deploy: route frontend and core through one origin

frontend/src/api/runtime-config.test.ts

@@ -1,40 +1,26 @@
 import { describe, expect, it } from "vitest";
 
 import { backendBaseUrl, joinBackendPath, resolveBackendUrl } from "./runtime-config";
-import cases from "./backend-url-cases.json";
 
 describe("resolveBackendUrl", () => {
-  it("uses the runtime-injected backend URL", () => {
-    expect(resolveBackendUrl({ backendBaseUrl: "/api" })).toBe("/api");
+  it("uses same-origin /api by default", () => {
+    expect(resolveBackendUrl()).toBe("/api");
   });
 
-  it("falls back to the Vite backend URL", () => {
-    expect(resolveBackendUrl(undefined)).toBe(import.meta.env.VITE_BACKEND_URL ?? "");
+  it("does not allow a browser-facing backend override", () => {
+    expect(() => resolveBackendUrl("https://api.example.test")).toThrow(/same-origin/i);
   });
 
-  it("preserves the client default when Vite has no configured backend", () => {
-    expect(backendBaseUrl).toBe(import.meta.env.VITE_BACKEND_URL ?? "http://localhost:8787");
+  it("keeps the exported browser base on /api", () => {
+    expect(backendBaseUrl).toBe("/api");
   });
 
   it.each(["/backend", "api", "//evil.test", "ftp://example.test", "https://user:pass@example.test"])(
-    "rejects unsupported backend URL %j",
+    "rejects any browser-facing backend URL %j",
     (backendBaseUrl) => {
-      expect(() => resolveBackendUrl({ backendBaseUrl })).toThrow(/BACKEND_BASE_URL/);
+      expect(() => resolveBackendUrl(backendBaseUrl)).toThrow(/same-origin/i);
     },
   );
-
-  it.each(["", "/", "/api", "/api/", "http://localhost:8787", "https://api.example.test/v1"])(
-    "accepts supported backend URL %j",
-    (backendBaseUrl) => {
-      expect(resolveBackendUrl({ backendBaseUrl })).toBe(backendBaseUrl);
-    },
-  );
-
-  it.each(cases)("applies the canonical policy to $value", ({ value, valid }) => {
-    const resolve = () => resolveBackendUrl({ backendBaseUrl: value });
-    if (valid) expect(resolve()).toBe(value);
-    else expect(resolve).toThrow(/BACKEND_BASE_URL/);
-  });
 });
 
 describe("joinBackendPath", () => {