ekklesiaandClaude Opus 5.5
65908ac97c
CI / verify (pull_request) Successful in 51s
CI / infrastructure-smoke (pull_request) Successful in 20s
CI / migration-smoke (pull_request) Successful in 1m49s
CI / image-build (pull_request) Successful in 17s
CI / deploy-smoke (same-origin) (pull_request) Successful in 48s
CI / deploy-smoke (split) (pull_request) Successful in 55s
An installation can now serve the Dashboard and the API on sibling hostnames (dash./api.) beside the default same-origin topology, from one image and with configuration alone. - The Dashboard learns its API origin at run time: the built page carries one empty <meta name="ekklesia-api-origin">, which the API fills with its identity base URL's origin at startup, before computing the page's ETag. The shell accepts only a canonical http(s) origin and otherwise fails closed without making a request. The build-time EKKLESIA_API_BASE_URL is gone from the bundle; the development server injects the same element. - The display host stays on the API's origin, so its device cookies, requests, and offline cache are unchanged. - The API trusts its own origin (trusted origins plus the identity base URL), as Better Auth already does, so the display page's mutations pass the origin check without operators listing it. - Doctor validates EKKLESIA_DASHBOARD_ORIGIN exactly as the API's startup does (it previously skipped it), reports the topology without printing hostnames, and warns when split hostnames are not siblings. - The module UI contract states the CORS header limit (safelisted headers plus Content-Type, safelisted response headers only). - Reference deployment: Caddyfile.split.example (Dashboard hostname serves / and its script; API hostname serves /api/*, /display/*, and the display script; each refuses the other's paths) and EKKLESIA_DASHBOARD_HOSTNAME in the proxy overlay and env examples. - The deploy smoke test runs either topology (CI runs both). The split run installs the module template as a test-only module, checks per-hostname routing and exact CORS, then drives a digest-pinned headless Chromium over the DevTools protocol, with no added dependency: sign-in on the Dashboard hostname, the session cookie host-only on the API hostname, the module UI imported cross-origin and its credentialed request succeeding, the display and its service worker on the API hostname, and sign-out. ADR 0045 is marked Accepted. Co-Authored-By: Claude Opus 5.5 <[email protected]>
72 lines
2.9 KiB
TypeScript
72 lines
2.9 KiB
TypeScript
// @vitest-environment node
|
|
import { readFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, expect, it } from "vitest";
|
|
import { dashboardHostAssetUrls } from "../src/dashboard-assets.js";
|
|
|
|
const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
|
|
|
|
describe("Dashboard host asset locator", () => {
|
|
it("exports only frozen immutable href strings for the two exact built files, never the source map", () => {
|
|
expect(Object.isFrozen(dashboardHostAssetUrls)).toBe(true);
|
|
expect(dashboardHostAssetUrls).toEqual({
|
|
html: new URL("dist/browser/index.html", `file://${packageDirectory}/`).href,
|
|
script: new URL(
|
|
"dist/browser/assets/ekklesia-dashboard/app.js",
|
|
`file://${packageDirectory}/`,
|
|
).href,
|
|
});
|
|
expect(JSON.stringify(dashboardHostAssetUrls)).not.toContain(".map");
|
|
});
|
|
|
|
it("publishes the locator through a narrow package subpath, not the shell root barrel", async () => {
|
|
const manifest = JSON.parse(
|
|
await readFile(path.join(packageDirectory, "package.json"), "utf8"),
|
|
) as { exports?: Record<string, unknown> };
|
|
expect(manifest.exports?.["./dashboard-assets"]).toEqual({
|
|
import: "./dist/dashboard-assets.js",
|
|
types: "./dist/dashboard-assets.d.ts",
|
|
});
|
|
|
|
const rootSource = await readFile(path.join(packageDirectory, "src/index.ts"), "utf8");
|
|
expect(rootSource).not.toContain("dashboardHostAssetUrls");
|
|
expect(rootSource).not.toContain("dashboard-assets");
|
|
});
|
|
|
|
it("loads exactly one fixed, absolute, same-origin script and no inline script", async () => {
|
|
const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
|
|
|
|
expect(html).toContain('id="ekklesia-host"');
|
|
expect(html.match(/<script\b/gu)).toHaveLength(1);
|
|
expect(html).toContain(
|
|
'<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
|
|
);
|
|
});
|
|
|
|
it("carries exactly one empty API-origin meta element for the serving API to fill (ADR 0045)", async () => {
|
|
const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
|
|
|
|
expect(html.match(/name="ekklesia-api-origin"/gu)).toHaveLength(1);
|
|
expect(html).toContain('<meta content="" name="ekklesia-api-origin" />');
|
|
});
|
|
|
|
it("bakes no API origin into the bundle: the build defines nothing but NODE_ENV", async () => {
|
|
const buildScript = await readFile(
|
|
path.join(packageDirectory, "scripts/build-browser.mjs"),
|
|
"utf8",
|
|
);
|
|
|
|
expect(buildScript).not.toContain("__EKKLESIA_API_BASE_URL__");
|
|
});
|
|
|
|
it("builds the Dashboard entry at the exact path the locator names", async () => {
|
|
const buildScript = await readFile(
|
|
path.join(packageDirectory, "scripts/build-browser.mjs"),
|
|
"utf8",
|
|
);
|
|
|
|
expect(buildScript).toContain('"assets/ekklesia-dashboard/app": path.join(');
|
|
});
|
|
});
|