Avoid Brave-blocked frontend proxy path - #121
Open
xrpbanks wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The routing changes are consistent and covered by updated/new tests, with only minor documentation/test robustness nits noted.
Pull request overview
This PR introduces a browser-filter-safe same-origin proxy alias (/api/calorieapp) and routes frontend readiness/auth/account/food traffic through it to avoid client-side blocking of /api/backend/*, while preserving the legacy /api/backend route for existing clients.
Changes:
- Added a new Next.js API route alias at
/api/calorieapp/*that re-exports the existing/api/backend/*proxy handlers. - Updated frontend request base URLs (readiness + UI flows) from
/api/backendto/api/calorieapp. - Updated and extended test coverage to validate the readiness “direct-origin vs same-origin” race and adjusted existing Xaman-related request assertions.
File summaries
| File | Description |
|---|---|
| tools/tests/xaman_logout_request.test.mjs | Updates logout request expectations to use /api/calorieapp proxy path. |
| tools/tests/xaman_login_start_retry.test.mjs | Updates identity callback/me/logout/login-status request expectations to /api/calorieapp. |
| tools/tests/backend_request_route.test.mjs | Adds regression test for readiness race using the new filter-safe same-origin route. |
| release-check.sh | Adds the new backend route regression test to the release test suite. |
| README.md | Updates documentation to reference /api/calorieapp as the same-origin proxy path. |
| frontend/lib/backendRequest.ts | Switches default wake base URL and same-origin readiness probe base to /api/calorieapp. |
| frontend/components/XamanLoginPanel.tsx | Routes login panel API traffic via /api/calorieapp. |
| frontend/components/FoodSearchPlaceholder.tsx | Routes food readiness/search related calls via /api/calorieapp. |
| frontend/components/AccountErasurePanel.tsx | Routes account erasure calls via /api/calorieapp. |
| frontend/components/AccountDataImportPanel.tsx | Routes account import calls via /api/calorieapp. |
| frontend/components/AccountDataExportButton.tsx | Routes account export calls via /api/calorieapp. |
| frontend/app/auth/callback/page.tsx | Routes auth callback flow via /api/calorieapp. |
| frontend/app/api/calorieapp/[...path]/route.ts | Introduces /api/calorieapp proxy alias by re-exporting legacy backend proxy route handlers. |
Review details
- Files reviewed: 13/13 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
xrpbanks
force-pushed
the
fix/brave-safe-calorieapp-proxy
branch
from
September 6, 2026 05:39
2ff58bb to
f0ce7e6
Compare
xrpbanks
force-pushed
the
fix/brave-safe-calorieapp-proxy
branch
from
September 6, 2026 05:42
f0ce7e6 to
4266977
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/calorieappas a browser-filter-safe alias for the existing same-origin backend proxy/api/backendunchanged for backward compatibilityEvidence
/api/backend/healthrequest is blocked client-side withERR_BLOCKED_BY_CLIENT, so it never reaches the CalorieApp backend/api/calorieapp/healthpath is not client-blocked/healthendpointScope
Frontend route correction only. No WordPress plugin, Xaman payload, login-session contract, layout, footer, or page-content changes.