Allow running backend on prefixed url (#1495)

Author: evroon

Dockerfile

@@ -7,7 +7,9 @@ ENV NODE_ENV=production
 
 COPY frontend .
 
-RUN corepack enable && CI=true pnpm install && pnpm build
+RUN corepack enable && \
+    CI=true pnpm install && \
+    VITE_API_BASE_URL=http://localhost:8400/api pnpm build
 
 # Build backend image that also serves frontend (stored in `/app/frontend-dist`)
 FROM python:3.14-alpine3.22

backend/bracket/app.py

@@ -152,18 +152,22 @@ async def generic_exception_handler(request: Request, exc: Exception) -> JSONRes
     return JSONResponse({"detail": "Internal server error"}, status_code=500)
 
 
-app.mount("/static", StaticFiles(directory="static"), name="static")
+app.mount(f"{config.api_prefix}/static", StaticFiles(directory="static"), name="static")
 
 for tag, router in routers.items():
+    assert router.prefix == config.api_prefix, f"Prefix not set on router with tag `{tag}`"
     app.include_router(router, tags=[tag])
 
 if config.serve_frontend:
-    frontend_root = Path("frontend-dist").resolve()
+    msg = "API_PREFIX env var must be set (e.g. `/api`) when serving the frontend"
+    assert config.api_prefix.startswith("/"), msg
+
+    frontend_root = Path("frontend-dist")
     allowed_paths = list(glob.iglob("frontend-dist/**/*", recursive=True))
 
     @app.get("/{full_path:path}")
     async def frontend(full_path: str) -> FileResponse:
-        path = (frontend_root / Path(full_path)).resolve()
+        path = frontend_root / Path(full_path)
 
         # Checking `str(path) in allowed_paths` should be enough here but we check for more cases
         # to be sure and avoid AI tools raising false positives.

backend/bracket/config.py

@@ -41,6 +41,7 @@ class Config(BaseSettings):
     pg_dsn: PostgresDsn = PostgresDsn("postgresql://user:pass@localhost:5432/db")
     sentry_dsn: str | None = None
     serve_frontend: bool = False
+    api_prefix: str = ""
 
     def is_cors_enabled(self) -> bool:
         return self.cors_origins != "*"

backend/bracket/routes/auth.py

@@ -20,7 +20,7 @@
 from bracket.utils.security import verify_password
 from bracket.utils.types import assert_some
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 7 * 24 * 60  # 1 week

backend/bracket/routes/clubs.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends
 
+from bracket.config import config
 from bracket.logic.subscriptions import check_requirement
 from bracket.models.db.club import ClubCreateBody, ClubUpdateBody
 from bracket.models.db.user import UserPublic
@@ -9,7 +10,7 @@
 from bracket.utils.errors import ForeignKey, check_foreign_key_violation
 from bracket.utils.id_types import ClubId
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get("/clubs", response_model=ClubsResponse)

backend/bracket/routes/courts.py

@@ -2,6 +2,7 @@
 from heliclockter import datetime_utc
 from starlette import status
 
+from bracket.config import config
 from bracket.database import database
 from bracket.logic.subscriptions import check_requirement
 from bracket.models.db.court import Court, CourtBody, CourtToInsert
@@ -20,7 +21,7 @@
 from bracket.utils.id_types import CourtId, TournamentId
 from bracket.utils.types import assert_some
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get("/tournaments/{tournament_id}/courts", response_model=CourtsResponse)

backend/bracket/routes/internals.py

@@ -1,9 +1,10 @@
 from fastapi import APIRouter
 from fastapi.responses import PlainTextResponse
 
+from bracket.config import config
 from bracket.models.metrics import get_request_metrics
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get("/metrics", response_class=PlainTextResponse)

backend/bracket/routes/matches.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from starlette import status
 
+from bracket.config import config
 from bracket.logic.planning.conflicts import handle_conflicts
 from bracket.logic.planning.matches import (
     get_scheduled_matches,
@@ -40,7 +41,7 @@
 from bracket.utils.id_types import MatchId, StageItemId, TournamentId
 from bracket.utils.types import assert_some
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get(

backend/bracket/routes/players.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends
 
+from bracket.config import config
 from bracket.database import database
 from bracket.logic.subscriptions import check_requirement
 from bracket.models.db.player import Player, PlayerBody, PlayerMultiBody
@@ -25,7 +26,7 @@
 from bracket.utils.pagination import PaginationPlayers
 from bracket.utils.types import assert_some
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get("/tournaments/{tournament_id}/players", response_model=PlayersResponse)

backend/bracket/routes/rankings.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends
 
+from bracket.config import config
 from bracket.logic.ranking.calculation import recalculate_ranking_for_stage_item
 from bracket.logic.ranking.elimination import (
     update_inputs_in_complete_elimination_stage_item,
@@ -28,7 +29,7 @@
 from bracket.sql.stage_items import get_stage_item
 from bracket.utils.id_types import RankingId, TournamentId
 
-router = APIRouter()
+router = APIRouter(prefix=config.api_prefix)
 
 
 @router.get("/tournaments/{tournament_id}/rankings")