From bdb489201493e6f2fddf6af0a08905550d49c297 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl?= <michael@MacBook-Air-van-Michael.local>
Date: Sat, 28 Feb 2026 00:21:01 -0300
Subject: [PATCH] Backend: add PUBLIC_BASE_PATH for NIP-98 URL behind /api
 proxy

Made-with: Cursor
---
 backend/src/config.ts           | 2 ++
 backend/src/middleware/nip98.ts | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/src/config.ts b/backend/src/config.ts
index 8b3873f..7cdc631 100644
--- a/backend/src/config.ts
+++ b/backend/src/config.ts
@@ -24,6 +24,8 @@ function envBool(key: string, defaultValue: boolean): boolean {
 export const config = {
   port: envInt("PORT", 3001),
   trustProxy: envBool("TRUST_PROXY", false),
+  /** Public path prefix when behind a reverse proxy that strips it (e.g. nginx /api/ -> backend /). */
+  publicBasePath: (process.env.PUBLIC_BASE_PATH ?? "").replace(/\/$/, ""),
   allowedOrigins: (process.env.ALLOWED_ORIGINS ?? process.env.FRONTEND_URL ?? "http://localhost:5173,http://localhost:5174").split(",").map((s) => s.trim()),
 
   // Database: omit DATABASE_URL for SQLite; set for Postgres
diff --git a/backend/src/middleware/nip98.ts b/backend/src/middleware/nip98.ts
index 079ea84..f551b42 100644
--- a/backend/src/middleware/nip98.ts
+++ b/backend/src/middleware/nip98.ts
@@ -83,11 +83,12 @@ export async function nip98Auth(req: Request, res: Response, next: NextFunction)
     return;
   }
 
-  // Reconstruct absolute URL (protocol + host + path + query)
+  // Reconstruct absolute URL (protocol + host + base path + path + query)
   const proto = (req.headers["x-forwarded-proto"] as string | undefined) ?? ((req.socket as { encrypted?: boolean }).encrypted ? "https" : "http");
   const host = (req.headers["x-forwarded-host"] as string | undefined) ?? req.headers.host ?? "";
   const path = req.originalUrl ?? req.url;
-  const absoluteUrl = `${proto}://${host}${path}`;
+  const basePath = config.publicBasePath ? `/${config.publicBasePath.replace(/^\//, "")}` : "";
+  const absoluteUrl = `${proto}://${host}${basePath}${path}`;
   if (u !== absoluteUrl) {
     res.status(401).json({
       code: "invalid_nip98",