VITE_OAUTH_TOKEN_URL build-time default overrides runtime config when not explicitly set

[mwisselaar]

Description

When running the Docker image with a custom VITE_POLARIS_API_URL, the app still uses http://polaris:8181 as the OAuth token endpoint unless VITE_OAUTH_TOKEN_URL is also explicitly passed at runtime.

Root cause

The Dockerfile sets ENV VITE_OAUTH_TOKEN_URL=http://polaris:8181/api/catalog/v1/oauth/tokens during the build stage. Vite bakes this into import.meta.env.VITE_OAUTH_TOKEN_URL in the JS bundle.

generate-config.sh writes an empty string for VITE_OAUTH_TOKEN_URL when it is not passed at runtime. The getConfig() function in src/lib/config.ts skips empty strings in window.APP_CONFIG and falls through to import.meta.env — which returns the baked-in polaris:8181 default.

// src/lib/config.ts
function getConfig(key: keyof AppConfig, defaultValue: string = ""): string {
  const runtimeValue = window.APP_CONFIG?.[key]
  if (runtimeValue !== undefined && runtimeValue !== "") {  // empty string is skipped
    return runtimeValue
  }
  const buildTimeValue = import.meta.env[key]  // falls through to baked-in default
  ...
}

Expected behavior

If VITE_OAUTH_TOKEN_URL is not set at runtime, it should be derived from VITE_POLARIS_API_URL at runtime — not from the build-time Dockerfile default.

Steps to reproduce

docker run -p 8080:8080 \
  -e VITE_POLARIS_API_URL=http://myhost:8181 \
  -e VITE_POLARIS_REALM=myrealm \
  -e VITE_POLARIS_PRINCIPAL_SCOPE=PRINCIPAL_ROLE:ALL \
  apache/polaris-console:latest

Login fails with ERR_NAME_NOT_RESOLVED for polaris:8181/api/catalog/v1/oauth/tokens despite VITE_POLARIS_API_URL being correctly set.

Workaround

Always pass VITE_OAUTH_TOKEN_URL explicitly:

docker run -p 8080:8080 \
  -e VITE_POLARIS_API_URL=http://myhost:8181 \
  -e VITE_OAUTH_TOKEN_URL=http://myhost:8181/api/catalog/v1/oauth/tokens \
  apache/polaris-console:latest

Suggested fix

In docker/generate-config.sh, derive VITE_OAUTH_TOKEN_URL from VITE_POLARIS_API_URL when not explicitly set:

VITE_OAUTH_TOKEN_URL="${VITE_OAUTH_TOKEN_URL:-${VITE_POLARIS_API_URL}/api/catalog/v1/oauth/tokens}"

This ensures the token URL always follows the API URL unless explicitly overridden.

[mwisselaar]

Related issue: CORS blocks requests in local Docker setup

When running the console and Polaris on different ports (e.g. console on 8080, Polaris on 8181), the browser blocks all API requests due to CORS:

Access to XMLHttpRequest at 'http://host:8181/api/catalog/v1/oauth/tokens'
from origin 'http://host:8080' has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested resource.

Different ports on the same host are treated as different origins by the browser.

Workaround

A reverse proxy is needed to serve both the console and the Polaris API from the same origin:

server {
    listen 9090;
    location /api/ {
        proxy_pass http://127.0.0.1:8181;
    }
    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}

Then run the console pointing to the proxy:

docker run -p 8080:8080 \
  -e VITE_POLARIS_API_URL=http://host:9090 \
  -e VITE_OAUTH_TOKEN_URL=http://host:9090/api/catalog/v1/oauth/tokens \
  apache/polaris-console:latest

Suggested fix

The README should document this requirement for local Docker setups. Alternatively, a docker-compose.yml with an nginx sidecar would make this work out of the box.