While reviewing fix/auth-headers-and-profile branch code, I found that it is directionally useful and addresses real problems, especially missing auth headers on protected metadata/custom database requests and the profile page’s dependency on the Keycloak Account API. However, I would consider several configuration and verification details.
The main issue is the local Keycloak URL handling. The branch’s env.template suggests VITE_KEYCLOAK_URL=/auth, but in local development this is known to break login because Keycloak redirects can expose internal Docker hostnames. Since we already had a production incident caused by browser-facing and backend/internal Keycloak URL mismatches, I want the template and documentation to make the safe local value explicit: http://localhost:8080/auth.
I also found that the new VITE_API_TIMEOUT setting is currently only parsed into frontend config, but not actually enforced by the fetch layer. This could be problematic: it makes the code look more configurable than it really is. I want either to wire this into actual request cancellation behavior, or avoid presenting it as an active timeout feature.
Next, the JupyterHub URL cleanup is reasonable and aligns with the RIKEN nginx path layout, but it changes an important integration path. Because the Jupyter button flow was not confirmed end-to-end, I would like to add or at least document a concrete smoke test before treating the change as safe for deployment.
Finally, this branch brings in the broader dev/prod URL-parity work from PR #47, not just the auth-header/profile fixes. That may be the right direction, but it should be intentional and clearly reviewed as part of the merge, since it affects Docker Compose, Vite proxy behavior, Keycloak routing, JupyterHub routing, and deployment expectations.
So, I would like to improve the branch before merging it: make the Keycloak local/prod behavior explicit and safe, remove or complete misleading timeout configuration, document the required manual .env updates, and define the required smoke checks for Keycloak login, custom database operations, and JupyterHub launch. I will create a PR for the clean development delivery process and then we will be able to merge safely.
Please, let me know if you have any concerns.
@carlosengutierrez
While reviewing fix/auth-headers-and-profile branch code, I found that it is directionally useful and addresses real problems, especially missing auth headers on protected metadata/custom database requests and the profile page’s dependency on the Keycloak Account API. However, I would consider several configuration and verification details.
The main issue is the local Keycloak URL handling. The branch’s env.template suggests VITE_KEYCLOAK_URL=/auth, but in local development this is known to break login because Keycloak redirects can expose internal Docker hostnames. Since we already had a production incident caused by browser-facing and backend/internal Keycloak URL mismatches, I want the template and documentation to make the safe local value explicit: http://localhost:8080/auth.
I also found that the new VITE_API_TIMEOUT setting is currently only parsed into frontend config, but not actually enforced by the fetch layer. This could be problematic: it makes the code look more configurable than it really is. I want either to wire this into actual request cancellation behavior, or avoid presenting it as an active timeout feature.
Next, the JupyterHub URL cleanup is reasonable and aligns with the RIKEN nginx path layout, but it changes an important integration path. Because the Jupyter button flow was not confirmed end-to-end, I would like to add or at least document a concrete smoke test before treating the change as safe for deployment.
Finally, this branch brings in the broader dev/prod URL-parity work from PR #47, not just the auth-header/profile fixes. That may be the right direction, but it should be intentional and clearly reviewed as part of the merge, since it affects Docker Compose, Vite proxy behavior, Keycloak routing, JupyterHub routing, and deployment expectations.
So, I would like to improve the branch before merging it: make the Keycloak local/prod behavior explicit and safe, remove or complete misleading timeout configuration, document the required manual .env updates, and define the required smoke checks for Keycloak login, custom database operations, and JupyterHub launch. I will create a PR for the clean development delivery process and then we will be able to merge safely.
Please, let me know if you have any concerns.
@carlosengutierrez