fix(ee): follow HTTP→HTTPS redirects in forward_to_control_plane

[nmgarza5]

Description

forward_to_control_plane in proxy.py and _make_billing_request in service.py both use httpx.AsyncClient which does not follow redirects by default (unlike requests). The control plane's nginx returns a 308 HTTP→HTTPS permanent redirect, causing these requests to fail with "Control plane request failed". Adding follow_redirects=True to both fixes this.

Why this only affects production

Locally, the control plane runs directly on http://localhost with no nginx in front, so there is no HTTP→HTTPS redirect. In production, nginx sits in front of the control plane and forces http:// → https://, producing the 308 that httpx refuses to follow. Every other code path that talks to the control plane uses the requests library, which follows redirects by default — forward_to_control_plane and _make_billing_request are the only ones using httpx.

How Has This Been Tested?

Unit tests added for both proxy.py and service.py verifying AsyncClient is constructed with follow_redirects=True. Needs deployment to cloud DP to verify end-to-end.

Additional Options

• [Required] I have considered whether this PR needs to be cherry-picked to the latest beta branch.
• [Optional] Override Linear Check

[cubic-dev-ai]

No issues found across 2 files

[greptile-apps]

Greptile Overview

Greptile Summary

Fixes proxy requests failing when control plane sits behind nginx with HTTP→HTTPS redirect. httpx.AsyncClient doesn't follow redirects by default (unlike requests), so control plane's 308 redirect caused all proxy requests to fail with "Control plane request failed". Adding follow_redirects=True resolves this.

• Added follow_redirects=True parameter to httpx.AsyncClient in forward_to_control_plane
• Added unit test verifying the client is constructed with the flag enabled
• No breaking changes, purely additive fix

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• Simple one-parameter fix to enable redirect following in httpx client. The change is well-understood (httpx defaults differ from requests library), properly tested with a unit test, and matches the documented behavior of httpx. No logic changes, no security implications.
• No files require special attention

Important Files Changed

Filename	Overview
backend/ee/onyx/server/tenants/proxy.py	Added follow_redirects=True to httpx.AsyncClient to handle control plane HTTP→HTTPS redirects
backend/tests/unit/ee/onyx/server/tenants/test_proxy.py	Added unit test verifying AsyncClient is instantiated with follow_redirects=True

Sequence Diagram

sequenceDiagram
    participant SH as Self-Hosted Instance
    participant DP as Cloud Data Plane<br/>(proxy.py)
    participant NG as Nginx<br/>(HTTP→HTTPS)
    participant CP as Control Plane

    SH->>DP: POST /proxy/create-checkout-session<br/>(with license Bearer token)
    DP->>DP: Verify license signature
    DP->>NG: POST http://control.example.com/create-checkout-session<br/>(with JWT token)
    Note over NG: Returns 308 Permanent Redirect<br/>Location: https://control.example.com/...
    NG-->>DP: 308 Redirect
    Note over DP: httpx.AsyncClient with<br/>follow_redirects=True
    DP->>CP: POST https://control.example.com/create-checkout-session<br/>(follows redirect automatically)
    CP-->>DP: 200 OK {url: "stripe.com/..."}
    DP-->>SH: 200 OK {url: "stripe.com/..."}

Loading

[justin-tahara]

Glad it was something simple