From 0a79108c053ed8e919e9a07e616234eb5eebab7c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 14 Jan 2026 17:19:14 +0000
Subject: [PATCH] fix(r2): validate baseDomain to reject S3 API endpoints

Updated `r2Service.js` to detect if the user inputs an S3 API endpoint (e.g. `*.r2.cloudflarestorage.com`) as the Public Bucket URL. If detected, it prevents saving and displays a clear error message instructing the user to use the correct public domain (e.g. `*.r2.dev`). This prevents CORS errors and confusion caused by using the wrong endpoint type.
---
 js/services/r2Service.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/js/services/r2Service.js b/js/services/r2Service.js
index b0cfd168..429e0aa1 100644
--- a/js/services/r2Service.js
+++ b/js/services/r2Service.js
@@ -220,6 +220,16 @@ class R2Service {
     const secretAccessKey = String(formValues.secretAccessKey || "").trim();
     const baseDomain = sanitizeBaseDomain(formValues.baseDomain || ""); // This is the Public Bucket URL
 
+    if (baseDomain.includes(".r2.cloudflarestorage.com")) {
+      if (!quiet) {
+        this.setCloudflareSettingsStatus(
+          "It looks like you entered the S3 API URL. Please use your Public Bucket URL (e.g. https://pub-xxx.r2.dev or your custom domain).",
+          "error"
+        );
+      }
+      return false;
+    }
+
     if (!accountId || !accessKeyId || !secretAccessKey) {
       if (!quiet) {
         this.setCloudflareSettingsStatus(