diff --git a/workspace/_assets_/nav-data.js b/workspace/_assets_/nav-data.js index f445e21..fff2afe 100644 --- a/workspace/_assets_/nav-data.js +++ b/workspace/_assets_/nav-data.js @@ -49,6 +49,7 @@ var NAV_DATA = { title: 'History', path: 'history/index.html', children: [ + { title: 'Tuesday, 15 July 2026', path: 'history/2026/07-July/15-Tuesday/index.html' }, { title: 'Monday, 14 July 2026', path: 'history/2026/07-July/14-Monday/index.html' }, { title: 'Sunday, 13 July 2026', path: 'history/2026/07-July/13-Sunday/index.html' }, { title: 'Sunday, 12 July 2026', path: 'history/2026/07-July/12-Sunday/index.html' }, diff --git a/workspace/boards/backlog.html b/workspace/boards/backlog.html index acdebff..29414d7 100644 --- a/workspace/boards/backlog.html +++ b/workspace/boards/backlog.html @@ -22,31 +22,6 @@
MVP
- - styles.rokojori.com - - New asset and font hosting service at styles.rokojori.com. Hosts Google Fonts - (downloaded and self-served), CSS presets, components, and images for use - across all rokojori websites. - - Auth via shared JWT cookie from rokojori-auth. Access gated by requireAccess - middleware (already designed and documented in rokojori-auth workspace). - PATCH /api/admin/users/:id/products is live in rokojori-auth — assign the - "styles" product to grant access. - - Pages: - — / — logged-out or no-permission users see "STYLES" + login button linking - to account.rokojori.com/login?redirect=https://styles.rokojori.com; - logged-in users with access see list of available sections - — /list-fonts — preview-sentence input at top, then all font families rendered - with that sentence - — /add-fonts — preview-sentence input + font-family name input; downloads from - Google Fonts and generates a stylesheet - - Access rules: role:admin, role:user + product:styles, role:user + product:premium - - - Local Git Repository Integration diff --git a/workspace/boards/bugs.html b/workspace/boards/bugs.html index cb6a9e7..6eb1c73 100644 --- a/workspace/boards/bugs.html +++ b/workspace/boards/bugs.html @@ -25,9 +25,11 @@ 401 Not Handled in Data-Fetching Components - Components that fetch data (groups, projects, etc.) do not handle 401 responses - gracefully — they crash when the API returns an error object instead of an array. - Should show an appropriate message or redirect to login. + Components that fetch data do not handle 401 responses gracefully — they crash + when the API returns an error object instead of an array. Groups and the old + projects page have been removed; the current surfaces to check are project-home + and its theme components (project-list-default). Should show an appropriate + message or redirect to the refresh-session endpoint when a 401 is received. diff --git a/workspace/boards/tasks.html b/workspace/boards/tasks.html index a83336f..2fc759f 100644 --- a/workspace/boards/tasks.html +++ b/workspace/boards/tasks.html @@ -83,6 +83,23 @@ + + Investigate session logout after ~1 hour + + Users are logged out after a couple of hours. The access token issued by + rokojori-auth expires after 1 hour; the refresh token lasts 30 days. + Roject should silently refresh via GET account.rokojori.com/api/auth/refresh-session + before the token expires. + + Investigate: + — Is the 401 response from any API route triggering a redirect to refresh-session? + — Is the refreshToken cookie present and being sent cross-domain? + — Is the refresh-session endpoint actually rotating both cookies correctly? + — Check journalctl on the server for 401 patterns and the browser network tab + for which request first returns 401. + + + Switch Gitea webhook to dev branch @@ -96,6 +113,18 @@
In Progress
+ + styles.rokojori.com — complete deployment + + Service is built and running manually via npm start on the server. + Remaining work: + — Set up systemd service (styles-rokojori.service) so it survives restarts + — Download Barlow from /add-fonts (weights 100, 400, 700, 900) + — Verify CORS is working for roject.rokojori.com font imports + — Add to the add-subdomain deployment guide as a reference example + + + Local Filesystem Access diff --git a/workspace/history/2026/07-July/15-Tuesday/index.html b/workspace/history/2026/07-July/15-Tuesday/index.html new file mode 100644 index 0000000..fccd825 --- /dev/null +++ b/workspace/history/2026/07-July/15-Tuesday/index.html @@ -0,0 +1,120 @@ + + + + + + Tuesday, 15 July 2026 — Roject + + + + +
+ +
+

Tuesday, 15 July 2026

+

Session History

+

styles.rokojori.com built and deployed; Roject font migration; add-subdomain deployment guide.

+
+ +
+

What we built

+ +
+

styles.rokojori.com — new service

+

+ Built a new standalone asset hosting service from scratch at + styles.rokojori.com. Same stack as the other rokojori services: + Node.js + Express + ts-node, no external database, Web Components + raw CSS on + the frontend. +

+

Key pieces:

+
    +
  • GET /get-font — public CSS endpoint; three modes: all weights, specific weights (+ auto-italic), or explicit variations. Returns @font-face CSS; font files served statically from storage/fonts/.
    • +
  • POST /api/fonts/download — auth-gated; hits Google Fonts API with a browser User-Agent to get woff2 URLs, downloads each file, writes meta.json.
    • +
  • GET /api/fonts — auth-gated; lists all downloaded font families and their available weights/italics.
    • +
  • CORS allowlist middleware — checks Origin header against *.rokojori.com regex; echoes origin back only if matched. Public * header explicitly avoided.
    • +
  • Auth — shared JWT cookie from rokojori-auth; requireAccess middleware copied from auth workspace (role: admin, or user + product: styles / premium). HTML pages redirect to login; API routes return 401/403 JSON.
    • +
  • Pages — / detects auth state via fetch and shows hero or sections list; /list-fonts renders all families with live preview sentence; /add-fonts takes family name + optional weights, downloads, shows inline preview.
    • +
+
+ +
+

Roject — font migration and page cleanup

+

+ Removed three stale pages: dashboard.html, groups.html, + projects.html — all superseded by the project-home redesign from the + previous session. +

+

+ Migrated Barlow font loading from Google Fonts to styles.rokojori.com: + removed the three Google Fonts <link> tags from + source/pages/index.html and added + @import url('https://styles.rokojori.com/get-font?family=barlow&weights=100,400,700,900') + at the top of project-list-default.css. The theme now self-describes + its font dependency; no Google dependency at runtime. +

+
+ +
+

rokojori-auth workspace — add-subdomain deployment guide

+

+ Created workspace/add-subdomain.html — a step-by-step deployment + checklist for adding any new rokojori subdomain service to Server A. Covers: + Gitea repo creation, .gitignore, DNS on IONOS, server clone, install/build/env, + nginx HTTP config, Let's Encrypt via certbot, nginx HTTPS verification, and + systemd service setup. +

+

+ The guide has an interactive variables bar at the top (subdomain, port, service + name) — all commands throughout the page update live via JS as you type. + systemd unit file format matched to the Roject convention: + /usr/bin/npx ts-node, Restart=on-failure, + StandardOutput/Error=journal. + Added a step 0 explaining the CORS allowlist pattern with full code example. +

+
+
+ +
+

Key decisions

+ +
+

Font files are woff2-only, named numerically

+

+ Convention: 400.woff2, 400-italic.woff2. No "bold" + alias — numeric weights only. woff2 has near-universal browser support; no + fallback formats needed. +

+
+ +
+

CORS restricted to *.rokojori.com, not wildcard

+

+ Access-Control-Allow-Origin: * was rejected in favour of an + allowlist that echoes back the matched origin. The regex + /^https?:\/\/([\w-]+\.)?rokojori\.com$/ covers all current and + future subdomains. Extra origins can be added as strings or regexes to the + CORS_ALLOWED array. +

+
+ +
+

styles.rokojori.com scope expanded

+

+ Initially conceived as a font host; scope widened to a general shared-asset + platform: fonts now, shared HTML components / Web Components, CSS presets, and + binary assets (images, sounds, video) planned. +

+
+
+ +
+ Roject — session history +
+ +
+ + + + + diff --git a/workspace/history/index.html b/workspace/history/index.html index 3d6fb68..1010315 100644 --- a/workspace/history/index.html +++ b/workspace/history/index.html @@ -19,6 +19,11 @@

2026 — July

+
+

Tuesday, 15 July 2026

+

styles.rokojori.com built and deployed (font hosting, /get-font public CSS endpoint, CORS allowlist, auth-gated management pages); Roject Barlow font migrated from Google Fonts; old dashboard/groups/projects pages removed; add-subdomain deployment guide with live variable inputs.

+
+

Monday, 14 July 2026

Electron desktop app shell, workspace boards system. Full project home redesign: new / entry point, project-home component (hero / theme dispatch), default theme (logo nav, UUID-coloured badges, Barlow skewed names, new-project dialog), user settings backend, groups removed from UI.

diff --git a/workspace/outline/index.html b/workspace/outline/index.html index b7d1d5a..9193937 100644 --- a/workspace/outline/index.html +++ b/workspace/outline/index.html @@ -76,6 +76,28 @@ persisted server-side in user_settings.json via GET / PUT /api/user/settings. A second theme (Italic Neon) is planned. /edit redirects to the existing /editor.html. + Barlow is loaded via @import from styles.rokojori.com + (weights 100, 400, 700, 900 including italics) — no Google Fonts dependency. +

+
+ +
+

Ecosystem — styles.rokojori.com

+

+ A shared asset hosting service for all rokojori projects, live at + styles.rokojori.com. Currently serves self-hosted fonts downloaded + from Google Fonts on demand via a GET /get-font public endpoint that + returns a dynamic CSS file with @font-face rules. Font files are + stored as storage/fonts/<family>/<weight>.woff2 and + served statically. CORS is restricted to *.rokojori.com origins. + Access to the management UI (/list-fonts, /add-fonts) + is gated by the shared JWT cookie via requireAccess middleware + (role: admin, or role: user + product: styles / premium). +

+

+ Planned: shared HTML components / Web Components, CSS presets, and binary assets + (images, sounds, video) — making styles.rokojori.com the single place to manage + any reusable front-end resource across the rokojori ecosystem.