lfg2025/archy
1
0
Fork 0
Code Issues 20 Pull Requests Actions Packages Projects Releases 61 Wiki Activity

fix(demo): IndeeHub opens its real site — the same-origin proxy broke its assets

Browse Source 
The nginx sub_filter rewrite couldn't touch the SPA's runtime-built asset
URLs, so the iframed IndeeHub rendered with broken links and images. The
real site refuses iframing (X-Frame-Options), so the demo now opens
https://indee.tx1138.com/ directly via the demo-external mechanism, whose
isDemoExternal() check was previously hardcoded off.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-07-16 21:49:35 -04:00
parent 3aebbcbbb8
commit 8e13f981d0
2 changed files with 14 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
neode-ui/docker/nginx-demo.conf
View File

@ -103,27 +103,10 @@ http {
proxy_request_buffering off;
}
# IndeeHub: reverse-proxy the real site same-origin, strip framing headers,
# and rewrite its absolute asset paths (/assets, /, src, href) to the
# /app/indeedhub/ prefix so the SPA loads inside the iframe.
location ^~ /app/indeedhub/ {
proxy_pass https://indee.tx1138.com/;
proxy_http_version 1.1;
proxy_set_header Host indee.tx1138.com;
proxy_set_header Accept-Encoding "";
proxy_ssl_server_name on;
proxy_hide_header X-Frame-Options;
proxy_hide_header Content-Security-Policy;
proxy_hide_header Content-Security-Policy-Report-Only;
sub_filter_types text/html text/css application/javascript application/json;
sub_filter_once off;
sub_filter 'href="/' 'href="/app/indeedhub/';
sub_filter 'src="/' 'src="/app/indeedhub/';
sub_filter "href='/" "href='/app/indeedhub/";
sub_filter "src='/" "src='/app/indeedhub/";
sub_filter 'from"/' 'from"/app/indeedhub/';
sub_filter 'url(/' 'url(/app/indeedhub/';
}
# IndeeHub is no longer proxied same-origin — the sub_filter rewrite
# approach broke the SPA's runtime-built asset URLs. The demo now opens
# the real site (https://indee.tx1138.com/) externally instead, via
# DEMO_EXTERNAL_URLS in useDemoIntro.ts.
# Mempool is NOT proxied upstream anymore — the mock backend serves a
# branded placeholder page for it (see DEMO_APP_PAGES in mock-backend.js),

16
neode-ui/src/composables/useDemoIntro.ts
View File

@ -26,13 +26,17 @@ export function clearDemoIntroSeen(): void {
// Only these apps actually do something in the demo (a mock UI or a real
// external site). Everything else shows "No demo" on a disabled install button
// and is not launchable.
const DEMO_EXTERNAL_URLS: Record<string, string> = {}
// IndeeHub's real site sends X-Frame-Options: SAMEORIGIN, and the old
// same-origin nginx sub_filter proxy broke its runtime-built asset URLs —
// so the demo opens the real site directly instead.
const DEMO_EXTERNAL_URLS: Record<string, string> = {
indeedhub: 'https://indee.tx1138.com/',
}
// Apps loaded in the in-app iframe via a same-origin path. IndeeHub and Mempool
// are reverse-proxied by nginx (X-Frame-Options/CSP stripped + asset paths
// rewritten) so the frame-busting real sites can be embedded.
const DEMO_MOCK_UI: Record<string, string> = {
indeedhub: '/app/indeedhub/',
mempool: '/app/mempool/',
'mempool-web': '/app/mempool/',
'bitcoin-knots': '/app/bitcoin-knots/',
@ -61,11 +65,11 @@ const DEMO_MOCK_UI: Record<string, string> = {
}
/**
* Whether a demo app opens in a new tab. Nothing does — IndeeHub and Mempool
* both load their real site directly in the in-app iframe.
* Whether a demo app opens externally (new tab / in-app browser) because its
* real site blocks iframing (X-Frame-Options).
*/
export function isDemoExternal(_appId: string): boolean {
return false
export function isDemoExternal(appId: string): boolean {
return appId in DEMO_EXTERNAL_URLS
}
/** Can this app be launched/installed in the demo? */