Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

Docs/adr 0045 split origins #51

Merged
Joey merged 2 commits from docs/adr-0045-split-origins into main 2026-10-03 18:42:41 +00:00
Conversation 2 Commits 2 Files Changed 2
+7 -4
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 55accd0e65 - Show all commits
docs/architecture/decisions/0045-split-dashboard-and-api-origins.md
+7 -4
View File
@@ -181,10 +181,13 @@ host-only session cookie.
Because those are browser behaviors, the split run also drives a **real browser**: a headless
Chromium from an image pinned by digest, controlled over the Chrome DevTools Protocol by the
smoke-test client with no added dependency. In it, a person signs in through the real form on the
Dashboard hostname, the Dashboard loads a module's UI and contribution from the API hostname, the
session cookie is present only for the API hostname, the module's display page mounts on the API
hostname, and sign-out ends the session. The split run installs the repository's module template as
a test-only module so these paths exist; installations' own smoke tests cover their real modules.
Dashboard hostname, the session cookie is present only for the API hostname, the Dashboard imports a
module's UI from the API hostname and the module's own credentialed requests succeed under CORS, no
request is refused, the module's display page mounts on the API hostname with its service worker, and
sign-out ends the session. The split run installs the repository's module template as a test-only
module so these paths exist; installations' own smoke tests cover their real modules. Contribution
artifacts are imported exactly as UI artifacts are, and the API's tests cover their CORS headers and
those of realtime streams.
## Consequences