5f9353841b
- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
through the openapi-fetch client typed by the generated schema
7 lines
317 B
TypeScript
7 lines
317 B
TypeScript
// The served index.html carries the admin base in a meta element; tests use a
|
|
// non-default base to prove the SPA reads it at runtime (D-02, D-03).
|
|
const meta = document.createElement('meta')
|
|
meta.setAttribute('name', 'summer-admin-base')
|
|
meta.setAttribute('content', '/admin-test')
|
|
document.head.appendChild(meta)
|