From 196212b41fde41ad9558d2401223ed8636f7f023 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Fri, 23 Oct 2026 11:05:16 -0700 Subject: [PATCH] fix(staging): set the backend's public API origin (TASK-403) Staging set frontendUrl but not backendUrl, so the backend fell back to the chart default https://api.commonly.me. That origin feeds the Atlassian connect hint ("ask your admin to allow /** in MCP server domains"), the CIMD client id, and the callback URLs, so staging told users to allow prod's API host. Staging's API is api-staging. No code change: hostedMcpApiBase already derives the origin from PUBLIC_API_URL / BACKEND_URL, with a test pinning that. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: swift Agent-Model: claude/claude-haiku-5-5/default --- k8s/helm/commonly/values-staging.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/k8s/helm/commonly/values-staging.yaml b/k8s/helm/commonly/values-staging.yaml index 428f9b8da1..be6b0953da 100644 --- a/k8s/helm/commonly/values-staging.yaml +++ b/k8s/helm/commonly/values-staging.yaml @@ -121,6 +121,12 @@ backend: # every /v2 page errors. The same allowlist feeds the socket.io cors. Caught by the Tier-1 # staging smoke 2026-10-23 (all /v2 renders failed on CORS until this landed). frontendUrl: "https://staging.commonly.me" + # The backend's public API origin. It sets the Atlassian connect hint ("allow + # /** in MCP server domains") and the CIMD and callback URLs. Unset, it falls + # back to the chart default (values.yaml: https://api.commonly.me), so staging told + # users to allow prod's API host. Staging's API is api-staging.commonly.me (the + # commonly-staging tunnel's ingressRules above). + backendUrl: "https://api-staging.commonly.me" # Staging backend runs on the SPOT pool at a fraction of prod's requests, so it fits # the nodes we already have (spot-pool sits at single-digit % CPU) without growing a # pool. Prod backend stays on dev-pool because it holds session state a spot