fix(console): link the new console everywhere and drop the legacy /console scheme by HarshMN2345 · Pull Request #13689 · appwrite/appwrite

HarshMN2345 · 2026-09-15T06:59:14Z

What

New _APP_CONSOLE_URL: the full origin of the console. Every console link Appwrite produces is built from it. It defaults to {http|https}://{_APP_CONSOLE_DOMAIN or _APP_DOMAIN}, using the same _APP_OPTIONS_FORCE_HTTPS rule as before. On Cloud it is https://appwrite.io. API URLs such as the VCS OAuth redirect_uri, /images/vcs and QR codes still use the console hostname.
_APP_CONSOLE_URL_SCHEME is removed, along with every legacy /console/project-{region}-{id}/... shape. All links now use root routes: OAuth2 success and failure defaults, magic URL, build CTAs, VCS comments and commit statuses, authorize-contributor, and webhook failure emails.
VCS installation callbacks with no redirect now default to {consoleUrl}/projects/{projectId}/settings (GitHub, Gitea, GitLab, Bitbucket and Origin). This supersedes fix(vcs): honour the console URL scheme in installation callback defaults #13599.
The legacy web paths redirect to the new console again: /invite to /join, /login to /sign-in, /recover to /reset and /register to /sign-up. /, /auth/* and /mfa keep their paths. /card is removed because the new console has no matching route. When the request is already on the console host, these paths return 404 instead of redirecting to themselves. The console host is also added to the allowed redirect hostnames.
Updated the tests: HTTP redirects and default OAuth2, the account OAuth2 failure URL, the webhooks worker, and the Gitea VCS callbacks.

Why

The new console serves only root routes, and on Cloud it runs on a different host from the API. Links built from the API hostname with /console paths sent users to pages that do not exist.

… scheme With _APP_CONSOLE_URL_SCHEME=root the console serves /, /auth/*, /card/*, /invite, /login, /mfa, /recover and /register/* at the root, so redirecting them to /console sends users to legacy paths.

The build failed, canceled and not-ready pages always linked to the sites console, so a function domain whose deployment was not ready sent users to a site that does not exist. Function links now use the functions shape: legacy .../functions/function-{id}[/deployment-{deploymentId}] and root /projects/{projectId}/functions/{id}[/deployments/{deploymentId}].

The vibes console has no /invite, /login, /recover or /register routes, so the registration comment no longer claims root-scheme consoles serve those paths.

greptile-apps · 2026-09-15T07:02:08Z

Confidence Score: 5/5

The code appears safe to merge. One non-blocking test gap remains in the existing thread.

Findings

This assertion copies the production check for APP CONSOLE URL SCHEME . CI runs this test with root , so the legacy redirect is never tested. It also accepts any response without location , including a 200 or 500 , even though root mode should return 404 . The repository rule requires fixed checks of visible behavior, not assertions derived from source configuration. Add separate root and legacy runs with fixed status and location assertions. ▶

Fix with agent prompt

### Issue 1
tests/e2e/General/HTTPTest.php:245-246
This assertion copies the production check for `_APP_CONSOLE_URL_SCHEME`. CI runs this test with `root`, so the legacy redirect is never tested. It also accepts any response without `location`, including a `200` or `500`, even though root mode should return `404`. The repository rule requires fixed checks of visible behavior, not assertions derived from source configuration. Add separate root and legacy runs with fixed status and `location` assertions.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Appwrite now builds console links from a separate console origin and uses root-based routes everywhere. Legacy web paths redirect to their new console equivalents, while requests on the console host are left for the console proxy.

_{Reviews (7) · Last reviewed commit: "chore(variables): introduce _APP_CONSOLE..."}

greptile-apps · 2026-09-15T07:02:11Z

+        $location = System::getEnv('_APP_CONSOLE_URL_SCHEME', 'legacy') !== 'root' ? '/console' . $endpoint : null;
+        $this->assertEquals($location, $response['headers']['location'] ?? null);


This assertion copies the production check for _APP_CONSOLE_URL_SCHEME. CI runs this test with root, so the legacy redirect is never tested. It also accepts any response without location, including a 200 or 500, even though root mode should return 404. The repository rule requires fixed checks of visible behavior, not assertions derived from source configuration. Add separate root and legacy runs with fixed status and location assertions.

Context Used: Call out and harshly judge implementation-coupled tests. We don't mirror source code, configuration, or version pins in assertions. We test observable behavior; use linters for syntax and schema checks. (source)

Prompt To Fix With AI

This is a comment left during a code review. Path: tests/e2e/General/HTTPTest.php Line: 245-246 Comment: This assertion copies the production check for `_APP_CONSOLE_URL_SCHEME`. CI runs this test with `root`, so the legacy redirect is never tested. It also accepts any response without `location`, including a `200` or `500`, even though root mode should return `404`. The repository rule requires fixed checks of visible behavior, not assertions derived from source configuration. Add separate root and legacy runs with fixed status and `location` assertions. **Context Used:** Call out and harshly judge implementation-coupled tests. We don't mirror source code, configuration, or version pins in assertions. We test observable behavior; use linters for syntax and schema checks. ([source](https://app.greptile.com/review/custom-context?memory=instruction-0)) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

github-actions · 2026-09-15T07:06:15Z

✨ Benchmark results

Comparing main (before) → fix/console-redirects-scheme (after).

Metric	Before	After	Change
🚀 Requests/sec	`184.1`	`191.18`	⚪ `+3.8%`
⏱️ Latency P50	`94.8 ms`	`89.34 ms`	🟢 `-5.8%`
⏱️ Latency P95	`220.69 ms`	`214.7 ms`	⚪ `-2.7%`

Per-scenario breakdown & investigation details

Metrics below reflect the current branch (after). Δ P95 compares against the base.

Scenario	P50 (ms)	P95 (ms)	Requests	RPS	Δ P95 (ms)
API total	`89.34`	`214.7`	`12,198`	`191.18`	`-6`
Account	`182.14`	`323.85`	`642`	`10.64`	`-19.05`
TablesDB	`85.82`	`158.83`	`6,634`	`107.28`	`-9.87`
Storage	`81.09`	`182.53`	`3,210`	`53.34`	`+1.24`
Functions	`135.86`	`263.5`	`1,712`	`29.06`	`-7.69`

Top API waits (after)

API request	Max wait (ms)
account.name.update	`533.27`
functions.create	`427.17`
tablesdb.rows.delete	`419.21`
functions.delete	`414.54`
storage.files.update	`408.19`

…-scheme

Drops _APP_CONSOLE_URL_SCHEME and the legacy /console/project-{region}-{id} link shapes. OAuth2 and magic URL defaults, router error CTAs, preview authorization, VCS commit statuses and PR comments, and the paused-webhook email now link to the console root routes on _APP_CONSOLE_URL, which defaults to the console domain over the configured protocol. The webhooks and jobs workers receive the variables the default is derived from.

The console has no git-installations page; Git configuration lives on the project settings page.

/login, /register, /recover and /invite land on /sign-in, /sign-up, /reset and /join on the console URL, while /, /auth/* and /mfa keep their path. The /card redirect is removed since the console has no card page. Requests already on the console host are not redirected, so they cannot loop back through the proxy.

…to fix/console-redirects-scheme

…RL is set The default OAuth2 success and failure URLs are built on the console URL, and the callback validates them against the allowed hostnames. A console served on its own host was missing from that list, so the default redirects were rejected.

Meldiron · 2026-09-15T08:29:47Z

-                'description' => 'Console URL scheme used when the backend generates links to the console (OAuth callbacks, emails, error page CTAs, VCS comments). Set to \'root\' for the new console served at the root path (appwrite/new), or \'legacy\' for the older console served under the /console path prefix. The default value is \'legacy\'.',
-                'introduction' => '2.0.0',
-                'default' => 'legacy',
+                'name' => '_APP_CONSOLE_URL',


Are we 100% certain we need new variable? Can we not reuse some existing one? if so, why not?

Meldiron · 2026-09-15T08:30:15Z

                'filter' => ''
            ],
            [
-                'name' => '_APP_CONSOLE_URL_SCHEME',


Lets check who added this variable, and confirm with them that its OK to remove it with this PR

Meldiron · 2026-09-15T08:32:57Z

Throughout entire PR, we touched MANY flows. Lets QA them manually, to make sure there is no regression, nothing breaks.
If we are not sure what flow a diff is and how to reproduce it, that would be big warning flag. If we dont 100% understand where some change applies, that might be the exact diff we will want to focus our manual QA.

The notifications and webhooks workers now take the console origin from the injected platform config instead of rebuilding it from _APP_CONSOLE_DOMAIN, so email links follow _APP_CONSOLE_URL and per-platform overrides. Rename the VCS comment QR variable since it points at the API host.

The console reset page requires userId and secret, so /recover only lands there when both are present and otherwise opens /recovery.

The default success and failure relays were matched by path alone, so any allowed host serving /auth/oauth2/success received the session key and secret. Match the console host from platform consoleUrl as well.

HarshMN2345 added 3 commits September 15, 2026 12:24

fix(console): register /console web redirects only for the legacy URL…

879f850

… scheme With _APP_CONSOLE_URL_SCHEME=root the console serves /, /auth/*, /card/*, /invite, /login, /mfa, /recover and /register/* at the root, so redirecting them to /console sends users to legacy paths.

chore(console): describe when the /console web redirects are registered

d16e886

The vibes console has no /invite, /login, /recover or /register routes, so the registration comment no longer claims root-scheme consoles serve those paths.

greptile-apps Bot reviewed Sep 15, 2026

View reviewed changes

HarshMN2345 and others added 7 commits September 15, 2026 12:51

Merge branch 'main' into fix/console-redirects-scheme

d097daa

Merge remote-tracking branch 'origin/main' into fix/console-redirects…

9ed2e71

…-scheme

fix(vcs): send redirect-less installation callbacks to project settings

514c9e4

The console has no git-installations page; Git configuration lives on the project settings page.

Merge remote-tracking branch 'origin/fix/console-redirects-scheme' in…

9800cc1

…to fix/console-redirects-scheme

HarshMN2345 changed the title ~~fix(console): gate /console redirects on URL scheme and fix function build CTAs~~ fix(console): link the new console everywhere and drop the legacy /console scheme Sep 15, 2026

Meldiron reviewed Sep 15, 2026

View reviewed changes

Meldiron approved these changes Sep 15, 2026

View reviewed changes

HarshMN2345 and others added 6 commits September 15, 2026 14:20

Merge branch 'main' into fix/console-redirects-scheme

2423bb9

Merge branch 'main' into fix/console-redirects-scheme

db029c3

fix(console): send /recover without a reset token to the recovery form

4ed17e6

The console reset page requires userId and secret, so /recover only lands there when both are present and otherwise opens /recovery.

fix(account): hand OAuth2 session params only to the console's own relay

8788b6b

The default success and failure relays were matched by path alone, so any allowed host serving /auth/oauth2/success received the session key and secret. Match the console host from platform consoleUrl as well.

chore(variables): introduce _APP_CONSOLE_URL in 2.2.1

264f030

HarshMN2345 merged commit 7352b58 into main Sep 15, 2026
46 checks passed

HarshMN2345 mentioned this pull request Sep 15, 2026

test(general): assert web redirects from Appwrite instead of following them #13712

Merged

Navigation Menu

fix(console): link the new console everywhere and drop the legacy /console scheme - #13689

fix(console): link the new console everywhere and drop the legacy /console scheme#13689
HarshMN2345 merged 16 commits into
mainfrom
fix/console-redirects-scheme

HarshMN2345 commented Sep 15, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Sep 15, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Sep 15, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026 •

edited

Loading

Uh oh!

Meldiron Sep 15, 2026

Uh oh!

Meldiron Sep 15, 2026

Uh oh!

Meldiron Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		$location = System::getEnv('_APP_CONSOLE_URL_SCHEME', 'legacy') !== 'root' ? '/console' . $endpoint : null;
		$this->assertEquals($location, $response['headers']['location'] ?? null);

Conversation

HarshMN2345 commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Uh oh!

greptile-apps Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

greptile-apps Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ Benchmark results

Uh oh!

Meldiron Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Meldiron Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Meldiron Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

HarshMN2345 commented Sep 15, 2026 •

edited

Loading

greptile-apps Bot commented Sep 15, 2026 •

edited

Loading

github-actions Bot commented Sep 15, 2026 •

edited

Loading