mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 4.7
16bdbf03d7
Three classes of drift cleaned up across 85 .md files:
- Em-dashes: replaced ` — ` with the contextually correct separator
(colon for `term: explanation`, period to split clauses across
sentences/source lines, parentheses for asides, semicolon for
tight-linked continuations). Two intentional exceptions remain
in `docs/contributing/documentation.md` (the rule literal) and
inside a fenced ```sh block in `docs/contributing/actions/debugging/ci.md`.
- SPOT self-labels: rewrote "This is the SPOT for X" to describe
the subject directly ("This directory holds X" / "This file
describes X"). Cross-references to other artefacts' canonical
role remain unchanged.
- Heading-emoji position: moved leading-emoji headings (`# 🧩 Title`)
to trailing position (`# Title 🧩`) per the headline rule that
emojis MUST come after the title text.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.9 KiB
2.9 KiB
016 - Fediwall multi-wall via OIDC-protected runtime upload
User Story
As an Infinito.Nexus admin, I want to host multiple Fediwalls under distinct path slugs on a single fediwall.{{ DOMAIN_PRIMARY }} deployment and manage their wall-config.json files at runtime through an OIDC-protected upload UI, so that I can publish purpose-built media walls (per event, hashtag, account set, etc.) without redeploying the web-app-fediwall role for every new wall.
Acceptance Criteria
- The static Fediwall SPA is served from
https://fediwall.{{ DOMAIN_PRIMARY }}/<slug>/for every published slug, and each request resolves the slug-specificwall-config.jsonfrom the same path. - An authenticated
POST /admin/wallsendpoint behindweb-app-oauth2-proxyaccepts amultipart/form-dataupload with fieldsslugandfile, persistswall-config.jsonto<persistent_volume>/walls/<slug>/wall-config.json, and returns201. - Unauthenticated requests to any
/admin/*endpoint are rejected with401(not200or403). - The
slugis validated against^[a-z0-9][a-z0-9-]{0,63}$; path-traversal payloads (.., slashes, control chars) and reserved slugs (e.g.admin,assets, empty) are rejected with400. - The uploaded file is validated as JSON and against the Fediwall
Configshape (every field from upstreamsrc/types.tsConfig); malformed payloads are rejected with422and a field-level error list. - An authenticated
DELETE /admin/walls/<slug>endpoint removes<persistent_volume>/walls/<slug>/; the next anonymous request to/<slug>/returns404. - An authenticated
GET /admin/wallsreturns the list of currently published slugs as JSON. - The public root
/renders an HTML link list of all currently published walls; the list updates on the next page load after a successful upload or delete (no admin login required to view). - Wall configs and slug directories survive container restart and
make deploy-reuse-kept-apps APPS=web-app-fediwall; an existing wall is reachable byte-identical after a redeploy. - CSP
connect-srcfor every/<slug>/continues to be governed bylookup('fediwall_active', 'url_bases'); the multi-wall feature MUST NOT bypass the existing whitelist. - End-to-end Playwright in
roles/web-app-fediwall/files/playwright.spec.jscovers: anonymous read of an existing/<slug>/, anonymous401on/admin/walls, authenticated round-trip (upload → read → delete →404), slug-collision rejection (409), and slug-validation rejection (400). - This requirement file is cross-linked from the implementing PR; the PR description references this file.