fix: return HTML for browser Accept headers on root route (#532)

[Justxd22]

Description

• fix / content negotiation to serve NIP-11 only for explicit application/nostr+json requests
• prevent typical browser Accept headers (e.g. text/html,...,*/*) from being treated as NIP-11 requests
• reuse the same explicit Accept check in router middleware and rootRequestHandler
• add unit coverage for explicit NIP-11, browser Accept header, and q=0
• add integration coverage for browser-style Accept header returning HTML

Related Issue

#532

How Has This Been Tested?

• npm run build:check
• npm run test:unit

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my code changes.
• I added a changeset, or this is docs-only and I added an empty changeset.
• All new and existing tests passed.

[Copilot]

Pull request overview

This PR fixes / content negotiation so NIP-11 relay information is only served when the client explicitly requests application/nostr+json, preventing typical browser Accept headers from receiving JSON.

Changes:

• Replaced accepts-based negotiation with an explicit Accept: application/nostr+json (and q>0) check shared between router middleware and rootRequestHandler.
• Added unit tests for the explicit Accept header detection (including browser-style headers and q=0).
• Added an integration scenario ensuring browser-style Accept headers receive HTML on /.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/unit/handlers/request-handlers/root-request-handler.spec.ts	Adds unit coverage for explicit NIP-11 Accept detection and related root handler behavior.
test/integration/features/nip-11/nip-11.feature.ts	Adds a Cucumber step that simulates a browser-like root request.
test/integration/features/nip-11/nip-11.feature	Adds an integration scenario asserting HTML is served for browser-style Accept headers.
src/routes/index.ts	Switches router middleware to use the explicit Accept-header check instead of accepts.
src/handlers/request-handlers/root-request-handler.ts	Introduces hasExplicitNostrJsonAcceptHeader and uses it for root handler content negotiation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Justxd22]

Ci should pass once #539 is merged

[cameri]

Did you test the fix manually? Also does it work when the relay URL is in a path other than /?

[Justxd22]

@cameri confirmed it breaks under subpath! so We need to edit the html templates remove hardcoded root url and inject settings.info.relay_url to get the sub path

[changeset-bot]

🦋 Changeset detected

Latest commit: 3e4a3a3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

coverage: 64.429% (+0.2%) from 64.19% — Justxd22:fix/532-root-browser-html into cameri:main

[Justxd22]

@cameri ready !

[Justxd22]

@cameri

• HTML links, invoice form actions, and invoice status polling now use a rendered path_prefix.
• path_prefix is derived from settings.info.relay_url by default.
• X-Forwarded-Prefix is only honored when the immediate proxy IP is configured in network.trustedProxies.
• Added regression tests for trusted and untrusted forwarded prefix behavior.

i suggest Changing default network.trustedProxies to [] so forwarded headers are opt-in, not trusted by default.