mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-13 22:26:49 +00:00
kevinveenbirkenbachandClaude Opus 4.8
0039602379
SeaweedFS is a server-side S3 backend for its consumers; only the
filer/master admin UIs are browser-facing. Split them into a `frontend`
service that stays off on onion nodes ('svc-net-tor' in group_names):
- frontend disabled: no nginx proxy container, no filer/master vhosts,
no oauth2 SSO sidecar; the S3 API vhost is unaffected
- stale filer/master vhosts from earlier frontend-enabled deploys are
removed so the site-wide CSP health probe stops hitting dead domains
- csp_skip_domains additionally skips canonicals a disabled service
declares via services.<name>.domains (defense in depth)
- UI personas (admin/biber/guest/storage-buckets) gate on the
FRONTEND_SERVICE_ENABLED flag; tor variants dropped (backend role)
Verified on the onion node: 4/4 UI specs skip, S3 API reachable, CSP
health check green, matrix S3 media consumer unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
905 B
JavaScript
24 lines
905 B
JavaScript
const { test } = require("@playwright/test");
|
|
const { gotoOnion } = require("./personas");
|
|
|
|
exports.register = function (shared) {
|
|
const { env, isAuthChain, expect } = shared;
|
|
|
|
async function assertRedirectedToAuth(page, targetUrl) {
|
|
await gotoOnion(page, targetUrl, { waitUntil: "domcontentloaded" });
|
|
await page.waitForLoadState("networkidle").catch(() => {});
|
|
expect(
|
|
isAuthChain(page.url()),
|
|
`guest must be redirected to the auth chain at ${targetUrl}, got ${page.url()}`
|
|
).toBe(true);
|
|
}
|
|
|
|
test("guest: redirected to auth, never reaches Filer or Master", async ({ page }) => {
|
|
test.skip(!env.frontendEnabled, "frontend disabled (headless backend node)");
|
|
test.skip(!env.ssoEnabled, "SSO disabled");
|
|
await assertRedirectedToAuth(page, env.filerUrl);
|
|
await page.context().clearCookies();
|
|
await assertRedirectedToAuth(page, env.masterUrl);
|
|
});
|
|
};
|