feat(app-url-guard): add APP_URL mismatch developer guard package by dripar-webkul · Pull Request #456 · unopim/unopim

dripar-webkul · 2026-06-02T05:14:08Z

Description

Adds a debug-only Webkul\AppUrlGuard package that detects when the browser host doesn't match APP_URL — the cause of the "styles/JS not loading" bug — and shows a guided fix modal styled to match the login page. Fully inert in production (APP_DEBUG=false).

Behavior (debug only):

Injects a compact, UnoPim-themed modal on mismatched pages showing Configured (.env) vs Actual (browser) URLs plus copy-paste fix steps and a progress bar.
Close (×) re-validates APP_URL via a same-origin endpoint → reloads if fixed, warning toast if still wrong; All done → hard reload.
Force-logs-out an authenticated admin on a mismatched host (admin session guard only) and redirects to a reachable login URL.
Logs the mismatch once per session.

Quality: Pint clean · 64 Pest tests / 101 assertions passing · no translation-audit issues. Self-contained view (scoped CSS, inline SVG — no font dependency), XSS-safe, handles Apache sub-dir & Nginx root.

Notes: Force-logout means an admin can't stay logged in while APP_URL is wrong (intentional, debug-only). No Tailwind classes added — the injected modal uses scoped CSS by design.

…-logout edge cases

…-steps UI

…n page theme

…ass in the full CI suite

… locales

Copilot

Pull request overview

This PR introduces a new debug-only Webkul\AppUrlGuard package to detect APP_URL vs browser-host mismatches (a common cause of “CSS/JS not loading”), and provides a guided, in-page modal plus a lightweight check endpoint. The package is designed to be inert when APP_DEBUG=false and includes unit/feature coverage for normalization, injection behavior, and forced-logout behavior.

Changes:

Add AppUrlGuard package: global middleware to detect mismatches, inject a guided modal, and force-log-out mismatched admin sessions (debug-only).
Add a debug-only JSON “check” endpoint used by the modal to re-validate after the developer updates .env.
Register the package in autoload/providers and add comprehensive Pest/PHPUnit test suite entries.

Reviewed changes

Copilot reviewed 47 out of 47 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/Pest.php	Binds AppUrlGuard tests to `AdminTestCase`.
phpunit.xml	Adds AppUrlGuard unit + feature test suites.
composer.json	Adds PSR-4 autoload mapping for `Webkul\\AppUrlGuard\\`.
bootstrap/providers.php	Registers `AppUrlGuardServiceProvider`.
packages/Webkul/AppUrlGuard/src/Providers/AppUrlGuardServiceProvider.php	Loads routes/translations in debug and pushes the middleware onto the global stack.
packages/Webkul/AppUrlGuard/src/Http/Middleware/VerifyAppUrlMatches.php	Core guard logic: mismatch detection, logging, forced logout, and HTML injection.
packages/Webkul/AppUrlGuard/src/Http/Controllers/AppUrlGuardController.php	Debug-only JSON endpoint for “does APP_URL match now?”.
packages/Webkul/AppUrlGuard/src/Concerns/NormalizesUrl.php	Shared URL normalization used by middleware + endpoint.
packages/Webkul/AppUrlGuard/src/Routes/web.php	Defines the `/app-url-guard/check` route.
packages/Webkul/AppUrlGuard/src/Resources/views/warning.blade.php	Self-contained modal UI (HTML/CSS/JS) injected into mismatched HTML pages.
packages/Webkul/AppUrlGuard/src/Resources/lang/en_US/app.php	English strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/en_GB/app.php	en_GB strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/en_AU/app.php	en_AU strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/en_NZ/app.php	en_NZ strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ar_AE/app.php	Arabic strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ca_ES/app.php	Catalan strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/da_DK/app.php	Danish strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/de_DE/app.php	German strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/es_ES/app.php	Spanish (ES) strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/es_VE/app.php	Spanish (VE) strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/fi_FI/app.php	Finnish strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/fr_FR/app.php	French strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/hi_IN/app.php	Hindi strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/hr_HR/app.php	Croatian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/id_ID/app.php	Indonesian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/it_IT/app.php	Italian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ja_JP/app.php	Japanese strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ko_KR/app.php	Korean strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/mn_MN/app.php	Mongolian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/nl_NL/app.php	Dutch strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/no_NO/app.php	Norwegian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/pl_PL/app.php	Polish strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/pt_BR/app.php	Portuguese (BR) strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/pt_PT/app.php	Portuguese (PT) strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ro_RO/app.php	Romanian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/ru_RU/app.php	Russian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/sv_SE/app.php	Swedish strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/tl_PH/app.php	Tagalog strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/tr_TR/app.php	Turkish strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/uk_UA/app.php	Ukrainian strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/vi_VN/app.php	Vietnamese strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/zh_CN/app.php	Simplified Chinese strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/src/Resources/lang/zh_TW/app.php	Traditional Chinese strings for the modal + forced-logout message.
packages/Webkul/AppUrlGuard/tests/Unit/VerifyAppUrlMatchesTest.php	Unit coverage for mismatch detection, response guards, security, and edge cases.
packages/Webkul/AppUrlGuard/tests/Unit/NormalizesUrlTest.php	URL normalization equivalence/difference matrix tests.
packages/Webkul/AppUrlGuard/tests/Unit/ArchTest.php	Architecture invariants (no debug calls, controller/middleware expectations).
packages/Webkul/AppUrlGuard/tests/Feature/AppUrlGuardEndpointTest.php	Feature coverage for endpoint behavior, middleware registration, injection, and force-logout behavior.

…gets the unreachable APP_URL host

…chable-host redirects, treat loopback hosts as equal, and apply review fixes

…tch test is port-agnostic

dripar-webkul added 6 commits June 1, 2026 13:13

feat: add dev-only APP_URL mismatch warning banner

3d46a28

style: move APP_URL warning banner to top-center

fd9fd2c

feat(app-url-guard): add debug-only APP_URL mismatch guard package

f603e37

test(app-url-guard): cover normalisation, Apache/Nginx, XSS and force…

be26607

…-logout edge cases

style(app-url-guard): compact modal, add powered-by footer and guided…

c1790a1

…-steps UI

style(app-url-guard): match modal backdrop and powered-by to the logi…

d708367

…n page theme

dripar-webkul force-pushed the feature/app-url-mismatch-warning branch from 10651c8 to d708367 Compare June 2, 2026 06:15

dripar-webkul added 3 commits June 2, 2026 12:04

test(app-url-guard): use untrusted REMOTE_ADDR so X-Forwarded tests p…

a66492c

…ass in the full CI suite

feat(AppUrlGuard): add locale-based translations for all 33 supported…

336513e

… locales

feat(AppUrlGuard): add locale-based translations for all 33 supported…

e65bd3c

… locales

navneetkumar-pim-webkul requested a review from Copilot June 2, 2026 14:18

Copilot started reviewing on behalf of navneetkumar-pim-webkul June 2, 2026 14:18 View session

Copilot AI reviewed Jun 2, 2026

View reviewed changes

Comment thread packages/Webkul/AppUrlGuard/src/Routes/web.php Outdated

Comment thread packages/Webkul/AppUrlGuard/src/Concerns/NormalizesUrl.php

Comment thread packages/Webkul/AppUrlGuard/src/Resources/views/warning.blade.php Outdated

dripar-webkul added 4 commits June 3, 2026 11:10

fix(AppUrlGuard): translate guard log messages and apply PR review fixes

1f08454

feat(AppUrlGuard): render standalone warning page when a redirect tar…

13ba74b

…gets the unreachable APP_URL host

fix(AppUrlGuard): i18n guard log messages, show warning page on unrea…

899d2f0

…chable-host redirects, treat loopback hosts as equal, and apply review fixes

test(AppUrlGuard): derive loopback alias from the real host so the ma…

9cbef4d

…tch test is port-agnostic

navneetkumar-pim-webkul merged commit 6fcf8fe into unopim:master Jun 4, 2026
21 of 22 checks passed

This was referenced Jun 4, 2026

Release v2.0.3 — installer & ACL security hardening #472

Merged

chore(release): v2.1.3 — installer & ACL security hardening, AppUrlGuard #473

Merged

Navigation Menu

Repository navigation

feat(app-url-guard): add APP_URL mismatch developer guard package - #456

feat(app-url-guard): add APP_URL mismatch developer guard package#456
navneetkumar-pim-webkul merged 13 commits into
unopim:masterfrom
dripar-webkul:feature/app-url-mismatch-warning

dripar-webkul commented Jun 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dripar-webkul commented Jun 2, 2026

Description

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants