19 lines
838 B
YAML
19 lines
838 B
YAML
# Local 403 fix for the web profile.
|
|
# Official dsh pins privileged /api methods (settings, credentials, presets,
|
|
# host dialogs, llm.discoverModels) to loopback by re-checking them with an
|
|
# empty trusted-host list. That makes a reverse-proxied /api always return 403
|
|
# even when --trusted-host lists the public host.
|
|
#
|
|
# This bundle inserts one row that registers exact /api/<method> routes for
|
|
# those methods and validates them against the same webRuntime.trustedHosts
|
|
# list the rest of /api uses, so a host listed in --trusted-host can call them.
|
|
#
|
|
# trustedHosts keeps the official webRuntime expression, so
|
|
# `dsh web --trusted-host <authority>` still feeds this fence.
|
|
- insert:
|
|
- id: local-403-fix
|
|
name: dsh-local-403-fix
|
|
inject: [webRuntime]
|
|
config:
|
|
trustedHosts: !!js ctx.webRuntime.trustedHosts
|