3 Commits

Include renames

Author	SHA1	Message	Date
mrhid6andClaude Opus 5	6a3e0a29a4	chore: verify the admin site end to end ... Everything checkable without a browser, against scratch databases: - All five Go modules and the adminsite production build compile clean. - Scoping holds: own instance 200, another account's 404, nonexistent 404 -- indistinguishable, so no existence oracle -- and a customer session on the staff API gets 401 where staff gets 200. - max_relinks comes from the API (3), not a constant mirrored in TypeScript. - The inline blob and the download endpoint return byte-identical content, so the fallback is faithful rather than approximate. - ADMIN_API_URL really is baked at build time: 9999 in the deliberately broken image, 8083 in the good one. - The served stylesheet carries site/'s tokens with matching values, plus prefers-color-scheme and both data-theme overrides. - With admin stopped the control plane still reports valid and mutations still succeed -- instances never call admin. - Admin touched only the three licence fields on instances; every other control-plane collection is as the control plane left it. Caught one stale-image bug doing this: the running admin predated the customer blob change, so the licence response had no blob field at all. Rebuilt and re-verified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 21:30:43 +01:00
mrhid6andClaude Opus 5	24060b2c5a	chore(adminsite): remove the frontend test suite ... Removes vitest, React Testing Library, the config, the setup file and all eleven test files, plus the test scripts and dev dependencies. Done at the user's direction; it matches the rest of the repo, which has no automated tests in any language. All eleven were observed passing before removal, and their assertions are kept in the plan as acceptance criteria to check by hand rather than deleted outright -- they are the clearest statement of what each component has to do. Consequence worth stating: Task 16's manual pass is now the only verification that exists for spec 4. Four behaviours it must cover carefully, because each is easy to break invisibly: 404-not-403 scoping, the expired card naming what still works, relink disabling at zero, and the blob fallback when a download fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 21:19:34 +01:00
mrhid6andClaude Opus 5	6953f5e972	feat(adminsite): scaffold and site/'s token system ... A fifth Next.js app, built like web/ and site/: App Router, React 18, Tailwind 3, TanStack Query, standalone output. app/globals.css carries site/app/globals.css's token blocks copied verbatim rather than retyped, so the two cannot drift by transcription. Tailwind holds var() references only -- no component or config entry may contain a hex value. The semantic three are aliased: site/'s --up/--pend/--down become valid/warn/expired, so each app names the colours for what it shows. Unlike web/, there is no rewrite proxy: the browser calls admin directly, so NEXT_PUBLIC_ADMIN_API_URL must be browser-reachable and listed in admin's ADMIN_ORIGIN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 20:55:25 +01:00