/design in production builds, for server administrators only #952

New issue

Closed

opened 2026-09-30 05:47:15 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-09-30 05:47:15 +00:00

Collaborator

Why: lane 0's review item is the /design reference page, which shows 35 components in 160 states. But it is only mounted in development builds (App.jsx: import.meta.env.DEV ? lazy(...) : null), and dev runs the production image, so the owner can't review it there. The owner chose (2026-09-30) to ship it in production builds, visible only to server administrators.

Approach:

Always mount the route, lazily loaded, so it adds nothing to the main bundle.
Guard it with the app's existing administrator check. A non-admin gets the same "not here" page as any unknown address, not a "forbidden" page, so nothing hints that it exists.
Check that nothing the page imports is dev-only (fixtures, mocks), and that the prod CSP allows everything it draws.
Add no link to it from Admin for now. The owner can decide later whether Admin should point at it.

Done when:

An admin can open /design on a production build.
A signed-in non-admin and a signed-out visitor both get "not here".
Tests cover all three.

**Why:** lane 0's review item is the `/design` reference page, which shows 35 components in 160 states. But it is only mounted in development builds (`App.jsx`: `import.meta.env.DEV ? lazy(...) : null`), and dev runs the production image, so the owner can't review it there. The owner chose (2026-09-30) to ship it in production builds, visible only to server administrators. **Approach:** - Always mount the route, lazily loaded, so it adds nothing to the main bundle. - Guard it with the app's existing administrator check. A non-admin gets the same "not here" page as any unknown address, not a "forbidden" page, so nothing hints that it exists. - Check that nothing the page imports is dev-only (fixtures, mocks), and that the prod CSP allows everything it draws. - Add no link to it from Admin for now. The owner can decide later whether Admin should point at it. **Done when:** - An admin can open `/design` on a production build. - A signed-in non-admin and a signed-out visitor both get "not here". - Tests cover all three.

rbrooks referenced this issue from a commit

2026-09-30 06:02:40 +00:00

Ship /design in production for administrators only (#952)

rbrooks referenced this issue from a commit

2026-09-30 06:02:40 +00:00

docs(design): /design is admin-only in production, not dev-only (#952)

claude-bot referenced this issue from a pull request that will close it,

2026-09-30 06:02:47 +00:00

/design ships in production, for server administrators only (#952) #953

rbrooks referenced this issue from a commit

2026-09-30 06:20:26 +00:00

fix(design): only phone-state boxes scroll sideways, so popovers elsewhere aren't clipped (#952)

rbrooks referenced this issue from a commit

2026-09-30 07:46:47 +00:00

Merge origin/main into feat/design-admin; phone-state boxes are the app container and scroll sideways (#952, #960)

claude-bot referenced this issue from a commit

2026-09-30 08:07:35 +00:00

Merge PR #953: /design ships in production, for server administrators only (#952)

claude-bot closed this issue

2026-09-30 08:07:36 +00:00

claude-bot commented

2026-09-30 08:07:38 +00:00

Author

Collaborator

Done in #953 (merged 2026-09-30, green CI).

Access: /design is always mounted (lazy, as its own 73 kB chunk) and guarded by DesignAccess:

open to anyone in a dev build;
in production, administrators only, with everyone else getting the ordinary not-found page;
a render check of the production-built e2e stack confirmed a non-admin and a signed-out visitor see exactly /nope's page, with no CSP or console errors.

Fixed along the way:

the stale "Dev only." line;
a 41 px phone overflow, where phone-width demo frames now scroll inside their own box;
after #960, phone-state boxes are also the app container, so container-query phone forms show on the page.

Done in #953 (merged 2026-09-30, green CI). **Access:** `/design` is always mounted (lazy, as its own 73 kB chunk) and guarded by `DesignAccess`: - open to anyone in a dev build; - in production, administrators only, with everyone else getting the ordinary not-found page; - a render check of the production-built e2e stack confirmed a non-admin and a signed-out visitor see exactly `/nope`'s page, with no CSP or console errors. **Fixed along the way:** - the stale "Dev only." line; - a 41 px phone overflow, where phone-width demo frames now scroll inside their own box; - after #960, phone-state boxes are also the `app` container, so container-query phone forms show on the page.