diff --git a/src/workspaces/officerdev/src/apps/Gitea/shared.ts b/src/workspaces/officerdev/src/apps/Gitea/shared.ts index 632ad71b..6d9758ca 100644 --- a/src/workspaces/officerdev/src/apps/Gitea/shared.ts +++ b/src/workspaces/officerdev/src/apps/Gitea/shared.ts @@ -420,11 +420,15 @@ export function isUnreachableFromBrowser(host: string): boolean { * Rebase instance-minted URLs onto `origin`, IN ONE DIRECTION ONLY: a URL the browser cannot reach is moved * onto one it can, never the reverse. * - * The direction matters because this instance answers with two different origins — `/user` and `/repos` - * build from its configured ROOT_URL (`http://localhost:9004`), `/contents` from the public host - * (`https://gitea.pastilhas.dev`). An unconditional rewrite onto the connection URL therefore *broke* the - * second set to match the first, turning working https links into dead loopback ones and tripping mixed - * content on the way. Verified against the live instance on 2026-08-06. + * The direction matters because an instance can answer with two different origins at once, and the one + * matching the connection URL is not necessarily the good one. Gitea stamps most URLs from its own + * configured `ROOT_URL` — the public address — but some endpoints echo the REQUEST host instead, and + * Officer dials the instance directly rather than through its reverse proxy. So dialling + * `http://localhost:9004` an instance whose `ROOT_URL` is `https://gitea.pastilhas.dev` yields + * `/contents` on the public host and `/user`, `/repos` on loopback. An unconditional rewrite onto the + * connection URL therefore *broke* the good half to match the bad, turning working https links into dead + * loopback ones and tripping mixed content on the way. Verified against the live instance and its + * `app.ini` on 2026-08-06. * * So: only a private/loopback URL is rewritten, and only when `origin` is itself publicly reachable. When * the connection URL is a dial address there is nothing better to offer, and the correct move is to change