10 Commits

Author	SHA1	Message	Date
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent	2026-09-02 18:24:56 +02:00
lilleman	6a0d11d9d3	Name exactly one gate on every declaration, and own a shift by identity id	2026-09-02 14:00:04 +02:00
lilleman	5d1e8f2309	Say the gate rule once, and key the example's shifts by the identifier it scopes on	2026-09-02 08:50:44 +02:00
lilleman	a17ed96b54	Say gate where the code now gates, in the two contracts that still said permission	2026-09-02 08:17:10 +02:00
lilleman	c7e6d66750	Scope My shifts at the upstream, and give Route and NavNode one gate declaration	2026-09-02 08:15:08 +02:00
lilleman	fa7cad1d65	Declare plugin settings in the manifest, resolve them from the environment	2026-08-23 13:17:03 +02:00
lilleman	2202bdbaa0	config/ becomes an empty drop-in mount; examples/ mirrors the mount dirs; plugins & config import the host via #plugin-api/#menu-config subpath imports	2026-07-01 23:19:48 +02:00
lilleman	fe97c3854a	Move reference plugin to examples/scheduling-plugin; plugins/ ships empty as a drop-in mount point, e2e bind-mounts the example	2026-06-27 00:02:26 +02:00
lilleman	6d316c4888	Drop .mjs: rename e2e/dev mock servers to .ts, update refs, document the convention in AGENTS.md	2026-06-23 23:54:42 +02:00
lilleman	f189f88942	§7 reference plugin (todo §7); plugins/scheduling is the worked example of the plugin contract — a list page fetching upstream data, a CSRF-guarded form forwarding writes upstream, permission-gated nav. shifts.ts: an injectable-fetch upstream REST client (stateless stand-in for the customer backend) + thin handler factories (list filters by ?q + degrades to a recoverable page on upstream-down; create CSRF-guards via ctx.verifyCsrf, validates, forwards, PRG, 502 on upstream 4xx). plugin.ts: apiVersion literal, namespaced scheduling:read/write perms, nav gated so the whole Scheduling header vanishes for non-holders. Views compose the core building blocks around the native app shell, incl. the plugin's own partials/shift-form. New host capability so a plugin page is native + secure (src/chrome.ts buildPluginChrome): ctx.chrome = brand/global-nav/user/theme/csrf for partials/shell (global menu = Dashboard + every plugin nav fragment + gated admin section, role-filtered + current-marked); ctx.verifyCsrf = the host's bound double-submit verifier (secret stays in the host). Both added to RequestContext (defaulted in buildContext), built per plugin route in app.ts (CSRF cookie set when fresh). Dashboard merges plugin nav fragments too (gated => invisible to anonymous, visual E2E byte-identical). Out of the box: bootstrap grants the demo admin scheduling:read/write (seedAdmin generalized to a roles list, env ADMIN_ROLES); dev compose runs a tiny stdlib mock upstream (examples/shifts-upstream, SCHEDULING_UPSTREAM). plugins/ added to tsconfig + the npm test glob. Tests-first across shifts/chrome/app/dashboard/bootstrap. README Building-a-plugin + Layout and docs/plugin-contract.md (ctx.chrome/verifyCsrf, upstream pattern) updated. typecheck + 296 units + the Ory-free visual E2E green (plugin discovered at boot, routes/nav gated, dashboard unchanged); live full-stack boot-verified (stack up with plugin + mock upstream serving the seeded shifts, bootstrap grants in real Keto all allowed:true) then torn down. apiVersion stays 1.0.0 (contract still assembled in §7). Authenticated browser happy-path deferred to §8 full E2E (line 114).	2026-06-19 14:48:27 +02:00