Spaces:
Paused
Paused
Commit History
-
fix: CF Worker must re-POST body on X's api.twitter.com→api.x.com redirect
Root cause: X redirects OAuth-signed POST /oauth/access_token from api.twitter.com to api.x.com (confirmed by domain=.x.com in error response cookies vs domain=.twitter.com for unauthenticated requests). CF Worker redirect:"follow" converts POST→GET per fetch spec, losing the OAuth-signed body → X receives unsigned GET → returns 500 HTML. Fix (cloudflare-proxy-setup.py): buffer the request body as ArrayBuffer, use redirect:"manual", then manually follow 3xx hops re-POSTing the same body (up to 5 hops). This preserves method + OAuth signature on redirect. Also add /app/redeploy-cf-worker endpoint to health-server.js: forces Worker redeploy without a full Space restart by unsetting CLOUDFLARE_PROXY_URL from subprocess env (bypassing the setup script's short-circuit check). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>062df28 -
add /app/test-twitter probe + fix Worker redirect for POST
health-server.js: - /app/test-twitter: probes api.twitter.com GET (reachability) and POST oauth/access_token (no auth) to distinguish IP-blocked (500 HTML) from IP-allowed (400/401 JSON). Shows NODE_OPTIONS + CLOUDFLARE_PROXY_URL. cloudflare-proxy-setup.py: - Worker: change redirect:"follow" → redirect:"manual" so POST bodies are not silently dropped when X returns a 3xx (fetch spec converts POST→GET on 301/302, losing OAuth-signed body → signature mismatch). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>86ec115
-
fix: set FRONTEND_URL to bare origin so CORS allow-origin matches browser
FRONTEND_URL was set to PUBLIC_URL/app (with basePath suffix). Postiz backend uses FRONTEND_URL as the CORS allowed-origin. Browsers send Origin: https://host (scheme+host only, no path per the HTTP spec), so the /app suffix caused every pre-flight and credentialed request to be blocked — making login and signup silently fail. Fix: FRONTEND_URL = PUBLIC_URL (no /app). Email links generated by Postiz (e.g. ${FRONTEND_URL}/auth/login) still work because health-server now redirects any bare /auth/* path to /app/auth/*. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>ff3303a
-
initialize project
b4d7c1c