187 Commits

Author	SHA1	Message	Date
lilleman	18e1a8d29d	Keep the chrome lazy for error pages, guard the guard-error render, split the recovery link	2026-08-04 00:31:19 +02:00
lilleman	be3bc2bdbb	Stability fixes: plugin-scoped contexts for owned pages, absent-href guard, checked locale mounts	2026-08-03 23:51:40 +02:00
lilleman	2b20497785	Pin the chrome's locale carrying in unit tests; keep one carrier list	2026-08-03 23:25:54 +02:00
lilleman	b3df7084c4	Reserve the locale param, carry it on breadcrumbs, translate the permissions detail view	2026-08-03 23:21:38 +02:00
lilleman	6440c543e5	Architecture review fixes: partials carry the locale, mountable locales/, shared core words	2026-08-03 23:12:18 +02:00
lilleman	245d1ad5b5	Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples	2026-08-03 22:37:27 +02:00
lilleman	c30cd95ebd	Fix a stale ctx.identity reference in the file map	2026-08-03 17:41:40 +02:00
lilleman	f38b5373bd	Say user throughout, noting Ory's identity naming in the docs	2026-08-03 17:41:40 +02:00
lilleman	096720904e	Rename the coarse gate from role to permission, matching RBAC	2026-08-03 17:41:40 +02:00
lilleman	04fe5b1e06	Cut the security-model threat table down to what the code cannot show	2026-08-03 17:41:40 +02:00
lilleman	3486e0ad00	Rename the Keto User namespace to Identity, matching Kratos	2026-08-03 17:41:40 +02:00
lilleman	8f9f79ac30	Document the users, groups and roles model in README	2026-08-03 17:41:40 +02:00
lilleman	f0662cbd0f	Reflow the security-model prose to the file's wrap width	2026-08-03 17:41:40 +02:00
lilleman	73a78d4404	Add the seeded admin login to the production secrets checklist	2026-08-03 17:41:40 +02:00
lilleman	5a5803b265	Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test	2026-08-03 17:41:40 +02:00
lilleman	a2204782fa	Review fixes: re-mint path, real session lifetime, full secret checklist	2026-08-03 17:41:40 +02:00
lilleman	eb5aafdfaa	Document the auth security model in README	2026-08-03 17:41:40 +02:00
lilleman	0919adf4ef	Review fixes: plain depends_on merge, positive secret assertion	2026-08-02 16:10:35 +02:00
lilleman	f5f4455b81	Browser E2E for the admin OAuth2-clients screen	2026-08-02 16:03:30 +02:00
lilleman	3f30f889c3	README: note GITHUB_ secret-name prefix is rejected too	2026-08-02 15:48:04 +02:00
lilleman	ae1479f55b	Renovate: set GITHUB_COM_TOKEN for authenticated github.com lookups	2026-08-02 15:43:38 +02:00
lilleman	6db0f57bf4	Trim README and workflow prose that restates the code	2026-08-02 13:55:50 +02:00
lilleman	175717f04d	Move the docs-only decision into ci.sh so it runs locally	2026-08-02 13:38:32 +02:00
lilleman	6c850b8923	Skip the test gate on docs-only branches	2026-08-02 13:31:07 +02:00
lilleman	145db5b4cd	CI: auto-release a version tag when Renovate merges a dependency update	2026-07-05 20:49:49 +02:00
lilleman	67d8a095a5	CI: Renovate for gated, self-hosted dependency updates	2026-07-04 21:51:04 +02:00
lilleman	93fa751d6d	Add README-dockerhub.md - the hand-maintained Docker Hub repo description	2026-07-04 17:37:02 +02:00
lilleman	cc886936ed	CI: sync release images to Docker Hub on vX.Y.Z tag push	2026-07-04 17:08:31 +02:00
lilleman	e3e582afef	README: document the one-time org-package-to-repo link for the Packages tab	2026-07-04 09:39:10 +02:00
lilleman	0644ec8f5a	CI: nightly registry cleanup - prune hash images not release-tagged nor a branch head	2026-07-04 09:18:07 +02:00
lilleman	058280934b	CI: re-tag the gated image as semver + latest on vX.Y.Z tag push	2026-07-04 08:35:48 +02:00
lilleman	50006dd1a7	CI: gate builds + pushes app image to Gitea registry tagged with the commit hash	2026-07-03 16:50:37 +02:00
lilleman	6e60df7008	CI: mirror main + tags to GitHub after every merge to main; note true home in README	2026-07-03 15:47:56 +02:00
lilleman	7a3161d3ff	README: document the merge gate on main (PR-only, required CI, fast-forward-only); check off todo	2026-07-03 14:50:54 +02:00
lilleman	94654a2adc	CI: Gitea Actions runs the full gate (ci.sh) on push to any branch except main; document runner setup	2026-07-02 14:24:19 +02:00
lilleman	535902e69b	Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts	2026-07-02 13:05:54 +02:00
lilleman	e8ea911b80	Move admin screens (users/groups/roles/oauth2-clients) into a drop-in example plugin; add the ctx.system capability surface	2026-07-02 08:01:15 +02:00
lilleman	2202bdbaa0	config/ becomes an empty drop-in mount; examples/ mirrors the mount dirs; plugins & config import the host via #plugin-api/#menu-config subpath imports	2026-07-01 23:19:48 +02:00
lilleman	4adf14f386	docs: restructure README around the plugin-author path, add examples/README, genericize the plugin walkthrough	2026-06-30 23:30:13 +02:00
lilleman	fe97c3854a	Move reference plugin to examples/scheduling-plugin; plugins/ ships empty as a drop-in mount point, e2e bind-mounts the example	2026-06-27 00:02:26 +02:00
lilleman	d8cf257940	Move plugin-contract.md into README's Building plugins section; remove docs/, repoint all references	2026-06-26 23:12:40 +02:00
lilleman	de22f51c12	Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout	2026-06-24 00:23:55 +02:00
lilleman	6d316c4888	Drop .mjs: rename e2e/dev mock servers to .ts, update refs, document the convention in AGENTS.md	2026-06-23 23:54:42 +02:00
lilleman	913bd6813a	Consolidate E2E into e2e-tests/ (Dockerfile + compose.{visual,auth,oauth,full,devstack}.yml, WORKDIR /e2e-tests); move ci.sh to repo root	2026-06-23 23:48:05 +02:00
lilleman	bb612baa2c	Reorganize README for two readers: first-run Quick start + nested ToC, overview-first ordering; document the convention in AGENTS.md	2026-06-23 23:15:24 +02:00
lilleman	a9f25a7692	Remove completed todo.md + html-css-foundation mockups; strip dead §N phase refs from comments/docs (simplify visual E2E to drop the mockup-comparison oracle)	2026-06-23 22:49:28 +02:00
lilleman	e22d24aa8a	§10 - one menu everywhere (buildPluginChrome) + shell on every page; instructional starter dashboard; Kratos-native email docs ... Collapse the three nav builders into buildPluginChrome: chrome.bestHref does longest-prefix matching so deep admin routes mark their leaf. Delete adminNav; buildConfirmModel and the admin model builders take the resolved nav. The same role-filtered sidebar now renders signed in or out, collapsing to a burger on narrow screens. shell.ejs gains menu (default true; menu:false -> single-column .app-bare), docTitle (separate <title> from the topbar, so the body keeps the single <h1>), and hideSignIn (suppress the footer Sign-in on auth pages to avoid a login loop). auth/home/landing now render inside the shell. Dashboard is a replaceable instructional starter (definePlugin snippet, no mock data). Email stays delegated to Kratos: documented its built-in courier.template_override_path instead of adding web-side SMTP.	2026-06-23 21:26:00 +02:00
lilleman	1d198acc97	Canonical host via APP_URL: stop login dumping users on /error from a host mismatch ... The from-scratch dev login was broken: open the banner's http://localhost:3000, sign in as the seeded admin, and you landed on http://127.0.0.1:3000/error "Page not found". Root cause: the banner/APP_URL said localhost but kratos.yml hard-coded 127.0.0.1, and a host-scoped Kratos CSRF cookie can't cross localhost<->127.0.0.1, so the cross-host login POST lost it; Kratos redirected to its error sink, which the app had no route for (404). Make APP_URL the single source of truth for the public host: - Canonical-host redirect (app.ts): when APP_URL is set, an off-host GET/HEAD visitor is 308'd to it (path+query kept) before a flow starts, so the browser, the themed forms and the cross-origin Kratos POST share one cookie host. After /public/ so static/health checks stay host-agnostic; GET/HEAD only so a 308 never replays a cross-host POST. - Opt-in (no NODE_ENV / no magic default): unset => no redirect, so a prod deploy that forgets APP_URL can't bounce real users to a stale default. The dev stack sets it. - kratos.yml browser URLs default to localhost (match APP_URL's dev value) and derive from ${APP_URL} via compose.override.yml; SERVE_PUBLIC_BASE_URL keeps the dev Ory port. - Real /error page (views/error.ejs) replaces the catch-all 404 for genuine flow errors. Tests-first: config (opt-in/validated), app (308 on mismatch, no-redirect on match, static host-agnostic, POST untouched, /error page), updated kratos.test host pins. New devstack regression (e2e/devstack-login.spec + compose.e2e-devstack.yml) drives the plain docker-compose-up topology on the host network: login from localhost works and 127.0.0.1 is canonicalised; wired into scripts/ci.sh. typecheck + 360 units + full ci.sh (visual 10 · auth 1 · oauth 2 · full 7 · devstack 2) green.	2026-06-21 21:52:20 +02:00
lilleman	7bdeb24b7f	§10 public pages + menu items, the blessed explicit alias (todo §10); a plugin may mark a page and its menu option public. A no-permission route/nav node is already anonymous-reachable, so per the human's pick this BLESSES that as a first-class, explicit choice (keep the default; add an explicit alias — not a secure-by-default flip). New optional public?: boolean on Route (src/plugin.ts) + NavNode (src/nav.ts) = "open to everyone, signed in or not", honored outright in isAuthorized (router.ts) + filterByRoles (nav.ts), and MUTUALLY EXCLUSIVE with permission — discovery shapeError recursively rejects a route/nav node setting both, failing the boot loud (never silently picks one). public is filter-only (toRenderNode never emits it). The shell (views/partials/shell.ejs) now renders a Sign in link instead of the profile/sign-out block for an anonymous visitor, so a public page in the native shell (ctx.chrome; ctx.user may be null) isn't a broken "Guest / Sign out". Reference plugin demos it: a public /scheduling Overview route + a public "Overview" nav child (the "Scheduling" header now shows for everyone), the shifts list still behind scheduling:read. Hardened the latent gap the shell newly leans on: claimsToUser rejects an empty email like it does an empty sub. Tests-first (348 → 354 units): router/nav/discovery (public open + reject-both + loads), shell (anon → Sign in, no logout form), app (public route anon-200), shifts (overview handler), jwt-middleware (empty email). Docs: plugin-contract.md ("Public pages & menu items" + route shape + shape-error note) + README (menu system + reference snippet). E2E: visual.spec asserts the public Overview is anon-200 + shown in the member's nav while the gated Shifts redirects/filters. stability-reviewer: APPROVE, no Critical/High/Medium (addressed its one Low — the empty-email hardening). typecheck + 354 units + full scripts/ci.sh gate (visual 10 · auth 1 · oauth 2 · full 7) green.	2026-06-20 18:12:46 +02:00
lilleman	7787ed4ea4	§10 split landing into a public "/" + gated "/dashboard", both plugin-replaceable (todo §10 follow-up); per human feedback, "/" is now an ungated public landing (default views/home.ejs: brand + intro + prominent Log in / Create account links, or "go to dashboard" when signed in) and "/dashboard" is the gated post-login app home (anonymous → /login?return_to=/dashboard). Both are fully replaceable via two optional RouteHandlers on PluginManifest — home? (public /) and dashboard? (gated /dashboard) — rendered against the plugin's own views with the native shell via ctx.chrome (full route parity: HEAD, void-return, response hooks, fresh CSRF cookie; a home handler is public so ctx.user may be null). Single-slot + loud: findConflicts errors on >1 owner of either slot (new "home"/"dashboard" kinds), discovery rejects a non-function handler, and "dashboard" is reserved so a plugin folder can't shadow it ("/" can't be shadowed — route paths carry the /<id> prefix). Post-login + already-signed-in redirects and the global Dashboard/People nav hrefs moved to /dashboard. Tests-first (348 units): public-/ + gated-/dashboard + dual plugin-override in app.test; per-slot conflict in plugin.test; non-function/reserved/two-owners in discovery.test. Docs: plugin-contract "The landing pages" section + README. E2E: visual.spec plants a session for /dashboard design-system tests + a cookie-free public-landing test; full-flow repointed to /dashboard. stability-reviewer: APPROVE, no Critical/High/Medium. typecheck + 348 units + visual(10) + full-flow(7) green.	2026-06-20 17:43:01 +02:00