Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

feat(api): serve the built Dashboard from the API origin #46

Merged
Zayin_Admin merged 1 commits from feat/api-serve-dashboard into main 2026-10-01 23:28:57 +00:00
Conversation 0 Commits 1 Files Changed 32
+1041 -56
Zayin_Admin commented 2026-10-01 23:20:02 +00:00
Owner
Copy Link
Copy Source

Serve surfaces/shell's built Dashboard from apps/api on the same origin
as /api (ADR 0044), exactly as the display host is served: a closed set
of files read once at startup, never a static directory, never a path
built from request input.

  • The shell exports @ekklesia/shell/dashboard-assets (the exact built
    index.html and script URLs), emits the script at
    assets/ekklesia-dashboard/app.js, and index.html names that absolute
    path so dev and production serve the same URLs.
  • GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen
    snapshot: no-cache with a strong ETag and 304 on match. Source maps
    are never served; every other path is the ordinary sanitized 404.
  • The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy:
    frame-ancestors 'none' (that directive only), and Referrer-Policy:
    no-referrer, on 200 and 304 alike.
  • A missing or empty shell build fails startup with a fixed
    DashboardHostAssetError before any module code is imported.
  • The If-None-Match comparison moves to conditional-request.ts, shared
    with the display host routes.
  • The emailed-link token stripping moves from browser/main.tsx into
    consumeAuthLanding (location and history injected) so it is tested;
    behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 [email protected]

Serve surfaces/shell's built Dashboard from apps/api on the same origin as /api (ADR 0044), exactly as the display host is served: a closed set of files read once at startup, never a static directory, never a path built from request input. - The shell exports @ekklesia/shell/dashboard-assets (the exact built index.html and script URLs), emits the script at assets/ekklesia-dashboard/app.js, and index.html names that absolute path so dev and production serve the same URLs. - GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen snapshot: no-cache with a strong ETag and 304 on match. Source maps are never served; every other path is the ordinary sanitized 404. - The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy: frame-ancestors 'none' (that directive only), and Referrer-Policy: no-referrer, on 200 and 304 alike. - A missing or empty shell build fails startup with a fixed DashboardHostAssetError before any module code is imported. - The If-None-Match comparison moves to conditional-request.ts, shared with the display host routes. - The emailed-link token stripping moves from browser/main.tsx into consumeAuthLanding (location and history injected) so it is tested; behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Zayin_Admin added 1 commit 2026-10-01 23:20:02 +00:00
feat(api): serve the built Dashboard from the API origin
CI / verify (pull_request) Successful in 46s
Details
CI / infrastructure-smoke (pull_request) Successful in 12s
Details
CI / migration-smoke (pull_request) Successful in 1m44s
Details
a12cbe9600 
Serve surfaces/shell's built Dashboard from apps/api on the same origin
as /api (ADR 0044), exactly as the display host is served: a closed set
of files read once at startup, never a static directory, never a path
built from request input.

- The shell exports @ekklesia/shell/dashboard-assets (the exact built
  index.html and script URLs), emits the script at
  assets/ekklesia-dashboard/app.js, and index.html names that absolute
  path so dev and production serve the same URLs.
- GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen
  snapshot: no-cache with a strong ETag and 304 on match. Source maps
  are never served; every other path is the ordinary sanitized 404.
- The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy:
  frame-ancestors 'none' (that directive only), and Referrer-Policy:
  no-referrer, on 200 and 304 alike.
- A missing or empty shell build fails startup with a fixed
  DashboardHostAssetError before any module code is imported.
- The If-None-Match comparison moves to conditional-request.ts, shared
  with the display host routes.
- The emailed-link token stripping moves from browser/main.tsx into
  consumeAuthLanding (location and history injected) so it is tested;
  behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Zayin_Admin merged commit d5d4928b9f into main 2026-10-01 23:28:57 +00:00
Zayin_Admin deleted branch feat/api-serve-dashboard 2026-10-01 23:28:57 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Joey Zayin_Admin ekklesia-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#46