fix(web): treat configured urls with uppercase schemes as secure

[Lucenx9]

Problem

resolveConfiguredPrimaryTarget classifies VITE_WS_URL / VITE_HTTP_URL with case-sensitive startsWith("wss:") / startsWith("https:") checks, while the URL parser folds any scheme casing (new URL("WSS://host") is valid). A configured WSS://host therefore falls into the plaintext branch and the derived HTTP base URL becomes http://host — silently downgrading TLS for that deployment (same for HTTPS://host → plain ws://).

Fix

Both raw-string scheme checks are case-folded before classification, so uppercase variants land in the secure branch like their lowercase equivalents.

Verification

• Two new regression tests in bootstrap.test.ts (WSS:// and HTTPS:// configured URLs must resolve to https/wss targets); both fail against the old code and pass now.
• Full environments/primary suite green, tsgo --noEmit clean.

ox-alpha via opencode

Note

Fix resolveConfiguredPrimaryTarget to treat uppercase HTTPS/WSS schemes as secure

When only one of VITE_HTTP_URL or VITE_WS_URL is set, the other is derived from it. Previously, uppercase secure schemes like HTTPS: or WSS: were not recognized as secure, causing the derived URL to downgrade to http or ws. The fix in target.ts normalizes the scheme via toLowerCase() before the security check. Tests in bootstrap.test.ts cover uppercase HTTPS and WSS env values.

^{Macroscope summarized 83fe887.}

---

Note

Medium Risk
Touches how configured environment URLs are classified as TLS vs plaintext, which previously could silently downgrade derived http/ws bases. The change itself is a small, well-tested case-fold.

Overview
Stops a silent TLS downgrade when only one of VITE_HTTP_URL or VITE_WS_URL is set with an uppercase scheme (HTTPS:// / WSS://).

resolveConfiguredPrimaryTarget now case-folds the raw scheme before deciding whether to derive https/wss vs http/ws. Regression tests cover both uppercase env values resolving to secure targets.

^{Reviewed by Cursor Bugbot for commit 83fe887. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Corrected handling of uppercase HTTPS and WSS URL schemes.
  • Secure connections now consistently remain on https and wss targets instead of being downgraded.

[Lucenx9]

@codex review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 13c108a1-3d96-4e26-ae39-293a2f3ee7f4

📥 Commits

Reviewing files that changed from the base of the PR and between b1670ac and 83fe887.

📒 Files selected for processing (2)

• apps/web/src/environments/primary/bootstrap.test.ts
• apps/web/src/environments/primary/target.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The target URL logic now normalizes configured schemes before detection. Tests cover uppercase WSS:// and HTTPS:// values and verify secure base URLs.

Changes

Secure scheme normalization

Layer / File(s)	Summary
Normalize configured schemes and validate targets apps/web/src/environments/primary/target.ts, apps/web/src/environments/primary/bootstrap.test.ts	Scheme checks now use lowercase values. Tests verify that uppercase WSS:// and HTTPS:// configurations produce secure HTTP and WebSocket base URLs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 83fe8

This localized change prevents uppercase HTTPS/WSS configuration values from being downgraded to insecure derived URLs, with regression tests covering both cases. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: juliusmarminge

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main fix for uppercase secure URL schemes.
Description check	✅ Passed	The description explains the problem, fix, and verification, but it omits the template headings and checklist.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 83fe887591

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Lucenx9]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[macroscopeapp]

Approvability

Verdict: Skipped

Macroscope did not run approvability analysis for this PR. Macroscope could not determine whether this PR modifies its approvability configuration, so the PR was not approved automatically. A PR that may change the rules that govern approval is never approved automatically.