feat(admin): Scaffold Vite/Svelte admin SPA with oAuth - #240

Merged

ifireball merged 28 commits into

fullsend-ai:mainfrom

ifireball:feat/admin-spa-vite-docs-pr

May 3, 2026

Commits on Apr 29, 2026

chore(toolchain): pin Node and Go with mise
ifireball
committed
8479af3
docs(plan): admin SPA implementation plan and spec updates
ifireball
committed
72fddac
feat(admin): SPA package, Vite workspace, worker merge, and site CI
ifireball
committed
6121ed2
docs(web): admin local dev and root Vite layout
ifireball
committed
6794c45
feat(admin): plan tasks 3–7 for production OAuth
ifireball
committed
e975c48
ci: run Vitest and svelte-check in CI workflow
ifireball
committed
caaa429
refactor(oauth): Worker-mediated GitHub authorize; drop SPA build-time client id
ifireball
committed
b384b1c
docs(admin): align OAuth plans with Worker layout and High 1 hardening
ifireball
committed
f8bd0fc
feat(admin): require Turnstile, OAuth BFF hardening, Wrangler rate limits
ifireball
committed
2f12ea0
fix(admin): Turnstile loader, /api/github/user CORS, looser rate limits
ifireball
committed
5f841a6
feat(admin): boot spinner and single GitHub user fetch
ifireball
committed
be2c28d
test(admin): expand OAuth and auth BFF coverage for PR #240 High 3
ifireball
committed
afa2de2
fix(admin): honor token expiry in storage and OAuth completion
ifireball
committed
e41cff8
test(admin): cover startGithubSignIn and consumeOAuthParamsFromDocumentUrl
ifireball
committed
da3b8c7
ci(site): derive ratelimit namespace_id from Worker name in deploy
ifireball
committed
dc6682b
fix(admin): clear stored token on GitHub /user 401
ifireball
committed
e6bbf90
test(worker): add vitest coverage for admin API worker
ifireball
committed
9f08d61
docs: admin Worker OAuth CORS and safety model
ifireball
committed
b87513f
test(worker): expand admin API Vitest coverage
ifireball
committed
2d2ccf2
fix(site-deploy): wrangle multi-var syntax
ifireball
committed
6dc57d6
fix(site): run worker first for /api so OAuth authorize navigations work
ifireball
committed
d537b8a
fix(site-deploy): patch wrangler.toml name for secret bulk target
ifireball
committed
e6341e3
fix(admin-oauth): narrow BFF /github/user; document redirect allowlist
ifireball
committed
5bab281
fix(worker): handleAdminApi 404 fallthrough must use corsHeaders(corsOrigin)
ifireball
committed
fc70542
fix(admin): Turnstile deadline + OAuth abort; fix Octokit 401 hook
ifireball
committed
ef49506

Commits on Apr 30, 2026

chore(admin): drop unreachable Octokit 401 check on success path
ifireball
committed
3c95c5b

Navigation Menu

feat(admin): Scaffold Vite/Svelte admin SPA with oAuth - #240

feat(admin): Scaffold Vite/Svelte admin SPA with oAuth#240
ifireball merged 28 commits into
fullsend-ai:mainfrom
ifireball:feat/admin-spa-vite-docs-pr

Commits on Apr 29, 2026

chore(toolchain): pin Node and Go with mise

docs(plan): admin SPA implementation plan and spec updates

feat(admin): SPA package, Vite workspace, worker merge, and site CI

docs(web): admin local dev and root Vite layout

feat(admin): plan tasks 3–7 for production OAuth

ci: run Vitest and svelte-check in CI workflow

refactor(oauth): Worker-mediated GitHub authorize; drop SPA build-time client id

docs(admin): align OAuth plans with Worker layout and High 1 hardening

feat(admin): require Turnstile, OAuth BFF hardening, Wrangler rate limits

fix(admin): Turnstile loader, /api/github/user CORS, looser rate limits

feat(admin): boot spinner and single GitHub user fetch

test(admin): expand OAuth and auth BFF coverage for PR #240 High 3

fix(admin): honor token expiry in storage and OAuth completion

test(admin): cover startGithubSignIn and consumeOAuthParamsFromDocumentUrl

ci(site): derive ratelimit namespace_id from Worker name in deploy

fix(admin): clear stored token on GitHub /user 401

test(worker): add vitest coverage for admin API worker

docs: admin Worker OAuth CORS and safety model

test(worker): expand admin API Vitest coverage

fix(site-deploy): wrangle multi-var syntax

fix(site): run worker first for /api so OAuth authorize navigations work

fix(site-deploy): patch wrangler.toml name for secret bulk target

fix(admin-oauth): narrow BFF /github/user; document redirect allowlist

fix(worker): handleAdminApi 404 fallthrough must use corsHeaders(corsOrigin)

fix(admin): Turnstile deadline + OAuth abort; fix Octokit 401 hook

Commits on Apr 30, 2026

chore(admin): drop unreachable Octokit 401 check on success path

Commits on May 1, 2026

chore(gitignore): ignore .claude/settings.local.json (align with main merge)

Merge upstream/main into feat/admin-spa-vite-docs-pr