Fix for base URL config in templated requests

[deanhannigan]

Fix for REST template queries executing against the spec's default server URL and ignoring the REST datasource base url, if it was configured. When saved, the query stored the server[0] value of the available servers on the spec and changing it would have no effect.

• Will still store server[0] on the query as a stable default, however, it will be overridden by the parent datasource config
• QueryRunner now swaps the stored spec base url for config.url at runtime.
• Custom queries are not affected by this. The base url will be served in the UI as normal, but its up to the user to manually update it. In custom mode its surfaced for convenience only.
• Test coverage expanded in the general areas affecting the queries to properly pin down the expectations on the functionality

---

Summary by cubic

Fixes templated REST queries ignoring the datasource base URL by swapping the stored spec server with the resolved datasource config.url at runtime, and shows the resolved URL in the builder. applyBaseUrl is now in @budibase/shared-core and used by both server and builder with improved HBS handling.

• Bug Fixes

  • Template REST queries override the stored spec base with the datasource config.url during execution; HBS in config.url (e.g. static variables) is resolved first and the swap happens before field enrichment.
  • applyBaseUrl preserves path/query/hash and HBS blocks, no-ops when hosts match, strips trailing slashes, handles relative paths, and falls back to the datasource base when the host is an unresolved HBS or the current URL is an origin/empty; used by the server QueryRunner and builder preview.
  • Builder preview/validation show the resolved URL (effectiveUrl); template queries still store servers[0] as a stable default. Custom queries are unchanged.

• Refactors

  • Moved applyBaseUrl to @budibase/shared-core and added tests (shared-core and server).
  • Simplified APIEndpointViewer.svelte URL state (renamed baseUrl to defaultSpecServerUrl), now display effectiveUrl, and ensure the selected endpoint stays in the dropdown even if not in the loaded list.
  • Updated builder tests and removed duplicate applyBaseUrl coverage; added targeted tests for constructFullPath, convertPathVariables, and validateQuery. CustomEndpointInput now uses the shared applyBaseUrl.

^{Written for commit d2f3a75. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 10 files

Confidence score: 3/5

• Template URL rebasing in packages/server/src/threads/query.ts ignores legacy restTemplate, so some templated datasources may still hit stored spec URLs unexpectedly.
• In packages/builder/src/components/integration/APIEndpointViewer.svelte, validateQuery receives only the base/path URL, so forbidden-binding checks for query parameters can be skipped.
• Given multiple medium-severity validation and URL handling gaps, there’s some user-impacting risk, though not necessarily merge-blocking.
• Pay close attention to packages/server/src/threads/query.ts and packages/builder/src/components/integration/APIEndpointViewer.svelte - URL rebasing and validation behavior may be inconsistent.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/server/src/threads/query.ts">

<violation number="1" location="packages/server/src/threads/query.ts:130">
P2: Template URL rebasing only checks `restTemplateId`, so legacy templated datasources with `restTemplate` are skipped and still execute against the stored spec URL.</violation>
</file>

<file name="packages/builder/src/components/integration/APIEndpointViewer.svelte">

<violation number="1" location="packages/builder/src/components/integration/APIEndpointViewer.svelte:194">
P2: defaultSpecServerUrl isn’t reset when switching datasources, so a new datasource without config.url/spec server URL can inherit the previous base URL.</violation>

<violation number="2" location="packages/builder/src/components/integration/APIEndpointViewer.svelte:615">
P2: Early return on empty requestUrl causes silent failure; validation/error notification is skipped when the template base URL is missing and path resolves to "".</violation>

<violation number="3" location="packages/builder/src/components/integration/APIEndpointViewer.svelte:619">
P2: `validateQuery` no longer sees query parameters because it only receives `requestUrl` (path/base). This skips forbidden-binding checks for query params. Pass the fully built URL instead so query params are validated too.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[melohagan]

LGTM! Pulled down locally and can see the custom server url is respected.

Nice tests 🚀