fix(backend): recover auth-config deploy contract on backend-origin drift

[LucasSantana-Dev]

Summary

• Fix deploy-gate auth-config drift where production backend can return status=degraded only because WEBAPP_BACKEND_URL is temporarily unset.
• Keep OAuth callback validation strict while adding request-origin fallback for origin allowlist matching.
• Update docs/changelog with the fallback behavior and production recommendation.

What changed

• packages/backend/src/routes/health.ts
  • Added request origin resolution from forwarded headers/host.
  • Passed requestOrigin into auth-config health builder.
• packages/backend/src/utils/authHealth.ts
  • Added optional requestOrigin input.
  • Included request origin in allowed-origin set for redirect validation.
  • Kept callback-path and client/session/redis checks unchanged.
• Tests
  • Added unit coverage for request-origin fallback in authHealth.test.ts.
  • Added integration coverage for forwarded header fallback in health.test.ts.

Verification

• npm run test --workspace=packages/backend -- tests/unit/utils/authHealth.test.ts tests/integration/routes/health.test.ts
• npm run db:generate
• npm run build --workspace=packages/shared
• npm run type:check --workspace=packages/backend
• npm run lint

Summary by CodeRabbit

• New Features

  • Health check endpoint now uses forwarded request headers as a fallback when backend URL configuration is missing, preventing false deploy-gate failures while maintaining OAuth validation.

• Documentation

  • Updated documentation to describe the new fallback behavior for origin validation during health checks.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	Mar 12, 2026 4:17am

[netlify]

✅ Deploy Preview for regal-bunny-0c8efe ready!

Name	Link
🔨 Latest commit	fdde8f9
🔍 Latest deploy log	https://app.netlify.com/projects/regal-bunny-0c8efe/deploys/69b23e4495de6600084482d2
😎 Deploy Preview	https://deploy-preview-175--regal-bunny-0c8efe.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

The PR adds support for deriving backend origin from forwarded request headers as a fallback when WEBAPP_BACKEND_URL is unset, enabling OAuth validation against the current request origin to prevent false deploy-gate failures in smoke checks.

Changes

Cohort / File(s)	Summary
Documentation CHANGELOG.md, README.md	Documents new behavior allowing /api/health/auth-config to validate OAuth origin against forwarded request-origin fallback when WEBAPP_BACKEND_URL is missing.
Route Handler packages/backend/src/routes/health.ts	Adds getForwardedHeader() and resolveRequestOrigin() helpers to extract and normalize origin from proxy headers (x-forwarded-proto, x-forwarded-host). Computes requestOrigin and passes it to buildAuthConfigHealth.
Health Utility packages/backend/src/utils/authHealth.ts	Extends AuthConfigHealthInput with optional requestOrigin parameter; adds normalizeOrigin() utility. Treats requestOrigin as fallback origin source for OAuth redirect validation alongside frontend/backend origins. Suppresses "No origins configured" warning when valid requestOrigin provided.
Integration & Unit Tests packages/backend/tests/integration/routes/health.test.ts, packages/backend/tests/unit/utils/authHealth.test.ts	Adds integration test verifying /api/health/auth-config returns status 200 with derived backend origin from forwarded headers; adds unit test verifying requestOrigin fallback produces no warnings when redirect URI origin matches.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(auth): harden oauth redirect contract checks #150: Extends auth health logic by adding request-origin extraction and forwarding, directly modifying the same buildAuthConfigHealth function.
• fix(backend): stabilize redis startup and auth health contract #145: Modifies /api/health/auth-config auth readiness logic and buildAuthConfigHealth validations.
• fix(ci): require auth-config deploy smoke contract #146: Touches /api/health/auth-config behavior with stricter deploy-smoke expectations that interact with request-origin fallback logic.

Suggested labels

size/m

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fix: recovering the auth-config deploy contract when backend-origin drifts (i.e., when WEBAPP_BACKEND_URL is unset), which is the primary objective of this PR.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/auth-config-origin-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate failed

Failed conditions
68.3% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud