mirror of
https://github.com/suitenumerique/meet.git
synced 2026-09-03 14:17:59 +00:00
Paul Csiki
cf3960db95
Adds support for serving media behind Traefik, which currently cannot work at all. The media-auth subrequest views read the original request URL from a hardcoded HTTP_X_ORIGINAL_URL header. That header is an nginx-ingress convention. Traefik's ForwardAuth middleware sends X-Forwarded-Uri instead and has no mechanism to emit X-Original-URL, so behind Traefik every recording download and file attachment is rejected with a bare 403 -- indistinguishable from a legitimate permission denial, which makes it painful to diagnose. Add MEDIA_AUTH_ORIGINAL_URL_HEADER, defaulting to HTTP_X_ORIGINAL_URL so existing nginx-ingress deployments are unaffected. Traefik deployments set it to HTTP_X_FORWARDED_URI. It is used in both places that resolve the header: RecordingViewSet._auth_get_original_url and the file attachment _authorize_subrequest. The log message on a missing header now names the header actually expected, which is what makes the failure diagnosable. This mirrors the setting the sibling Docs project already exposes (suitenumerique/docs, MEDIA_AUTH_ORIGINAL_URL_HEADER) for the same reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>