Claude Opus 4.8
fc41c91003
All checks were successful
CD / Build and push images (push) Successful in 3m13s
CI / Lint, typecheck, test (push) Successful in 2m30s
CI / Auth e2e pack (push) Successful in 3m21s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m13s
CD / Promote to Int (push) Successful in 11s
Anonymous visitors read what `public` grants allow, via the SPA and a server-rendered HTML endpoint for crawlers / PDF export (ADR 0005/0009). - api `public/`: `GET /public/:pondSlug/:pageSlug` returns a self-contained HTML document (content cache + minimal chrome + canonical link, no session-dependent content), and `…/content` returns JSON for the SPA. Both are `@Public()` and resolve the `public` subject through the shared resolver (PermissionService) — denied or missing → 404, so non-public pages never reveal their existence (security.md). Cached image nodes (`data-file-id`) are resolved to `/api/v1/media/:fileId` for the static render. - media: `GET /media/:fileId` is `@Public()` too, so embedded images on a public page stream to anonymous visitors; the attachment guard still gates on the `public` grant (non-public → 404). - web: a lightweight read-only `PublicPageView` at `/public/:pondSlug/:pageSlug` (outside the auth guard) renders the server HTML — deliberately without importing the collaborative editor, so anonymous readers load no editor bundle. New `public` i18n namespace (de+en). - tests: `public.e2e.db.test.ts` (HTML + JSON served for a public page; a non-public page never resolves; removing the grant 404s both) and a browser `public` pack (anonymous reads a public page and its image via the SPA; a non-public page shows "not found") with its own CI step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
57 lines
2.6 KiB
TypeScript
57 lines
2.6 KiB
TypeScript
import { Route, Routes } from 'react-router-dom';
|
|
|
|
import { RequireAnonymous, RequireAuth, RequireSiteAdmin } from './auth/guards';
|
|
import { AppLayout } from './layout/AppLayout';
|
|
import { AdminSettingsPage } from './pages/AdminSettingsPage';
|
|
import { HomePage } from './pages/HomePage';
|
|
import { NotFoundPage } from './pages/NotFoundPage';
|
|
import { PageEditorPage } from './pages/PageEditorPage';
|
|
import { PondHomePage } from './pages/PondHomePage';
|
|
import { PondSettingsPage } from './pages/PondSettingsPage';
|
|
import { PublicPageView } from './pages/PublicPageView';
|
|
import { SettingsPage } from './pages/SettingsPage';
|
|
import { TrashPage } from './pages/TrashPage';
|
|
import { ForgotPasswordPage } from './pages/auth/ForgotPasswordPage';
|
|
import { LoginPage } from './pages/auth/LoginPage';
|
|
import { ResetPasswordPage } from './pages/auth/ResetPasswordPage';
|
|
import { SignupPage } from './pages/auth/SignupPage';
|
|
import { VerifyEmailPage } from './pages/auth/VerifyEmailPage';
|
|
|
|
export function App(): React.JSX.Element {
|
|
return (
|
|
<Routes>
|
|
<Route element={<AppLayout />}>
|
|
<Route index element={<HomePage />} />
|
|
|
|
<Route element={<RequireAnonymous />}>
|
|
<Route path="login" element={<LoginPage />} />
|
|
<Route path="signup" element={<SignupPage />} />
|
|
<Route path="forgot-password" element={<ForgotPasswordPage />} />
|
|
</Route>
|
|
{/* Verify/reset work regardless of session state (mail links). */}
|
|
<Route path="verify-email" element={<VerifyEmailPage />} />
|
|
<Route path="reset-password" element={<ResetPasswordPage />} />
|
|
{/* Public read-only page view — reachable without a session (issue #56). */}
|
|
<Route path="public/:pondSlug/:pageSlug" element={<PublicPageView />} />
|
|
|
|
<Route element={<RequireAuth />}>
|
|
<Route path="settings" element={<SettingsPage />} />
|
|
<Route path="p/:pondSlug" element={<PondHomePage />} />
|
|
{/* Static segment "trash" wins react-router's ranking over the
|
|
dynamic :pageSlug sibling below — a page slugged "trash"
|
|
would be unreachable via direct URL, an accepted v1 gap. */}
|
|
<Route path="p/:pondSlug/trash" element={<TrashPage />} />
|
|
{/* Static "settings" wins over :pageSlug, like "trash" above. */}
|
|
<Route path="p/:pondSlug/settings" element={<PondSettingsPage />} />
|
|
<Route path="p/:pondSlug/:pageSlug" element={<PageEditorPage />} />
|
|
</Route>
|
|
<Route element={<RequireSiteAdmin />}>
|
|
<Route path="admin" element={<AdminSettingsPage />} />
|
|
</Route>
|
|
|
|
<Route path="*" element={<NotFoundPage />} />
|
|
</Route>
|
|
</Routes>
|
|
);
|
|
}
|