Admin nav owner only - #12
Merged
Merged
Conversation
The 0.2.2 release payload, plus the dependency work that had to land with it. dash-clerk-auth 0.9.1 -> 1.0.0, and lib/auth.py stops hand-patching the satellite. Both fixes it injected are upstream now: 0.9.1 stamps data-clerk-domain onto the ClerkJS script tag, 0.9.2 replaced the Clerk.openSignIn() modal — forbidden on a satellite domain — with a navigation to the primary. What stays is one *delegated* capture-phase listener on #clerk-login-button. The package binds that id inside its DOMContentLoaded handler, once, so the header control is covered but the sign-in card in lib/page_visibility.py is not: a page callback renders it when a visitor reaches an auth-tier page, long after that handler ran, and its button would have no listener at all. The listener now defers to the package's own buildSatelliteRedirect() (0.9.2's page-JS surface, opt-in via CLERK_SATELLITE_SIGN_IN_REDIRECT) and otherwise makes the same redirectToSignIn() call upstream does. 1.0.0 requires Python >=3.10 (clerk-backend-api 5.x publishes no 3.9 build, so the old >=3.9 claim was never installable). That binds the docs site only — Docker is 3.12, the CI docs matrix is 3.10/3.12/3.13. The dash_leaflet2 package keeps requires-python >=3.9, which package-python-range proves against the wheel. dash-emoji-mart and flexlayout-dash now install from PyPI instead of vendored tarballs, keeping load-bearing floors: >=0.0.5 (0.0.3 errors on init) and >=1.1.0 (that release renamed the import to flexlayout_dash, which docs/walking-sim/example.py imports directly). Both re-enter CI's pip-audit, which skips ./vendor/ lines because pip-audit can only assess PyPI dists. vendor/ is down to the single Clerk tarball. README: the 2plot mark now sits inside the anchor, above the wordmark. Verified: smoke 72/72, check_release clean for 0.2.2, flake8 clean, injected JS parses, and the rebuilt sdist/wheel carry the README with no vendor/docs leaks. The requirements.txt resolve itself is the one thing not provable offline — CI covers it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Production was serving /llms.txt, /sitemap.xml and every canonical link pointing at http://localhost:8050, and nothing looked wrong from anywhere you would think to look: the site rendered, /healthz returned 200, and tests/test_network_surfaces.py passed — it asserts sitemap URLs start with BASE_URL, comparing the deployed value against itself, which is just as true when both sides are localhost. The code default was never at fault; lib/constants.py already falls back to https://leaflet.2plot.dev. A loopback value can ONLY come from APP_BASE_URL or DASH_LEAFLET2_BASE_URL being explicitly set to one — and .env.example ships exactly those, uncommented, for local use. render.yaml declares the right values but a Render blueprint does not overwrite a variable edited in the dashboard, so a bad value there survives every deploy. Nothing here self-heals. Filling in Render's RENDER_EXTERNAL_URL would swap one wrong canonical origin (*.onrender.com) for another, quietly, which is worse than the bug. - lib.constants.base_url_misconfigured() returns an actionable message when a hosted service (RENDER_EXTERNAL_HOSTNAME present) resolved BASE_URL to a loopback origin, naming which of the two variables is at fault. - run.py prints the resolved base URL at boot, and that warning after it. - /healthz reports base_url, so the origin a satellite ADVERTISES is checkable from outside it with one curl — and the hub's hourly sweep can flag any satellite whose advertised origin is not where it was polled. This is a shared drop-in module; the same field belongs in the other satellites. - .env.example says its values are local-only and why. - DEPLOYMENT.md and RELEASING.md lead their post-deploy checklists with the base_url check, and note that the test suite cannot catch this for you. Verified: the guard warns on hosted+localhost via either variable and stays quiet for local dev, for the correct origin, and for a hosted deploy with neither variable set. flake8 clean, smoke 72/72, 98 tests pass, check_release clean for 0.2.2. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.