mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-06 08:18:58 +00:00
7b9c652548
Five fixes against the v1 spec: P0 — Reconcile GitHub App callback flow with the CLI's actual mechanism: manifest `redirect_url` (not `callback_urls`) carries the post-creation handoff via browser 302; the install endpoint is renamed to `/install/github/app/redirect` and authorized by OAuth `state` because GitHub strips Authorization across redirects. P1 — Bootstrap fork moves from "precheck inside serve" to the dispatch layer, since today's `commands::server::dispatch` loads settings before `serve` is invoked. Spec out the install bootstrap path explicitly, including skipping the eager dev-token / session-secret creation. P1 — Clarify that the same `fabro-web` bundle hosts the wizard via a server-injected `window.__FABRO_MODE__` flag in `index.html` controlling which router tree mounts at boot. Without this, existing route loaders that call `/api/v1/auth/*` would throw before the install UI renders. P2 — Correct the dev-token path to `<storage_dir>/server.dev-token` (matching `Storage::server_state().dev_token_path()`). P2 — Resolve the dev-token "never exposed to the client" contradiction: JWT keys and session secret stay on the server; the dev token is returned in the `/install/finish` response so the operator can copy it. P2 — Note that the existing OpenAPI conformance test only covers `build_router(...)` and would silently miss install drift. Spec the expansion: split spec iteration by `install` tag, route to the appropriate router, and verify cross-mounting is rejected. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| administration | ||
| agents | ||
| api-reference | ||
| brainstorms | ||
| changelog | ||
| core-concepts | ||
| examples | ||
| execution | ||
| getting-started | ||
| human-tools | ||
| ideation | ||
| images | ||
| integrations | ||
| languages | ||
| logo | ||
| plans | ||
| reference | ||
| superpowers/specs | ||
| tutorials | ||
| workflows | ||
| .mintignore | ||
| docs.json | ||
| dot-highlight.js | ||
| favicon.svg | ||
