Skip to content

fix(site): make an unusable base path impossible, not merely documented - #589

Merged
SUaDtL merged 1 commit into
mainfrom
chore/base-path-guard
Aug 1, 2026
Merged

fix(site): make an unusable base path impossible, not merely documented#589
SUaDtL merged 1 commit into
mainfrom
chore/base-path-guard

Conversation

@SUaDtL

@SUaDtL SUaDtL commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

Turns the BASE comment into an enforced gate.

The failure it prevents

rehypeBaseLinks prefixes every root-absolute href/src with the base. A base of "/" rewrites /diagrams/x.svg into //diagrams/x.svg — a protocol-relative URL that resolves against a different host.

Nothing 404s. The build succeeds. The link audit passes, because the target still parses as a valid reference. The page just quietly fetches from somewhere else. That is why this needed to be an error rather than a comment: "/" is the obvious thing to reach for when moving a site to a domain root, and every existing check would have waved it through.

What changed

site/base.mjs validates at import time and throws. The invariant is "" (apex) or a root-absolute path with no trailing slash, so the same guard also catches "/codeArbiter/" and "codeArbiter".

Verified by mutation, not by assertion

Setting the base to "/" fails all three independently, because each imports the module:

with RAW_BASE = "/"
npm run build FAILED (guard fired)
npm run link-audit FAILED (guard fired)
vitest FAILED — module will not load

There is no path that ships it.

test/base.test.ts pins the rejected forms and, rather than describing the hazard in prose, asserts the corruption directly: prefixing under a base of "/" produces a value starting with //.

Gate

511/511 vitest (48 files), tsc clean, build green, link-audit resolves 20,057 links across 140 pages. All four run locally this time — npm test alone is vitest only, which is what let the previous two CI failures through.

The base was guarded by a comment saying it must never be "/". A comment
stops nobody, and "/" is the obvious thing to reach for when moving a
site to a domain root.

The failure it prevents is worse than a broken link. rehypeBaseLinks
prefixes every root-absolute href/src with the base, so a base of "/"
rewrites "/diagrams/x.svg" into "//diagrams/x.svg" — a protocol-relative
URL that resolves against a DIFFERENT HOST. Nothing 404s: the build
succeeds and the link audit passes, because the target still parses as a
valid reference. The page just quietly fetches from somewhere else.

base.mjs now validates at import time and throws. Verified by mutation
— setting the base to "/" fails the Astro build, the link audit, and the
test suite, because every one of them imports the module. There is no
path that ships it.

The invariant is "" or a root-absolute path with no trailing slash, so
the same guard also catches "/codeArbiter/" and "codeArbiter".

test/base.test.ts pins the rejected forms and, rather than describing the
hazard in prose, asserts the corruption directly: prefixing under a base
of "/" produces a value starting with "//".

511/511 vitest, tsc clean, build green, 20,057 links resolve.
@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 218a5d68-7c88-413a-86a2-7e331ffeaf53

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@SUaDtL
SUaDtL merged commit 61d55aa into main Aug 1, 2026
42 checks passed
@SUaDtL
SUaDtL deleted the chore/base-path-guard branch August 1, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant