fix(levelcode): /ai 301'd to itself forever on a staging host

[ndemianc]

A dev build pointed at an ngrok tunnel produced an endless redirect loop — /ai/login logging identical 301s to itself:

Started GET "/ai/login" ...
Redirected to https://thinly.ngrok.app/ai/login
Completed 301 Moved Permanently in 0ms

Cause

LEVELCODE_ORIGIN is ENV.fetch-able and commented "ENV-overridable for staging". LEVELCODE_HOSTS was a hardcoded frozen pair.

So you can point the origin at a tunnel, but you cannot add that tunnel to the host list. #ui then takes the non-LevelCode branch and bounces any /ai path to LEVELCODE_ORIGIN — which is now the host it is already serving. The browser follows the 301 straight back into the same action.

The staging override was only ever half-usable.

Two fixes, because either alone leaves a trap

1. LEVELCODE_HOSTS parses a comma list from ENV, so a tunnel or preview host can be declared a LevelCode host and serve the account app properly — bare-path funnelling included.
2. #ui refuses to redirect a host to itself. Worth having even when configured correctly: a config mistake should degrade to serves the app, not to a redirect storm that reads like an application bug.

LEVELCODE_ORIGIN=https://thinly.ngrok.app
LEVELCODE_HOSTS=levelcode.ai,www.levelcode.ai,thinly.ngrok.app

Where the policy lives

Review found that routing and the controller each decided "is this a LevelCode host?" on their own, and only the controller folded case. Rack passes the Host header through exactly as sent (only the port is stripped), so Host: LevelCode.AI was a LevelCode host to #ui and not one to the route constraint — a 7-char bare path like /pricing resolved as a short code and landed on /link-not-found before #ui ever ran.

Rather than have routes.rb reach into a controller, the policy is now its own small immutable value, Levelcode::Hosts (app/services/levelcode/hosts.rb):

#hosts, #origin	the parsed list and the canonical origin
#include?(host)	does this host serve the account app? — case-folded
#origin?(host)	is this host the canonical origin itself? — what the self-redirect guard asks
.from_env(env = ENV)	builds one from LEVELCODE_HOSTS / LEVELCODE_ORIGIN
.current	the process-wide policy, read once

StaticController#ui and the route constraint both ask Levelcode::Hosts.current, so they cannot disagree about a host. The controller no longer carries constants or class methods (94 → 71 lines), and the guard is an elsif ai_path? branch rather than two early returns that each re-tested the path. The env var names and defaults are unchanged.

How it is tested

No assertions against source text. An earlier revision of this PR had two — a regex over the controller's source to prove the list came from ENV (the constant was frozen at class load, so nothing else could), and a string match on which method routes.rb called. Both are replaced by behaviour:

• .from_env takes the environment as an argument, so reading it is directly testable.
• .current is checked on a throwaway subclass, which has its own memo and never disturbs the real one.
• Routing and the controller share one policy is the tunnel example: its host exists only in the overridden policy, and /pricing is seven characters.

Every request example names the shell it expects. Five of them used to assert a bare 200, which cannot tell the shortener shell from the account shell — a self-redirect guard that rendered the wrong one passed the whole file. There is also now an inverse example: on thin.ly a 7-char path is a short code. Without it, a constraint that withheld the lookup from every host satisfied everything.

spec/requests/static_spec.rb 13 examples · spec/services/levelcode/hosts_spec.rb 13 examples.

Verification

• Full suite 1058 examples, 0 failures · rubocop clean · brakeman 0 warnings under CI's invocation · zeitwerk:check good.
• The refactor is behaviour-preserving, and the history shows it: ca1adb6 pins the behaviour against the old code; 21d3bed moves the code, and the 13 request examples pass against it untouched — that file's only edits are one helper's body, a comment, and the unit examples that moved.
• Each piece broken in turn, caught only by its own examples:

Mutation	Fails
the policy stops folding case	2
routing builds its own policy instead of sharing the controller's	1 — the tunnel example
the controller keeps a private host list	2
origin? never matches	4
the guard line removed from #ui	1
.current hardcoded to the defaults	1
(against the old code) the guard renders the wrong shell	1 — previously 0

Commits, in reading order

1. f48b35f fix — LEVELCODE_HOSTS from ENV, and the self-redirect guard.
2. fb9a972 fix — review: one host predicate for routing and the controller.
3. ca1adb6 test — pin which shell each host and path renders.
4. 21d3bed refactor — the policy moves into Levelcode::Hosts.

develop is merged in (no overlap with these files).

[Copilot]

Pull request overview

Adds environment-configurable LevelCode hosts and prevents self-redirect loops for staging deployments.

Changes:

• Parses LEVELCODE_HOSTS from the environment.
• Adds self-redirect protection.
• Expands request specs for host parsing and tunnel behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Review
app/controllers/static_controller.rb	Host configuration and redirect protection added. Moderate issue: routing does not apply the same host normalization, causing mixed-case hosts to bypass the bare-path funnel.
spec/requests/static_spec.rb	Adds coverage for host overrides, parsing, and redirect-loop prevention.

Suppressed comments (3)

app/controllers/static_controller.rb:67

• This check compares only hostnames, but URI#host drops the origin's port (and the scheme is ignored too). For example, with LEVELCODE_ORIGIN=https://preview.example:8443, a request to http://preview.example:3000/ai/login is not a self-redirect—the target is a different origin—yet this guard renders the shell on port 3000 instead of redirecting to the configured canonical origin. Compare the full effective origin (scheme, host, and port) before suppressing the redirect.

    URI.parse(LEVELCODE_ORIGIN).host.to_s.casecmp?(request.host.to_s)

app/controllers/static_controller.rb:69

• ENV.fetch accepts an explicitly empty LEVELCODE_ORIGIN. For that value URI.parse yields no host, so this predicate is false and the redirect branch builds /ai/..., a relative URL on the same host; the infinite redirect loop remains. Validate the origin at boot or treat a missing/invalid host as a non-redirecting configuration before calling redirect_to.

    URI.parse(LEVELCODE_ORIGIN).host.to_s.casecmp?(request.host.to_s)
  rescue URI::InvalidURIError
    false

app/controllers/static_controller.rb:12

• This new environment variable does not by itself make a tunnel reachable in production/staging: config/environments/production.rb:114-129 still hardcodes config.hosts and does not include LEVELCODE_HOSTS. Rails HostAuthorization rejects a host such as thinly.ngrok.app before routing reaches this controller, so the documented two-variable setup still returns 403 unless a separate host allowlist is configured. Wire the configured hosts into config.hosts or document that additional requirement.

  # ENV-overridable so a staging or tunnel host (ngrok, a preview deploy) can serve the account app.
  # MUST be set together with LEVELCODE_ORIGIN: overriding the origin alone points the bounce at a host
  # that is still not recognised as a LevelCode host, and /ai then 301s to itself forever. The
  # self-redirect guard in #ui makes that misconfiguration render instead of loop, but set both.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.