ekklesiaandClaude Opus 5.5
a12cbe9600
Serve surfaces/shell's built Dashboard from apps/api on the same origin as /api (ADR 0044), exactly as the display host is served: a closed set of files read once at startup, never a static directory, never a path built from request input. - The shell exports @ekklesia/shell/dashboard-assets (the exact built index.html and script URLs), emits the script at assets/ekklesia-dashboard/app.js, and index.html names that absolute path so dev and production serve the same URLs. - GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen snapshot: no-cache with a strong ETag and 304 on match. Source maps are never served; every other path is the ordinary sanitized 404. - The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy: frame-ancestors 'none' (that directive only), and Referrer-Policy: no-referrer, on 200 and 304 alike. - A missing or empty shell build fails startup with a fixed DashboardHostAssetError before any module code is imported. - The If-None-Match comparison moves to conditional-request.ts, shared with the display host routes. - The emailed-link token stripping moves from browser/main.tsx into consumeAuthLanding (location and history injected) so it is tested; behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
20 lines
1002 B
HTML
20 lines
1002 B
HTML
<!doctype html>
|
|
<html lang="en" style="min-width: 0; scrollbar-gutter: stable">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta content="width=device-width, initial-scale=1" name="viewport" />
|
|
<title>Ekklesia</title>
|
|
</head>
|
|
<body style="margin: 0; min-width: 0">
|
|
<!-- The shell's root. A module UI never receives this element: it is given a container the
|
|
shell creates inside its own layout. -->
|
|
<div id="ekklesia-host"></div>
|
|
<!-- A real module script, from the same origin, with no inline script anywhere on the page:
|
|
a deployment can therefore apply a strict script-src without exceptions, and the runtime
|
|
`import()` of a published module artifact stays same-origin under it. The path is absolute
|
|
and fixed, exactly like the display host's, so it names one host-owned route rather than a
|
|
file relative to whatever URL served the page. -->
|
|
<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>
|
|
</body>
|
|
</html>
|