feat(web): eliminate browser CORS via header-driven /api proxy#54

Merged

offendingcommit merged 26 commits into

mainfrom

feat/web-api-proxy

Jun 2, 2026

Commits on Jun 2, 2026

docs: add header-driven /api proxy design spec
offendingcommit
committed
docs: add header-driven /api proxy implementation plan
offendingcommit
committed
refactor(web): extract isTauri into a leaf platform module
offendingcommit
committed
feat(web): add dispatchFor transport helper for same-origin proxy
offendingcommit
committed
feat(web): route web build through same-origin /api proxy
offendingcommit
committed
docs: amend proxy plan with absolute-base fix and task 4 test mocking
offendingcommit
committed
feat(web): route checkConnection and discovery through the proxy
offendingcommit
committed
refactor(web): drop same-origin sentinel from runtime config
offendingcommit
committed
feat(docker): header-driven /api reverse proxy in nginx
offendingcommit
committed
feat(docker): render SSRF allowlist map from env
offendingcommit
committed
feat(web): dev /api proxy middleware mirroring nginx
offendingcommit
committed
docs: document the /api proxy contract and env vars
offendingcommit
committed
docs(docker): drop stale same-origin sentinel from entrypoint comment
offendingcommit
committed
fix(docker): drop dead HONCHO_UPSTREAM and same-origin default
offendingcommit
committed
fix(web): enforce upstream allowlist in vite dev proxy
offendingcommit
committed
fix(web): strip content-encoding from vite dev proxy responses
offendingcommit
committed
fix(docker): derive nginx resolver from container DNS
offendingcommit
committed
test(docker): add hermetic /api proxy smoke test
offendingcommit
committed
feat(docker): split compose into dev-forward build and prod pull
offendingcommit
committed
docs: document dev/prod compose modes and make targets
offendingcommit
committed
refactor(make): rename compose targets to up/prod/down/clean
offendingcommit
committed
refactor(docker): use compose profiles instead of a prod override file
offendingcommit
committed
fix(web): raise connection-test timeout for cold upstreams
offendingcommit
committed
refactor(web): use top-level z.url() over deprecated z.string().url()
offendingcommit
committed
test(web): cover instance store CRUD and legacy migration
offendingcommit
committed
docs: scrub environment-specific endpoint from proxy spec
offendingcommit
committed