Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Host 500s every request on non-base domains when GET /api/tenants/bindings 404s — no fallback, and no runtime ships the route

Aperta
  • Qualcosa non va?
#665 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
api, backend, infrastructure

Direzione di ricerca

Start with host/src/services/binding-resolver.ts, then check the deployed API contract and the api plugin documentation in skills/api-and-auth. Trace how a missing bindings route and an unrecognized Host header affect resolution, and inspect the base-host matching behavior for www aliases. Done when the reported non-base domains serve successfully and the runtime provides the bindings route or handles its absence as requested.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Environment

  • Child runtime: bos://nearbuilding.near/nearbuilders.org (extends: bos://dev.everything.near/everything.dev), platform: 2.0.0-rc.27
  • Host image: ghcr.io/nearbuilders/everything-dev:v2.0.0-rc.27, host bundle gitSha b86f6407cdb75441c7176065a157c4d832f42562 (version manifest 405e6695ffee5c1f on cdn.everything.dev)
  • Serve via the Railway template per the self-deploy guide

Symptom

Viewing the deployed app through anything other than the runtime's configured domain returns 500 on every page:

Tenant bindings unavailable (cached failure, 6s remaining) — last fetch of http://localhost:8080/api/tenants/bindings failed

(localhost:8080 is the host's in-container API; the failure is real, not a client echo.)

The API itself is healthy — GET /api/_health returns status: "ready" with all plugins loaded. Sending the gateway host header serves the app fine:

$ curl -H "Host: nearbuilders.org" https://app-production-5363.up.railway.app/   # → 200, full page
$ curl https://app-production-5363.up.railway.app/                              # → 500
$ curl https://app-production-5363.up.railway.app/api/tenants/bindings          # → 404 Not Found

Root cause (host/src/services/binding-resolver.ts, as built into the rc.27 host bundle)

  1. createBindingResolver.resolve() treats any hostname that fails isBaseHost as a tenant lookup and calls ensureBindingsLoaded(). isBaseHost is an exact match: hostname === gatewayId || hostname === "localhost" || hostname === "127.0.0.1".
  2. fetchBindingsFromApi() throws on any non-OK response: GET ${endpoint} failed with HTTP ${status}.
  3. On failure with no stale entries to fall back on, the failure is cached (failedUntil: Date.now() + FAILURE_TTL_MS) and rethrown — turning into a site-wide 500 for every non-base-host request (this is the Tenant resolution is unavailable case in skills/super-app and skills/extends-config).
  4. No deployed runtime actually exposes GET /api/tenants/bindings. The base runtime's own production API returns 404 for it (https://everything.dev/api/tenants/bindings → 404), and child APIs built from the rc.27 scaffold have no tenants contract either (our published API spec has 90 paths, none tenant-related) — everything.dev itself serves 200 only because requests there match the base domain and never enter tenant resolution.

Impact

  • Every self-deployed child runtime is one unrecognized Host header away from a full site 500 — e.g. before the real domain is attached in DNS, the Railway (*.up.railway.app) URL is unviewable.
  • www.<domain> also fails isBaseHost's exact match, so standard www→apex setups will trigger tenant lookup too.

Asks

  1. Graceful degradation: a 404 from the bindings endpoint should mean "no tenants configured" — resolve to an empty map (warn log) and serve the base runtime for unrecognized hostnames, rather than 500ing the request. (503 keeps the current "API plugin failed to load" hard error; the two failure modes can stay distinct.)
  2. Ship the route: the host expects GET /tenants/bindings on the platform API, but no published runtime ships it — either the base runtime API exposes it, or the scaffold's api contract includes the tenants table + lookup routes (skills/api-and-auth already documents "the api plugin owns the tenants table and exposes public lookup routes").
  3. isBaseHost: relax exact-match so conventional www. aliases resolve as the base runtime (or provide a redirect path).

Repro

Deploy any child runtime per docs/self-deploy.md (Railway template, BOS_ACCOUNT/BOS_GATEWAY), then open the *.up.railway.app URL, or:

curl -H "Host: <gateway>" <deploy-url>/        # 200
curl <deploy-url>/                             # 500
curl <deploy-url>/api/tenants/bindings         # 404
Lingua principale
TypeScript
Stelle
5
Fork
3
Merge medio
9h 37m
PR unite (30g)
157

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NEARBuilders/everything-dev

Tutte le issue di NEARBuilders/everything-dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.