6 Commits

Include renames

Author	SHA1	Message	Date
SluijsensandClaude Sonnet 5	fa389e42ee	Adds SlpModularCms.Api.SlpSoftware and extracts shared CmsHost composition ... Unit 1 of the slpsoftware-api feature (FR-1/FR-2/FR-3): a new Client project in the Clients solution folder, intended to eventually become the deployed API for test.slpsoftware.nl/slpsoftware.nl, hosting the same four modules as SlpModularCms.Api plus a future Offerings module. - Extracts SlpModularCms.Api/Program.cs's hosting-pipeline composition into SlpModularCms.Core.Hosting.CmsHost (ConfigureServices/ConfigurePipeline), shared by both Client projects so they cannot drift apart - Moves StaticContentExtensions.cs + WebsitePlaceholder.html from Api into Core, since CmsHost cannot live in Api but Core cannot depend on Api - Adds SlpModularCms.Api.SlpSoftware with its own isolated local dev database and dev ports (5286/7223, distinct from Api's and Api.Slave's) - Adds SlpModularCms.Api.Tests with WebApplicationFactory-based pipeline regression tests (security headers, health check, SPA fallback, rate limiting), scoped to Api per NFR Design - Adds a frontend dev:slpsoftware pnpm script mirroring dev:slave - Fixes GlobalExceptionHandler logging routine 401s (e.g. an expired/missing refresh token) as unhandled errors -- pre-existing, unrelated to this feature's own scope, found while testing the new instance Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN	2026-08-02 01:28:39 +02:00
Sluijsens	88770c5bd0	U7 — tells a website builder what they need to know ... WEBSITE_WORKSPACE.md, plus the parts of the README that were still describing the old layout or a manual step the code doesn't need anymore (the key-ring paragraph, mainly - that one was actively wrong now, not just stale).	2026-07-28 16:30:19 +02:00
SluijsensandClaude Sonnet 5	0447993181	Completes local-dev-master-slave-setup: dual-instance frontend tooling, module-capability gating, and master/slave protocol self-healing fixes ... Frontend (Unit 2 completion): dual dev-server tooling (pnpm dev:slave, pnpm dev:all), per-instance browser tab titles, and a backend capability check (SystemController + useSystemCapabilities + ModuleGuard) so a Master-only page is hidden on a slave instance instead of assuming every backend has every module. Master/slave protocol fixes surfaced by actually running master and slave side by side locally: - Deactivating a CMS instance (Inactive) now releases the slave's master gate instead of leaving it stuck on its last pushed status. - The periodic integrity check now also re-pushes status to every reachable slave (previously URL-verification only) and runs once immediately on startup. - Added the originally-specified (but never implemented) slave-pull path: a slave now periodically polls its own status from the master (GET /api/v1/SlaveStatus) and fails open to Available if the master is unreachable for too long, complementing the existing push. - The slave's own Settings page can no longer "successfully" change local availability while the master controls it; it's now locked with an explanatory banner and the backend rejects the write with 409 instead of silently no-op'ing it. - CMS instance status badges now match the dashboard's color/icon styling instead of a plain grey badge. Also corrected the master-cms-module design docs to match this as-built behavior, and flagged (without a full rewrite) a larger, pre-existing divergence between its inception-stage application design and what construction actually built. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-04 19:53:52 +02:00
SluijsensandClaude Haiku 4.5	5331be4279	fix(auth): configurable SameSite cookie for cross-origin dev setup ... Chrome 89+ schemeful same-site treats http://localhost and https://localhost as different sites, blocking SameSite=Strict cookies on cross-origin fetch (e.g. Vite on port 5173, API on port 7221). Fix: make CookieSameSite configurable per environment in JwtSettings. - Default: Strict (production) - appsettings.Development.json: None (allows cross-origin cookie in dev) - When SameSite=None, Secure is always forced (browser requirement) Revert the earlier Vite proxy approach in favour of this backend config. VITE_API_BASE_URL remains a freely configurable URL in .env.local. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-06-22 15:42:56 +02:00
SluijsensandClaude Haiku 4.5	546b773781	fix(auth): add Vite dev proxy to fix SameSite=Strict cookie on page reload ... Chrome 89+ treats http://localhost and https://localhost as different sites (schemeful same-site). The refreshToken cookie (SameSite=Strict) was not sent when the Vite dev server (HTTP) made cross-origin fetch calls to the .NET backend (HTTPS), causing a 401 on every page reload. Fix: route /api/* through the Vite dev server proxy so all requests stay same-origin. The cookie is now always sent and auth sessions survive reloads. - vite.config.ts: proxy /api → https://localhost:7221 (secure:false for dev cert) - .env.example: document proxy vs direct mode, set default VITE_API_BASE_URL to empty - config.ts: accept empty string as valid apiBaseUrl alongside full URLs Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-06-22 15:23:19 +02:00
Sluijsens	7dfc3a9692	Adds front-end set-up	2026-06-20 17:04:17 +02:00