Claude Opus 4.8
fc41c91003
All checks were successful
CD / Build and push images (push) Successful in 3m13s
CI / Lint, typecheck, test (push) Successful in 2m30s
CI / Auth e2e pack (push) Successful in 3m21s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m13s
CD / Promote to Int (push) Successful in 11s
Anonymous visitors read what `public` grants allow, via the SPA and a server-rendered HTML endpoint for crawlers / PDF export (ADR 0005/0009). - api `public/`: `GET /public/:pondSlug/:pageSlug` returns a self-contained HTML document (content cache + minimal chrome + canonical link, no session-dependent content), and `…/content` returns JSON for the SPA. Both are `@Public()` and resolve the `public` subject through the shared resolver (PermissionService) — denied or missing → 404, so non-public pages never reveal their existence (security.md). Cached image nodes (`data-file-id`) are resolved to `/api/v1/media/:fileId` for the static render. - media: `GET /media/:fileId` is `@Public()` too, so embedded images on a public page stream to anonymous visitors; the attachment guard still gates on the `public` grant (non-public → 404). - web: a lightweight read-only `PublicPageView` at `/public/:pondSlug/:pageSlug` (outside the auth guard) renders the server HTML — deliberately without importing the collaborative editor, so anonymous readers load no editor bundle. New `public` i18n namespace (de+en). - tests: `public.e2e.db.test.ts` (HTML + JSON served for a public page; a non-public page never resolves; removing the grant 404s both) and a browser `public` pack (anonymous reads a public page and its image via the SPA; a non-public page shows "not found") with its own CI step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
49 lines
1.8 KiB
TypeScript
49 lines
1.8 KiB
TypeScript
import { useQuery } from '@tanstack/react-query';
|
|
import { useTranslation } from 'react-i18next';
|
|
import { useParams } from 'react-router-dom';
|
|
|
|
import { ApiError, apiGet } from '../lib/api';
|
|
import { NotFoundPage } from './NotFoundPage';
|
|
|
|
interface PublicPageContent {
|
|
pondName: string;
|
|
pondSlug: string;
|
|
title: string;
|
|
slug: string;
|
|
html: string;
|
|
updatedAt: string;
|
|
}
|
|
|
|
/**
|
|
* Read-only public page view (issue #56): renders a page that a `public` grant
|
|
* opens to anonymous visitors, from the server-derived HTML — deliberately
|
|
* WITHOUT importing the collaborative editor, so anonymous readers never load
|
|
* the editor bundle. A non-public page 404s (the api hides its existence).
|
|
*/
|
|
export function PublicPageView(): React.JSX.Element {
|
|
const { t } = useTranslation('public');
|
|
const { pondSlug = '', pageSlug = '' } = useParams<{ pondSlug: string; pageSlug: string }>();
|
|
|
|
const query = useQuery({
|
|
queryKey: ['public-page', pondSlug, pageSlug],
|
|
queryFn: () => apiGet<PublicPageContent>(`/public/${pondSlug}/${pageSlug}/content`),
|
|
enabled: Boolean(pondSlug && pageSlug),
|
|
retry: false,
|
|
});
|
|
|
|
if (query.error instanceof ApiError && query.error.status === 404) return <NotFoundPage />;
|
|
if (query.isLoading || !query.data) return <div aria-busy="true" />;
|
|
|
|
const page = query.data;
|
|
return (
|
|
<article className="public-page">
|
|
<p className="public-page__badge">{t('readOnlyBadge')}</p>
|
|
<p className="public-page__pond">{page.pondName}</p>
|
|
<h1 className="public-page__title">{page.title}</h1>
|
|
{/* The HTML comes from the server's content cache (issue #24), derived
|
|
from the sanitized editor schema — safe to render. */}
|
|
<div className="public-page__body" dangerouslySetInnerHTML={{ __html: page.html }} />
|
|
</article>
|
|
);
|
|
}
|