c7c81fb65c
Bundles the console work from the current branch: the header account control, database-backed roles and permissions, and signing out across the applications that share this sign-in. The account control replaces a separate identity chip and a separate sign-out button, which meant the header carried two controls describing one fact. web/account.js is mounted into every page by a placeholder and owns the keyboard handling, the outside-click behaviour and the sign-out form once. It also fills the trigger's name, which the previous markup left empty. Signing out revokes the hosted-login bearer sessions this installation issued, then redirects to the provider's end_session_endpoint when the discovery document advertises one. Applications that authenticate against this installation therefore lose their session too; one pointed straight at an identity provider is out of its reach and is unchanged. Roles and permissions become rows rather than a closed enum, so a tenant can extend the catalog without a migration, and a role can no longer be granted a capability that is not in it. requireSameOrigin now compares against the origin the request arrived on instead of the configured base URL, which defaulted to http://localhost:8080 and so rejected every write in a deployment that never set it. Two bugs found while verifying in a browser: - A profile picture never rendered. avatarURL built an absolute URL from the configured base URL, and the page's own img-src 'self' blocked it. The console's own pages now take a root-relative path; only /connect/userinfo, read from another origin, needs an absolute one, and it follows the request. - absoluteURL preferred the configuration over the request while its comment claimed the opposite, which also misdirected the logout redirect. Card layout: the footer was one two-column row shared between a label and a forty-character identifier, so the identifier took the width and crushed its label into three stacked words. Each pair is a line now, the value truncates with the full text in the title, and cards align their footers across a row.
32 lines
1.1 KiB
TOML
32 lines
1.1 KiB
TOML
# Air watches this tree and rebuilds into ./dist on every change.
|
|
# Used by `make compose-dev-up` (docker-compose.dev.yaml + Dockerfile.dev).
|
|
# Docs: https://github.com/air-verse/air/blob/master/air_example.toml
|
|
|
|
root = "/src"
|
|
tmp_dir = "/tmp/air"
|
|
log_file = "/tmp/air/build-errors.log"
|
|
delay = 300
|
|
stop_on_error = true
|
|
stop_on_root_dir = true
|
|
send_interrupt = true
|
|
kill_delay = "2s"
|
|
log_level = "info"
|
|
|
|
[build]
|
|
# Output lands in ./dist on the host through the bind mount.
|
|
bin = "dist/go-loose"
|
|
cmd = "go build -trimpath -o ./dist/go-loose ./cmd/go-loose"
|
|
args_bin = []
|
|
# web/ is embedded with go:embed, so asset edits need a rebuild too.
|
|
include_ext = ["go", "html", "js", "css", "sql", "json", "yaml", "yml", "toml"]
|
|
include_dir = ["cmd", "internal", "client", "web"]
|
|
# data/db is the PostgreSQL volume and would otherwise trigger rebuilds.
|
|
exclude_dir = [".git", "dist", "data", "docs", "node_modules", "tmp"]
|
|
exclude_regex = ["_test\\.go$"]
|
|
exclude_unchanged = true
|
|
follow_symlink = true
|
|
|
|
# Bind mounts do not deliver inotify events on Docker Desktop, so poll there.
|
|
[misc]
|
|
poll = false
|
|
poll_interval = 300
|