2 Commits

Include renames

Author	SHA1	Message	Date
Sluijsens	7c1d2aa520	Fixes /admin 404 by building the admin SPA before dotnet publish, not via an MSBuild target ... The BuildAndCopyAdminFrontend MSBuild target (BeforeTargets=Publish) never actually worked: files it created after project evaluation were silently absent from the publish output, and forcing them in via an explicit Content item collided with the SDK's own static-web-asset resolution. Verified locally with a clean obj/bin and a fresh node_modules - every deploy so far genuinely shipped without wwwroot/admin. Moves the frontend build + copy into its own CI step ahead of dotnet publish, so the SDK's ordinary wwwroot handling picks it up with no custom MSBuild involved. Also fixes unreadable <code> badges on the website placeholder page (no explicit text color, relying on inherited body color pairing unreliably with the badge background).	2026-07-30 11:10:17 +02:00
SluijsensandClaude Opus 5	29a93ef873	Separates website and admin roots, adds /health, hardens the availability gate ... Prepares the single-host layout for deployment. The customer's public website moves from wwwroot/ to wwwroot/web/, so a CMS deploy can no longer overwrite content it does not own: with the website in its own directory, the release directory can be swapped without touching it. Each front-end gets its own file provider, and both tolerate a missing directory at startup — a fresh deployment has no website until a separate workspace deploys one, and the CMS must still serve /admin and the API. When the website's index.html is absent, an embedded placeholder is served instead of a 404, which also doubles as proof the CMS itself is running. The placeholder is embedded in the assembly rather than shipped into wwwroot/web/, because that directory is owned and overwritten by the website workspace. Adds GET /health for uptime monitoring. It reports infrastructure liveness only and is deliberately NOT the same thing as /api/v1/Availability/status or /api/v1/System/capabilities: those are CMS domain state that also serve the master/slave protocol. A healthy instance can be switched off by design, and a switched-on instance can be unhealthy, so conflating them would alert on business state and stay silent on real outages. /health is on the availability gate's bypass list for the same reason. Fixes a real defect in the gate's admin bypass. It parsed the bearer token with ReadJwtToken, which reads claims without verifying the signature, so an unauthenticated caller could forge an unsigned token carrying an Owner role claim and bypass the gate that suspends a customer's site. Protected endpoints still rejected them, so nothing leaked — but the gate itself was bypassable. The token is now fully validated against the same parameters as the bearer scheme, resolved from one shared source so the two cannot drift apart. Host wiring for these changes lands with the data-durability commit, since both units touch the same lines of Program.cs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoJpxYXzHACSQguHrC5fw	2026-07-28 00:00:13 +02:00