feat: make subpath optional for reverse proxy prefix

[benlife5]

1. Makes the subpath optional
2. Makes the automatically setup redirects optional (because we don't need them if no subpath)
3. Updates the apply step able to handle moving to or from a RPP with a subpath

Testing details:

• Created a section library with a custom pack of pages js
• Successfully created a RPP with a subpath (existing behavior): https://www.yext.com/s/5225829/yextsites/168642/pagesets
• Successfully generated a section library revision with no subpath (artifact generation operation 01a0ed74-fba3-79c8-a62e-663884bd0052) -- confirmed the artifacts did not have any subpaths.
• Not 100% the client's domain configuration so may need to troubleshoot through the actual deployment

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a297666a-095f-4b3c-8052-e9c0fd775fcb

📥 Commits

Reviewing files that changed from the base of the PR and between 13ae478 and 09a6234.

📒 Files selected for processing (2)

• packages/pages/src/util/applyReverseProxy.test.ts
• packages/pages/src/util/applyReverseProxy.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

Reverse-proxy prefixes can now contain only a host, with or without a trailing slash. For these prefixes, override construction retains the configured assets path and omits the generated dynamic route. Configuration updates can remove a matching route generated from the previous subpath prefix while retaining unrelated routes. Tests cover repeated application and switching between host-only and subpath prefixes.

Sequence Diagram(s)

sequenceDiagram
  participant PrefixInput
  participant parseReverseProxyPrefix
  participant buildReverseProxyOverride
  participant updateConfigYaml
  PrefixInput->>parseReverseProxyPrefix: Parse host-only prefix
  parseReverseProxyPrefix-->>buildReverseProxyOverride: Return host with undefined subpath
  buildReverseProxyOverride-->>updateConfigYaml: Provide override without dynamic route
  updateConfigYaml->>updateConfigYaml: Retain assets path and update matching prior generated route

Loading

Suggested reviewers: mkilpatrick, a-friedman

Priority: ⬇️ Low

Change: Feature

Merge Risk: ⚪ Minimal · up to 09a62

Host-only prefixes and transitions between prefixes appear ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 09a62

Normal prefix switches preserve asset paths, but an interrupted switch to a host-only prefix can leave the configuration and asset path out of sync, and retrying may not repair it. No new security bypass was established.

Retained concerns

• Medium · reliability · inferred: An interrupted subpath-to-host-only switch can persist the new prefix before updating Vite’s asset path; retry can then treat the old prefixed path as the original path, leaving routing and built assets inconsistent.

Security review details

Security Blast Radius

• inferred — The observed configuration-writing path is reached through a project build command. Its effects are on that project’s serving and asset configuration; authority to invoke builds and downstream deployment exposure are not established by the available source.

Trust Boundaries and Controls

• observed — The build input is parsed before configuration is updated. Host-only input omits a generated dynamic route rather than introducing a new request-handling path; the host component itself is not subject to a newly added validation control.

Resilience and Maintainability Implications

• inferred — Sequential writes can strand a host-only migration in a state that a repeated build does not correct, affecting failure containment and rollback rather than establishing an attacker-driven bypass.

Hardening Proposals

• proposed — Make the two-file transition recoverable—for example, retain a stable original asset path until both writes succeed or restore the prior configuration on failure—and exercise interruption followed by retry.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: making the reverse proxy prefix subpath optional.
Description check	✅ Passed	The description directly explains the optional subpath behavior, optional redirects, update handling, and testing results for the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jhelenek]

github doesnt have a +1 option, but +1
if you tested, please add test to the description, o/w please test once you merge

[benlife5]

Yeah sorry got ahead of myself, need to manually test

[benlife5]

Updated with testing details. Deployment plan:

• Cherry-pick this to 1.3.x, release as 1.3.3
• Update platform-templates-mission branch of the starter (this is what will be used for the client)
• Update main branch of the starter (the system also builds a OOTB artifact, so need this to avoid errors)
• Update section-libraries (not needed for client, will use fleet manager)

didn't mean to request changes, just the one comment

[briantstephan]

Maybe a bit out of the scope of your changes, but would it be helpful to add additional validation to block inputs like https:? The old logic allowed some invalid inputs as well so this isn't really a regression, just something to consider.

[jwartofsky-yext]

Can you explain why we are calling the exact same command twice here? What does this accomplish?

[benlife5]

When the reverse proxy is applied as part of the build, the config.yaml is rewritten. This duplicate call tests if the operation is idempotent