tegwick edfdd79208 Finish CSOC-WP-0003 and CSOC-WP-0004; residual intakes for Case B

Close self-registration workplan with Case A proven and Create account
entry implemented; park public registration enablement and identity
negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06
operator runbook (seed, bind, webhook, smoke) and smoke doc updates.

2026-08-12 10:59:25 +02:00

2.3 KiB

Raw Blame History

Space content — Forgejo markdown (read + write path)

See ADR-0002. App DB holds metadata; page bodies are markdown in Forgejo.

Operator runbook (seed, bind, cluster smoke): docs/deploy.md § Operator runbook — spaces on app.coulomb.social.

Read (T04)

Space row has forgejo_owner, forgejo_repo, default_branch, content_root.
App fetches {content_root}/index.md (or ?page=<slug> → {slug}.md) via Forgejo raw URL.
HTML is sanitized and cached in-process (successes only).

Env (non-secret defaults in settings):

Variable	Purpose
`FORGEJO_BASE_URL`	default `https://forgejo.coulomb.social`
`FORGEJO_TOKEN`	optional; needed for private repos
`FORGEJO_WEBHOOK_SECRET`	optional; enables push webhook cache bust

Write / sync (T05)

Git remains the source of truth. There is no in-app markdown editor in v1.

Operator / author workflow

Open the space on app.coulomb.social.
Click Edit in Forgejo (file editor) or View source.
Commit on the space’s default_branch (usually main).
Click Refresh content on the space page (or rely on webhook below).

Demo seed (public raw, no token):

python manage.py seed_demo_space
# binds demo → coulomb/coulomb-social @ docs/space-fixtures/demo/pages

Webhook (optional, recommended)

So authors do not need to click Refresh after every push:

Set FORGEJO_WEBHOOK_SECRET in the app env Secret (not in git).
In Forgejo: repo → Settings → Webhooks → Add webhook → Gitea.
Target URL: https://app.coulomb.social/app/spaces/hooks/forgejo/
HTTP Method: POST, content type JSON.
Secret: same value as FORGEJO_WEBHOOK_SECRET (Forgejo signs with HMAC-SHA256).
Trigger: Push events.

Auth accepted by the app:

X-Gitea-Signature: <hex hmac-sha256 of body> (Forgejo default when secret set), or
X-Coulomb-Webhook-Secret: <shared secret>

Response JSON: { ok, owner, repo, cache_entries_cleared, spaces_matched }.

Fail closed

Missing binding → clear UI error, no Bubble fallback.
Fetch errors → error card; previous cache entry is not used after Refresh.

docs/adr/ADR-0002-space-content-forgejo-markdown.md
python manage.py seed_demo_space

2.3 KiB Raw Blame History Unescape Escape