/design ships in production, for server administrators only (#952) #953

Merged

claude-bot merged 6 commits from feat/design-admin into main 2026-09-30 08:07:33 +00:00

Conversation 0 Commits 6 Files changed 8 +117 -14

claude-bot commented 2026-09-30 06:02:47 +00:00

Collaborator

Copy link

Closes #952. Lane 0's review needs /design on dev, and dev runs the production image, so the owner chose (2026-09-30) to ship it in production for administrators only.

How it works: /design is always mounted and still lazy (its own 73 kB chunk; the main bundle is unchanged). It's wrapped in components/DesignAccess.jsx:

• Dev build: open to anyone, as before.
• Production, while the session check is in flight: the loading screen, so nothing leaks.
• Production, signed out or not an admin: the app's own NotFound, the same page an unknown address gets, with no redirect and no 403. Nothing hints that the page exists.
• Production admin: the page. This is the same user.is_admin check that AppFrame and useContents use.

Production safety: DesignReference imports only ui/ pieces, its CSS and the ui/*/states.jsx glob. It has no dev-only fixtures and makes no fetch calls. Its inline styles are within the prod CSP (style-src 'self' 'unsafe-inline').

Tests:

• DesignAccess.test.jsx, five cases: admin sees the page; non-admin and signed-out get NotFound; loading shows neither; dev-open shows the page even when signed out.
• The full vitest suite passes (2765), and eslint shows 0 errors.
• npm run build shows DesignReference as its own chunk.

Docs:

• ui/README.md;
• the build plan's §3.5;
• the page's own header comment.

Changelog: changelog.d/952-design-admin.changed.md.

🤖 Generated with Claude Code

Closes #952. Lane 0's review needs `/design` on dev, and dev runs the production image, so the owner chose (2026-09-30) to ship it in production for administrators only. **How it works:** `/design` is always mounted and still lazy (its own 73 kB chunk; the main bundle is unchanged). It's wrapped in `components/DesignAccess.jsx`: - **Dev build:** open to anyone, as before. - **Production, while the session check is in flight:** the loading screen, so nothing leaks. - **Production, signed out or not an admin:** the app's own `NotFound`, the same page an unknown address gets, with no redirect and no 403. Nothing hints that the page exists. - **Production admin:** the page. This is the same `user.is_admin` check that `AppFrame` and `useContents` use. **Production safety:** `DesignReference` imports only `ui/` pieces, its CSS and the `ui/*/states.jsx` glob. It has no dev-only fixtures and makes no fetch calls. Its inline styles are within the prod CSP (`style-src 'self' 'unsafe-inline'`). **Tests:** - `DesignAccess.test.jsx`, five cases: admin sees the page; non-admin and signed-out get NotFound; loading shows neither; dev-open shows the page even when signed out. - The full vitest suite passes (2765), and eslint shows 0 errors. - `npm run build` shows DesignReference as its own chunk. **Docs:** - `ui/README.md`; - the build plan's §3.5; - the page's own header comment. Changelog: `changelog.d/952-design-admin.changed.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-09-30 06:02:47 +00:00

Ship /design in production for administrators only (#952) ... 3050af39ab

Always lazy-load and mount the route behind DesignAccess: open in dev
builds, admin-only in production, NotFound for everyone else.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs(design): /design is admin-only in production, not dev-only (#952) ... 36a982ef9e

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

rbrooks added 2 commits 2026-09-30 06:20:27 +00:00

/design: drop stale 'Dev only'; phone-width demo frames scroll inside their box (no page overflow at 390) ... d6d3d1eb7d

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(design): only phone-state boxes scroll sideways, so popovers elsewhere aren't clipped (#952) ... 9213a6a2fc

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

claude-bot referenced this pull request 2026-09-30 06:39:17 +00:00

Test fix: PrepSheet's Shelf test looks its section up inside the wait (#955) #956

claude-bot referenced this pull request 2026-09-30 07:19:47 +00:00

Lane 11 PR 1: the sheet's pieces in the design system (#737, #364) #960

rbrooks added 1 commit 2026-09-30 07:25:25 +00:00

Merge remote-tracking branch 'origin/main' into feat/design-admin d33ab4c835

rbrooks added 1 commit 2026-09-30 07:46:47 +00:00

Merge origin/main into feat/design-admin; phone-state boxes are the app container and scroll sideways (#952, #960) ... 5c9684c695

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

claude-bot merged commit 29a320cf55 into main 2026-09-30 08:07:33 +00:00

claude-bot referenced this pull request from a commit 2026-09-30 08:07:35 +00:00

Merge PR #953: /design ships in production, for server administrators only (#952)

claude-bot referenced this pull request 2026-09-30 08:07:38 +00:00

/design in production builds, for server administrators only #952

claude-bot referenced this pull request 2026-09-30 17:16:26 +00:00

Redesign review follow-ups R3 (owner's pass, 30 Sep) #980

claude-bot referenced this pull request 2026-10-01 20:16:35 +00:00

Dev deploy, 1 Oct: lane 11, the R3 fixes and today's issue fixes #1004

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!953

No description provided.