -117,8 +117,13 @@ cmd_db_allow() {
|
|
|
117
117
|
# this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
|
|
118
118
|
# in DATABASE_URL.
|
|
119
119
|
if [ -z "$cluster" ]; then
|
|
120
|
+
# `-n` + `p`: print ONLY when the substitution matched. The portable way to say "extract
|
|
121
|
+
# or nothing". This was `s|…|\1|; t; d`, which is GNU: BSD sed reads everything after `t`
|
|
122
|
+
# as a LABEL, so on macOS it died with `undefined label '; d'`, printed nothing, and the
|
|
123
|
+
# command then reported "this database has no trusted-source list" — a real cluster
|
|
124
|
+
# reported as an open one, on the platform's own machine.
|
|
120
125
|
cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
|
|
121
|
-
| sed -
|
|
126
|
+
| sed -nE 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|p')
|
|
122
127
|
fi
|
|
123
128
|
|
|
124
129
|
if [ -z "$cluster" ]; then
|
package/package.json
CHANGED