8 Commits

Include renames

Author	SHA1	Message	Date
joshandClaude Sonnet 4.6	65d6514603	fix: use git rev-parse for short SHA in build-dev ... $GITEA_SHA is unset on Gitea runners — the nav showed "dev-" with an empty SHA. git rev-parse --short HEAD works regardless of runner env vars. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 13:18:47 -04:00
joshandClaude Sonnet 4.6	6ba02bf17d	feat: show dev-<sha> version string in nav for dev builds ... Production images continue to display the semver (v1.x.x). Dev images built by CI now receive BUILD_VERSION=dev-<7-char-sha> via a Docker ARG, and app.js skips the v prefix for non-semver strings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 12:52:15 -04:00
joshandClaude Sonnet 4.6	0f2a37cb39	fix: centre badge text on instance cards ... .badge lacked text-align: center. Inside the card's flex-end right column, badge text was left-justified within each pill, making state labels (deployed / testing / degraded) appear skewed to the left. TDD: CSS regression test added to tests/helpers.test.js — reads css/app.css directly and asserts the rule is present, so this cannot regress silently in future. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 12:28:44 -04:00
joshandClaude Sonnet 4.6	08c12c9394	fix: skip db boot init in test env to prevent parallel worker lock ... Vitest runs test files in parallel workers. Each worker imports server/db.js, which triggered module-level init(DEFAULT_PATH) unconditionally. Two workers racing to open the same SQLite file caused "database is locked", followed by process.exit(1) killing the worker — surfacing as: Error: process.exit unexpectedly called with "1" Fix: guard the boot init block behind NODE_ENV !== 'test'. Vitest sets NODE_ENV=test automatically. Each worker's beforeEach(() => _resetForTest()) initialises its own :memory: database, so no file coordination is needed. process.exit(1) is also guarded by the same condition — it must never fire inside a test runner process. TDD: two regression tests added to tests/db.test.js documenting the expected boot behaviour and proving the module loads cleanly in parallel. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 11:48:07 -04:00
joshandClaude Sonnet 4.6	15ed329743	fix: db volume ownership and explicit error handling for write failures ... Root cause of the 500 on create/update/delete: the non-root app user in the Docker container lacked write permission to the volume mount point. Docker volume mounts are owned by root by default; the app user (added in a previous commit) could read the database but not write to it. Fixes: 1. Dockerfile — RUN mkdir -p /app/data before chown so the directory exists in the image with correct ownership. Docker uses this as a seed when initialising a new named volume, ensuring the app user owns the mount point from the start. NOTE: existing volumes from before the non-root user was introduced will still be root-owned. Fix with: docker run --rm -v catalyst-data:/data alpine chown -R 1000:1000 /data 2. server/routes.js — replace bare `throw e` in POST/PUT catch blocks with console.error (route context + error) + explicit 500 response. Add try-catch to DELETE handler which previously had none. Unexpected DB errors now log the route they came from and return a clean JSON body instead of relying on the generic Express error handler. 3. server/db.js — wrap the boot init() call in try-catch. Fatal startup errors (e.g. data directory not writable) now print a clear message pointing to the cause before exiting, instead of a raw stack trace. TDD: tests written first (RED), then fixed (GREEN). Six new tests in tests/api.test.js verify that unexpected DB errors on POST, PUT, and DELETE return 500 with { error: 'internal server error' } and call console.error with the route context string. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 11:11:00 -04:00
joshandClaude Sonnet 4.6	01f83d25f6	fix: SPA deep-link assets and broken home screen CSS ... Three root causes addressed: 1. Added <base href="/"> to index.html so all relative asset paths (css/app.css, js/*.js) resolve from the root regardless of the current SPA route. Without this, /instance/117 requested /instance/css/app.css, which hit the SPA fallback and returned HTML; helmet's nosniff then refused it as a stylesheet. 2. Removed upgrade-insecure-requests from the CSP (useDefaults: false). This directive told browsers to upgrade HTTP→HTTPS for every asset request, breaking all resource loading on HTTP-only deployments. 3. Changed script-src-attr from 'none' to 'unsafe-inline' to allow the inline onclick handlers used throughout the UI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 09:52:48 -04:00
josh	6e40413385	claude went crazy	2026-03-28 02:35:00 -04:00
josh	505315c8bd	adds tests	2026-03-27 23:51:03 -04:00