[APPS] Fix dev backend query API origin

[sdkennedy2]

Motivation

Running a high-code app dev server with the default dd-auth --actions-api -- npm run dev wrapper currently gives the dev middleware credentials for DD_SITE=datadoghq.com. Backend function execution then sends preview-async requests to https://datadoghq.com/api/v2/app-builder/queries/preview-async, which CloudFront rejects because the bare site is not an API origin for POST requests.

Changes

Normalize app-builder query execution URLs in the apps dev-server middleware before calling Datadog. Raw Datadog sites like datadoghq.com, staging sites like datad0g.com, and regional sites like us5.datadoghq.com now resolve to their api.* origin. Explicit api.* values are preserved, and app.* values are converted to the corresponding api.* origin.

This affects only local dev backend-function execution through /__dd/executeAction; production iframe execution and asset upload behavior are unchanged.

QA Instructions

• ~/.yarn/switch/bin/yarn workspace @dd/apps-plugin typecheck
• ~/.yarn/switch/bin/yarn eslint packages/plugins/apps/src/vite/dev-server.ts packages/plugins/apps/src/vite/dev-server.test.ts
• ~/.yarn/switch/bin/yarn workspace @dd/tests test:unit packages/plugins/apps/src/vite/dev-server.test.ts --runInBand
• Locally linked @datadog/vite-plugin into /Users/scott.kennedy/dd/test-apps/testapp-may-7, rebuilt it, and verified dd-auth --actions-api -- npm run dev can execute a backend listHosts function. The dev log now calls https://api.datadoghq.com/api/v2/app-builder/queries/preview-async and the local /__dd/executeAction request returns 200.

Blast Radius

This changes the API origin used by high-code app local dev-server backend function execution. The risk is limited to local development requests that proxy backend functions through Datadog's app-builder query APIs.

Documentation

• How to reliably make frontend production changes
• PR Description Guidelines
• Deploy steps

[sdkennedy2]

• [APPS] Fix dev backend query API origin #347 👈 (View in Graphite)
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".