From 85f3655e6f69f4c4418ea1097bbf32f1ff30f5ee Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Wed, 5 Aug 2026 11:39:46 -0700 Subject: [PATCH] docs: update HANDOFF with shipped docs state + the proxy public-route fix Records that the /docs section and homepage fix are merged (PR #8) and live, the proxy.ts PUBLIC_ROUTES hotfix that made /docs reachable without a session, and the authoring/middleware gotchas for future public route groups. --- docs/HANDOFF-audit-cleanup.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docs/HANDOFF-audit-cleanup.md b/docs/HANDOFF-audit-cleanup.md index 29056bc..855dc92 100644 --- a/docs/HANDOFF-audit-cleanup.md +++ b/docs/HANDOFF-audit-cleanup.md @@ -112,8 +112,17 @@ Items 5 (comms realtime dedup) and 6 (commit granularity) still stand as written `public/docs-media/` and are embedded as captioned figures. Docs prose contains no em-dashes by house style. - **Authoring notes:** add a page = add it to `DOC_CATEGORIES` in `lib/docs/nav.ts` and drop the matching `content/docs//.md`. No H1 in the body (the page chrome renders the title). Cross-link docs - as `/docs//` and app screens as `/route`. Every page was fact-checked against the code by an - adversarial verify pass; the permission gotcha that recurs: server actions often allow `board`, but the - space-config UI (`/settings`, `/customize` config panels, integrations) is admin-only. + as `/docs//` and app screens as `/route`. Screenshots go in `public/docs-media/` and embed + as `![caption](/docs-media/.jpg)` (the alt text becomes the figure caption). House style: no em-dashes. + Every page was fact-checked against the code by an adversarial verify pass; the permission gotcha that + recurs: server actions often allow `board`, but the space-config UI (`/settings`, `/customize` config + panels, integrations) is admin-only. +- **Middleware gotcha (bit the first deploy):** `proxy.ts` (the Next 16 middleware) redirects any path not in + its `PUBLIC_ROUTES` allowlist to `/login`. **Any new public route group must be added to `PUBLIC_ROUTES`**, + or it 307s unauthenticated visitors to login. `/docs` is now listed; `/docs-media/*` static images already + bypass via the image matcher. Test public pages with cookies cleared: a browser "new tab" keeps the session, + so it is NOT a signed-out test. -Gates on this branch: `tsc` 0 · `lint` 0 errors · `build` ✓ (all 34 `/docs` pages prerendered). +**Shipped:** merged via PR #8 (+ a `proxy.ts` public-route hotfix) and deployed. Live at `hackerspace.sh/docs` +(verified public: `/docs` returns 200 with no session; `/dashboard` still redirects to `/login`). Gates: +`tsc` 0 · `lint` 0 errors · `build` ✓ (all 34 `/docs` pages prerendered) · CI green · deploy ✓.