Recreate the embed directory so stale dotfiles cannot be served

Review finding F1: the cleanup glob internal/frontend/dist/* skipped hidden files, which all:dist embeds. Remove and recreate the whole directory before copying web/dist, and add a check-embed-clean target that plants a stale hidden file and asserts the embed removes it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add make build to embed the built PWA in the server binary
2026-10-02 22:44:33 -04:00 · 2026-10-02 22:40:46 -04:00 · 2026-10-02 22:36:51 -04:00 · 2026-10-02 22:29:41 -04:00
3 changed files with 3 additions and 107 deletions
@@ -1,26 +0,0 @@
-# Keep the build context small and free of secrets and local state.
-.git
-.gitignore
-.dockerignore
-Dockerfile
-.remember/
-.claude/
-design/
-**/.DS_Store
-node_modules
-web/node_modules
-web/dist
-# Generated embed output; the Go stage takes the PWA from the web stage.
-internal/frontend/dist/
-bin/
-*.db
-*.db-*
-.env*
-**/.env*
-deploy/secrets/
-**/*.pem
-**/*.key
-**/*.p12
-**/*.pfx
-**/*.jks
-**/*.keystore
@@ -1,42 +0,0 @@
-# syntax=docker/dockerfile:1
-# Base images are pinned by digest (multi-arch index); tags are for readability.
-
-FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS web
-WORKDIR /src/web
-COPY web/package.json web/package-lock.json ./
-RUN npm ci
-COPY web/ ./
-RUN npm run build
-
-FROM golang:1.25-alpine@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59 AS server
-ARG VERSION=dev
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-# Replace the placeholder with the built PWA; recreate the directory so no
-# stale file survives into the embed.
-RUN rm -rf internal/frontend/dist
-COPY --from=web /src/web/dist/ internal/frontend/dist/
-RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" \
-    -o /out/mealquest ./cmd/server
-
-# Alpine ships the CA bundle and busybox wget for the health check.
-FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
-RUN addgroup -S -g 10001 mealquest \
-    && adduser -S -D -H -u 10001 -G mealquest mealquest \
-    && mkdir /data && chown mealquest:mealquest /data
-COPY --from=server /out/mealquest /usr/local/bin/mealquest
-ENV MEALQUEST_HTTP_ADDR=:8080 \
-    MEALQUEST_DATA_DIR=/data
-VOLUME /data
-EXPOSE 8080
-USER 10001:10001
-# Probe the listener from MEALQUEST_HTTP_ADDR: host is everything before the
-# last colon (IPv6 keeps its brackets). Wildcard hosts map to loopback, as
-# does localhost: Go listens on its IPv4 address but wget would try ::1.
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD host="${MEALQUEST_HTTP_ADDR%:*}"; \
-    case "$host" in ""|0.0.0.0|"[::]"|localhost) host=127.0.0.1 ;; esac; \
-    wget -q -O /dev/null "http://${host}:${MEALQUEST_HTTP_ADDR##*:}/health" || exit 1
-ENTRYPOINT ["/usr/local/bin/mealquest"]
@@ -1,44 +1,11 @@
-# MealQuest build entry points.
-#
-#   make dev     Go server on :8080 plus Vite dev server on :5173 (proxies
-#                /api, /auth, /media to :8080). Needs the MEALQUEST_* env set.
-#   make test    gofmt check, go vet, go test -race, npm typecheck and test.
-#   make build   Build the PWA, embed it, build the static binary bin/mealquest.
-#   make docker  Build the container image from ./Dockerfile.
+# Build entry point: build the PWA, embed it, then build the server binary.

 FRONTEND_DIST := internal/frontend/dist
-# Dirty means a tracked change outside the generated embed output, which
-# `make embed` rewrites; plain `--dirty` would flag every rebuild.
-GIT_DIRTY := $(shell git status --porcelain --untracked-files=no -- . ':(exclude)$(FRONTEND_DIST)' 2>/dev/null)
-VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo dev)$(if $(GIT_DIRTY),-dirty)
-IMAGE ?= mealquest:$(VERSION)
-LDFLAGS := -s -w -X main.version=$(VERSION)

-.PHONY: dev test go-test web-test build web embed check-embed-clean docker
-
-# Run both servers; Ctrl-C (or either exiting) stops both. The binary is built
-# first and run directly because `go run` would orphan its child on kill.
-dev: SHELL := /bin/bash
-dev:
-	go build -ldflags "$(LDFLAGS)" -o bin/mealquest-dev ./cmd/server
-	@trap 'kill $$(jobs -p) 2>/dev/null; wait' EXIT; \
-	bin/mealquest-dev & \
-	(cd web && exec npm run dev) & \
-	wait -n
-
-test: go-test web-test
-
-go-test:
-	@unformatted="$$(gofmt -l .)"; \
-	if [ -n "$$unformatted" ]; then echo "gofmt needed:"; echo "$$unformatted"; exit 1; fi
-	go vet ./...
-	go test -race ./...
-
-web-test:
-	cd web && npm ci && npm run typecheck && npm test
+.PHONY: build web embed check-embed-clean

 build: embed
-	CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o bin/mealquest ./cmd/server
+	go build -o bin/mealquest ./cmd/server

 web:
 	cd web && npm ci && npm run build
@@ -55,6 +22,3 @@ check-embed-clean:
 	touch $(FRONTEND_DIST)/.stale-embed-check
 	$(MAKE) embed
 	test ! -e $(FRONTEND_DIST)/.stale-embed-check
-
-docker:
-	docker build --build-arg VERSION=$(VERSION) -t $(IMAGE) .
Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	7ba2a37da2	Recreate the embed directory so stale dotfiles cannot be served Independent review Approved — 0 high findings (#4) Details Review finding F1: the cleanup glob internal/frontend/dist/* skipped hidden files, which all:dist embeds. Remove and recreate the whole directory before copying web/dist, and add a check-embed-clean target that plants a stale hidden file and asserts the embed removes it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 22:44:33 -04:00
dev_agentandClaude Opus 5.5	8236c5e349	Add make build to embed the built PWA in the server binary Independent review Not signed off — 0 high, 1 medium (#4) Details Fixes review finding F1: nothing copied web/dist into internal/frontend/dist, so the server always embedded the placeholder. make build now builds the web app, replaces internal/frontend/dist with web/dist, and builds bin/mealquest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 22:40:46 -04:00
dev_agentandClaude Opus 5.5	efae9bed7e	Keep reserved prefixes out of the SPA fallback under dot segments Independent review Not signed off — 1 high (#4) Details Address review findings F1 and F2: - F1: check reserved prefixes against the request path before and after cleaning, so /auth/../quests/42 and /api%2F..%2Fquests/42 get the JSON 404 instead of index.html. Add frontend and router tests for both. - F2: add an unhashed asset (robots.txt) to the frontend fixture and assert its status, body and immutable Cache-Control. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 22:36:51 -04:00
dev_agentandClaude Opus 5.5	ee4670754a	Embed the PWA build and serve it with SPA fallback Independent review Not signed off — 0 high, 1 medium, 1 low (#4) Details Add internal/frontend, which embeds internal/frontend/dist and serves it with Cache-Control "no-cache" for index.html, sw.js and manifest.webmanifest and "public, max-age=31536000, immutable" for every other asset. Any other GET or HEAD falls back to index.html, except paths under the reserved /api, /auth, /media and /health prefixes, which get the JSON not_found error instead. NewRouter now takes the asset fs.FS so tests use a fstest.MapFS fixture, mounts an /api subrouter with JSON 404/405 handlers, and fails fast if the assets lack index.html. A placeholder dist/index.html is tracked so a fresh clone compiles; built assets remain git-ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 22:29:41 -04:00