ekklesiaandClaude Opus 5.5
a12cbe9600
Serve surfaces/shell's built Dashboard from apps/api on the same origin as /api (ADR 0044), exactly as the display host is served: a closed set of files read once at startup, never a static directory, never a path built from request input. - The shell exports @ekklesia/shell/dashboard-assets (the exact built index.html and script URLs), emits the script at assets/ekklesia-dashboard/app.js, and index.html names that absolute path so dev and production serve the same URLs. - GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen snapshot: no-cache with a strong ETag and 304 on match. Source maps are never served; every other path is the ordinary sanitized 404. - The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy: frame-ancestors 'none' (that directive only), and Referrer-Policy: no-referrer, on 200 and 304 alike. - A missing or empty shell build fails startup with a fixed DashboardHostAssetError before any module code is imported. - The If-None-Match comparison moves to conditional-request.ts, shared with the display host routes. - The emailed-link token stripping moves from browser/main.tsx into consumeAuthLanding (location and history injected) so it is tested; behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
56 lines
2.2 KiB
TypeScript
56 lines
2.2 KiB
TypeScript
// @vitest-environment node
|
|
import { readFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, expect, it } from "vitest";
|
|
import { dashboardHostAssetUrls } from "../src/dashboard-assets.js";
|
|
|
|
const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
|
|
|
|
describe("Dashboard host asset locator", () => {
|
|
it("exports only frozen immutable href strings for the two exact built files, never the source map", () => {
|
|
expect(Object.isFrozen(dashboardHostAssetUrls)).toBe(true);
|
|
expect(dashboardHostAssetUrls).toEqual({
|
|
html: new URL("dist/browser/index.html", `file://${packageDirectory}/`).href,
|
|
script: new URL(
|
|
"dist/browser/assets/ekklesia-dashboard/app.js",
|
|
`file://${packageDirectory}/`,
|
|
).href,
|
|
});
|
|
expect(JSON.stringify(dashboardHostAssetUrls)).not.toContain(".map");
|
|
});
|
|
|
|
it("publishes the locator through a narrow package subpath, not the shell root barrel", async () => {
|
|
const manifest = JSON.parse(
|
|
await readFile(path.join(packageDirectory, "package.json"), "utf8"),
|
|
) as { exports?: Record<string, unknown> };
|
|
expect(manifest.exports?.["./dashboard-assets"]).toEqual({
|
|
import: "./dist/dashboard-assets.js",
|
|
types: "./dist/dashboard-assets.d.ts",
|
|
});
|
|
|
|
const rootSource = await readFile(path.join(packageDirectory, "src/index.ts"), "utf8");
|
|
expect(rootSource).not.toContain("dashboardHostAssetUrls");
|
|
expect(rootSource).not.toContain("dashboard-assets");
|
|
});
|
|
|
|
it("loads exactly one fixed, absolute, same-origin script and no inline script", async () => {
|
|
const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
|
|
|
|
expect(html).toContain('id="ekklesia-host"');
|
|
expect(html.match(/<script\b/gu)).toHaveLength(1);
|
|
expect(html).toContain(
|
|
'<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
|
|
);
|
|
});
|
|
|
|
it("builds the Dashboard entry at the exact path the locator names", async () => {
|
|
const buildScript = await readFile(
|
|
path.join(packageDirectory, "scripts/build-browser.mjs"),
|
|
"utf8",
|
|
);
|
|
|
|
expect(buildScript).toContain('"assets/ekklesia-dashboard/app": path.join(');
|
|
});
|
|
});
|