- scripts/check-phase19.5.sh: go, userplugin, sociallogin, demo, bm,
fonoteka, docker and docs stages across six repositories
- go test -json detector fails on a failed, skipped, missing or zero test;
vitest detector requires oauth.test.ts and refuses skips
- additive user-plugin check against 4c5d3b8 and no updates/ change (D-22)
- --self-test proves the detectors and the docker NOT RUN rule
sm-sociallogin-plugin mounted in sm-demo-app and sm-bm-app (Microsoft 365
with the frontend callback, consent and link-ticket views), fonoteka.go
pinned to sm-user-plugin v0.1.4. User setup for the Entra registration;
one unrelated fonoteka route-inventory failure deferred.
- sm-sociallogin-plugin v0.1.0 (private repo), pinned to summercms v0.3.1
and sm-user-plugin v0.1.4, all pushed and tagged in D-21 order
- v0.3.1 changelog posted after the User-Agent fix (fix-ua)
The layers read NUXT_CACHE_PURGE_TOKEN and strip the purge keys from
nuxt-site-config; demo.summercms.io and summercms.io/changelog run the
fixed builds with rotated tokens (check-live ok, 0 purge keys live).
Negotiation table (Sec-Fetch-Mode, X-Requested-With, Accept q values, the
32-range cap, /api, /_ and admin paths), byte equality with the
http.error_pages.enabled false router for curl, fetch, XHR and JSON
clients, page content and headers for every covered status, details
gating and escaping, renderer override and fallbacks, the admin prefix
and the uploads route.
A browser navigation (Sec-Fetch-Mode navigate, or GET/HEAD without it; no
X-Requested-With; Accept naming text/html above every JSON type; not /api,
/_<name> or the admin prefix) that hits a framework-generated 404, 405 or
500 gets a self-contained SummerCMS page: unmatched routes and wrong
methods at the ServeMux, failed Where/WhereIn constraints, overlap-family
misses, the unpublished uploads route and recovered panics. Every other
request keeps the exact stdlib text, wire's opaque JSON 500 or the bare
raw-group 500.
Details (method, path, X-Request-Id) only with app.debug or outside
production. Applications replace the page with a published
surf.ErrorPageRenderer; http.error_pages.enabled false turns it off.
When a public image's thumb_url or url fails to load, the fileupload
field fetches its preview once through the authenticated thumb route
(session key in the header) and shows it from an object URL, revoked
when the item is forgotten and on unmount. The preview is reported as
unavailable only when that fetch or the object-URL image fails too.
Protected fields behave as before.
The record and relation-child thumb routes now also serve the thumbnail
of a public JPEG, PNG, GIF or WebP file, under the same record or
pending-session scope and D-10 headers as a protected one, so the admin
can preview a public image whose public URL does not load. The download
routes still answer 404 for every public file, and a public non-image
thumb stays 404.
TestPublicImageThumb covers owner, foreign and hidden records, image
types, a public row under a protected field, another admin's pending
upload and the relation-child route.
