Skip to content

One command for the local setup, in a Codespace as well - #19

Merged
oblomov-dev merged 1 commit into
mainfrom
claude/practical-ramanujan-2vsjge
Oct 17, 2026
Merged

oblomov-dev merged 1 commit into
mainfrom
claude/practical-ramanujan-2vsjge

Conversation

@oblomov-dev

Copy link
Copy Markdown
Member

What changes

  • npm run start-local (and :fe, :fe-v2, :card) at the root now runs the whole local setup with one command. It starts abap2UI5 in Node on localhost:3000, then the example's dev server with ui5-local.yaml. If a backend already answers on port 3000 (npm run backend, or npm run express in an abap2UI5 checkout), it uses that one instead.
  • New script npm run backend (scripts/backend.mjs) starts only the backend, for example for the e2e tests.
  • @abap2ui5/node-runtime (^1.148.0) and express (^5) are now root devDependencies. package-lock.json changes accordingly; most of the churn is npm re-hoisting packages now that express 5 sits at the root.
  • GitHub Codespace: the port forwarding rewrites Origin and X-Forwarded-Host, so abap2UI5's CSRF check rejected every roundtrip with "CSRF validation failed - cross-origin request rejected". The local backend now drops Origin, Referer and X-Forwarded-Host before abap2UI5 sees them, but only when CODESPACES=true. Everywhere else the backend is serve() as it ships, host guard included.
  • README ("Develop") and AGENTS.md describe the new commands. AGENTS.md also records the Codespace exception to the rule "no middleware of our own for abap2UI5's CSRF check", which has to be signed off.

Delivery to the branches is unchanged: scripts/ is not delivered, and the examples' READMEs keep their own backend instructions.

Why

Trying the examples locally used to need a second folder, a separate install and a second terminal. In a Codespace even that wasn't enough: the custom sections stayed empty (504 while no backend was running), then failed with the CSRF 403. Now npm ci && npm run start-local:fe is enough, locally and in a Codespace.

Checked

  • npm run lint, npm run format:check, npm run abaplint (0 issues), npm run build (the control is in every dist/thirdparty/), ABAP2UI5_DIR=../abap2UI5 npm run bsp: all pass.
  • npm run start-local:fe, tested with curl:
    • without CODESPACES: bundle 200, same-origin POST OK; Codespace-like headers → 403 (unchanged behaviour); a foreign Origin is refused by the host guard.
    • with CODESPACES=true: bundle 200, POST OK with Codespace-like headers.
  • "Port 3000 already in use" path: the running backend is reused.
  • The header drop was tried by the reporter in a real Codespace as a stand-alone script, and it worked there. This exact version (with CODESPACES detection) has not been run in a real Codespace yet.
  • npx playwright test not run here; CI runs it.

Generated by Claude Code

`npm run start-local[:fe|:fe-v2|:card]` at the root now starts abap2UI5 in
Node on localhost:3000 (@abap2ui5/node-runtime, a root devDependency) and
then the example's dev server - nothing to install in a folder of its own.
A backend already answering on port 3000 is used instead. `npm run backend`
starts the backend alone, for the e2e tests.

In a GitHub Codespace the port forwarding rewrites Origin and
X-Forwarded-Host, so abap2UI5's CSRF check rejected every roundtrip with
"CSRF validation failed - cross-origin request rejected". With
CODESPACES=true, and only then, the local backend drops those headers
before abap2UI5 reads them; AGENTS.md records the exception.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SSuTz9gad47nuvCgmUkpTr
@oblomov-dev
oblomov-dev merged commit b7657fc into main Oct 17, 2026
2 of 4 checks passed
@oblomov-dev
oblomov-dev deleted the claude/practical-ramanujan-2vsjge branch October 17, 2026 13:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants