Fix production network issues on app.simplemodule.dev#109
Merged
antosubash merged 2 commits intomainfrom Apr 15, 2026
Merged
Conversation
Live probing of the deployed site surfaced three user-visible 404s / dead links: - Dashboard landing cards and footer advertise /swagger, which is only mounted in Development. Thread isDevelopment through DashboardView and gate both links. - /favicon.ico 404s on every page load because wwwroot only ships favicon.svg. Add a host-level route that serves the SVG at the .ico path with the correct content-type. - Sidebar shows Files and Datasets to authenticated users without the required permission, routing them into AccessDenied on click. MenuItem.Roles was the only filter; the view endpoints use .RequirePermission(). Add MenuItem.RequiredPermission, a reusable ClaimsPrincipal.HasPermission extension (admin bypass + exact + wildcard via existing PermissionMatcher), filter menus on it in InertiaLayoutDataMiddleware, and set the permission on the two offending menu entries. PermissionAuthorizationHandler now delegates to HasPermission so the logic lives in one place, and the "permission" claim type is lifted to WellKnownClaims.Permission.
Deploying simplemodule-website with
|
| Latest commit: |
fc6574e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b608eddd.simplemodule-website.pages.dev |
| Branch Preview URL: | https://feature-agitated-curran.simplemodule-website.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Live probing of https://app.simplemodule.dev surfaced three user-visible network problems; this PR fixes all three:
/swagger404 — the Dashboard landing advertises an API Docs link but Swagger UI is only mounted in Development. TheisDevelopmentprop is already available at the endpoint; threaded throughDashboardViewand used to gate both the card and the footer link./favicon.ico404 on every page load —wwwrootonly shipsfavicon.svg; browsers still auto-fetch the.icopath. Added a smallMapGet("/favicon.ico")in the host that serves the existing SVG bytes withimage/svg+xml..RequirePermission(...)butMenuItemonly had aRolesfilter, so the menu was incoherent with authorization and every click 302'd toAccessDenied. Added:MenuItem.RequiredPermission(nullable string).ClaimsPrincipal.HasPermission(permission)extension — admin bypass + exact match + wildcard via existingPermissionMatcher.InertiaLayoutDataMiddlewarenow filters menus by both role and permission in a single compound predicate.FileStorageModuleandDatasetsModulesetRequiredPermission = XxxPermissions.Viewon their sidebar entries.PermissionAuthorizationHandlernow delegates toHasPermissionso the admin-bypass + wildcard-match logic lives in one place."permission"claim type string is lifted to a newWellKnownClaims.Permissionconstant and used in both call sites.No menu change needed for Map/Layer Sources, Products, Chat, Orders, or Settings — those endpoints are
AllowAnonymous()or accept any authenticated user. Admin and PageBuilder were already role-gated.Test plan
dotnet build— cleandotnet test tests/SimpleModule.Core.Tests— 259/259 pass (includes 6 newHasPermissiontests and the existingPermissionAuthorizationHandlertests that exercise the refactored delegation)dotnet test modules/FileStorage/tests/SimpleModule.FileStorage.Tests— 44/44dotnet test modules/Datasets/tests/SimpleModule.Datasets.Tests— 4/4curl -I https://app.simplemodule.dev/favicon.icoshould return 200