fix(client): re-add cloudProxyV1Url — the framework/s3 clients import it (v8.4.70 build fix)

v8.4.70's framework + storage clients import cloudProxyV1Url to address the /cloud
bearer proxy explicitly (a bare /v1/framework or /v1/s3 hits hanzoai/gateway with no
principal → 403). But that helper had been deleted from client.ts by the earlier
/v1-canonicalization, so the build failed: "'cloudProxyV1Url' is not exported from
'./client'". Re-add cloudProxyBase + cloudProxyV1Url (the <origin>/cloud/v1/<path>
builder) so the CMS/ERP/Help framework calls and the media DAM S3 calls resolve and
reach the working proxy. next build green (14/14).
This commit is contained in:
hanzo-dev
2026-07-03 16:58:34 -07:00
parent edfdc62844
commit d3f4081a2d
+17
View File
@@ -323,6 +323,23 @@ export const originV1Url = (path: string): string => {
return typeof window !== 'undefined' ? `${window.location.origin}/v1/${clean}` : `/v1/${clean}`
}
/**
* The console's OWN same-origin cloud-api USER-BEARER proxy base (`<origin>/cloud`).
*
* Some cloud heads (framework, s3) are NOT rewritten from a bare `/v1/<head>` to the
* `/cloud` proxy on the live ingress — a bare `/v1/framework`/`/v1/s3` reaches
* hanzoai/gateway directly with no principal and 403s ("valid principal required").
* So the clients for those heads (framework/client.ts, storage.ts) address the
* `/cloud` proxy EXPLICITLY: `app/cloud/[...path]` mints a short-lived user-bound
* token from the session and forwards to cloud-api with the org resolved from the
* token owner. `cloud` heads are allow-listed in proxy-allow.ts (defense in depth).
*/
export const cloudProxyBase = (): string =>
typeof window !== 'undefined' ? `${window.location.origin}/cloud` : '/cloud'
/** Build a `/v1/<path>` URL on the cloud-api user-bearer proxy (`<origin>/cloud/v1/<path>`). */
export const cloudProxyV1Url = (path: string): string => v1Url(path, cloudProxyBase())
async function restRequest<T>(
method: 'GET' | 'POST' | 'PUT' | 'DELETE',
url: string,