[I] VITE_OAUTH_TOKEN_URL build-time default overrides runtime config when not explicitly set [polaris-tools]

["mwisselaar (via GitHub)" <gi...@apache.org>]

mwisselaar opened a new issue, #248:
URL: https://github.com/apache/polaris-tools/issues/248

   ## Description
   
   When running the Docker image with a custom `VITE_POLARIS_API_URL`, the app still uses `http://polaris:8181` as the OAuth token endpoint unless `VITE_OAUTH_TOKEN_URL` is also explicitly passed at runtime.
   
   ## Root cause
   
   The Dockerfile sets `ENV VITE_OAUTH_TOKEN_URL=http://polaris:8181/api/catalog/v1/oauth/tokens` during the build stage. Vite bakes this into `import.meta.env.VITE_OAUTH_TOKEN_URL` in the JS bundle.
   
   `generate-config.sh` writes an empty string for `VITE_OAUTH_TOKEN_URL` when it is not passed at runtime. The `getConfig()` function in `src/lib/config.ts` skips empty strings in `window.APP_CONFIG` and falls through to `import.meta.env` — which returns the baked-in `polaris:8181` default.
   
   ```typescript
   // src/lib/config.ts
   function getConfig(key: keyof AppConfig, defaultValue: string = ""): string {
     const runtimeValue = window.APP_CONFIG?.[key]
     if (runtimeValue !== undefined && runtimeValue !== "") {  // empty string is skipped
       return runtimeValue
     }
     const buildTimeValue = import.meta.env[key]  // falls through to baked-in default
     ...
   }
   ```
   
   ## Expected behavior
   
   If `VITE_OAUTH_TOKEN_URL` is not set at runtime, it should be derived from `VITE_POLARIS_API_URL` at runtime — not from the build-time Dockerfile default.
   
   ## Steps to reproduce
   
   ```bash
   docker run -p 8080:8080 \
     -e VITE_POLARIS_API_URL=http://myhost:8181 \
     -e VITE_POLARIS_REALM=myrealm \
     -e VITE_POLARIS_PRINCIPAL_SCOPE=PRINCIPAL_ROLE:ALL \
     apache/polaris-console:latest
   ```
   
   Login fails with `ERR_NAME_NOT_RESOLVED` for `polaris:8181/api/catalog/v1/oauth/tokens` despite `VITE_POLARIS_API_URL` being correctly set.
   
   ## Workaround
   
   Always pass `VITE_OAUTH_TOKEN_URL` explicitly:
   
   ```bash
   docker run -p 8080:8080 \
     -e VITE_POLARIS_API_URL=http://myhost:8181 \
     -e VITE_OAUTH_TOKEN_URL=http://myhost:8181/api/catalog/v1/oauth/tokens \
     apache/polaris-console:latest
   ```
   
   ## Suggested fix
   
   In `docker/generate-config.sh`, derive `VITE_OAUTH_TOKEN_URL` from `VITE_POLARIS_API_URL` when not explicitly set:
   
   ```bash
   VITE_OAUTH_TOKEN_URL="${VITE_OAUTH_TOKEN_URL:-${VITE_POLARIS_API_URL}/api/catalog/v1/oauth/tokens}"
   ```
   
   This ensures the token URL always follows the API URL unless explicitly overridden.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] VITE_OAUTH_TOKEN_URL build-time default overrides runtime config when not explicitly set [polaris-tools]

["mwisselaar (via GitHub)" <gi...@apache.org>]

mwisselaar commented on issue #248:
URL: https://github.com/apache/polaris-tools/issues/248#issuecomment-4881325741

   ## Related issue: CORS blocks requests in local Docker setup
   
   When running the console and Polaris on different ports (e.g. console on `8080`, Polaris on `8181`), the browser blocks all API requests due to CORS:
   
   ```
   Access to XMLHttpRequest at 'http://host:8181/api/catalog/v1/oauth/tokens'
   from origin 'http://host:8080' has been blocked by CORS policy:
   No 'Access-Control-Allow-Origin' header is present on the requested resource.
   ```
   
   Different ports on the same host are treated as different origins by the browser.
   
   ## Workaround
   
   A reverse proxy is needed to serve both the console and the Polaris API from the same origin:
   
   ```nginx
   server {
       listen 9090;
       location /api/ {
           proxy_pass http://127.0.0.1:8181;
       }
       location / {
           proxy_pass http://127.0.0.1:8080;
       }
   }
   ```
   
   Then run the console pointing to the proxy:
   
   ```bash
   docker run -p 8080:8080 \
     -e VITE_POLARIS_API_URL=http://host:9090 \
     -e VITE_OAUTH_TOKEN_URL=http://host:9090/api/catalog/v1/oauth/tokens \
     apache/polaris-console:latest
   ```
   
   ## Suggested fix
   
   The README should document this requirement for local Docker setups. Alternatively, a `docker-compose.yml` with an nginx sidecar would make this work out of the box.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org