From 2d7b3151388c12f307b56a6b84f2d4b832cbcd46 Mon Sep 17 00:00:00 2001 From: MelekTaus Date: Fri, 16 Oct 2026 08:40:41 +0200 Subject: [PATCH] API, Architecture, Development: the editor on feuerwerk.nockal.com The same folder now answers on the subdomain as well, so the pages no longer name /feuerwerk/ as the one fixed path. - API: the session cookie has no Path, and the old /feuerwerk/ cookie is cleared on every sign-in and sign-out. - Architecture: site.ts takes the path from the folder of the page. - Development: why the build has a relative base. Co-Authored-By: Claude Opus 5.5 --- API.md | 4 +++- Architecture.md | 2 +- Development.md | 5 ++++- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/API.md b/API.md index bda2bf8..3891dd0 100644 --- a/API.md +++ b/API.md @@ -78,7 +78,9 @@ still takes a session. See [Accounts](Accounts). `SameSite=Lax`, and to that every subdomain of the site is the same site. Tools send no such header. - **The cookie** carries `Secure` whenever the request reached the Brandmauer over HTTPS, along - with `HttpOnly` and `SameSite=Lax`. + with `HttpOnly` and `SameSite=Lax`. It has no `Path`, so the browser keeps it for the folder of + the API as it sees it: `/feuerwerk/api` on `nockal.com`, `/api` on `feuerwerk.nockal.com`. A + cookie from before, set for all of `/feuerwerk/`, is ended with every sign-in and sign-out. `tests/php/rights.test.php` runs the API under `php -S` on a scratch directory and asks every route as somebody signed out, as the owner, as another account and as an administrator. It also reads the diff --git a/Architecture.md b/Architecture.md index 9318e61..b577041 100644 --- a/Architecture.md +++ b/Architecture.md @@ -193,7 +193,7 @@ src/core/recording/ recording (#405: what Start recording asks for and the ru editorRecording (main menu → Start recording…: what the dialog offers and the size and sharpness a choice comes out at), cursors + cursors/ (the mouse pointer an editor recording draws, one SVG per shape with its hot spot) -src/core/site.ts the path the site is served under (`/feuerwerk/`, #422) and the data paths built from it +src/core/site.ts the path the site is served under (the folder of the open page: `/feuerwerk/` or `/`) and the data paths built from it src/core/soundfx/ the sound FX graph (#311): nodes (every effect and what it adds to a plan), compile (the graph walked back from the Output to a plan; a parameter stays open until a voice starts; a tapped node gets a `tap` in front and behind, #374), parametricEq (#367: diff --git a/Development.md b/Development.md index cad30eb..3eeb36d 100644 --- a/Development.md +++ b/Development.md @@ -287,7 +287,10 @@ he walks on the spot — a clock that ticks without the picture following would ## Deployment The workspace folder itself lies behind `https://nockal.com/feuerwerk/`, so `npm run build` is the -deployment, and a change to `api/` is live the moment it is saved. nginx hands out only what the +deployment, and a change to `api/` is live the moment it is saved. The same folder answers at +`https://feuerwerk.nockal.com/`: the Brandmauer puts `/feuerwerk` in front of every path there. +That is why the build knows no path of its own. Its base is relative, and `src/core/site.ts` +takes the path of the API and the data from the folder of the open page. nginx hands out only what the pages load (#427), from a `location ^~ /feuerwerk/` block in the shared `nginx.conf` of the web stack: