d704e24244
The bearer-token middleware was mounted globally on the Express app, so the initial GET /?token=<token> request for index.html was rejected with 401 before the frontend JS could even load and capture the token from the URL. The server-side query-string fallback only accepts fn_token=, while the banner URL uses ?token= (which only the frontend captures), so the bootstrap request had no valid auth path. Fix: gate auth on /api/* only. The SPA shell (index.html, /assets/*, favicon) is public — it contains no secrets, and the frontend auth.ts module captures the token into localStorage and installs a fetch wrapper that injects Authorization: Bearer on every /api/* call. Also: add .env / .env.local to .gitignore so local FUSION_DAEMON_TOKEN values don't accidentally get committed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.0 KiB
Plaintext
53 lines
1.0 KiB
Plaintext
# Environment files (may contain secrets — FUSION_DAEMON_TOKEN, etc.)
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Build output
|
|
dist/
|
|
*.tsbuildinfo
|
|
|
|
# Coverage reports
|
|
coverage/
|
|
|
|
# hai runtime (local board state — don't commit)
|
|
.fusion/
|
|
.hai/
|
|
.worktrees/
|
|
.factory/
|
|
kb.db/
|
|
|
|
# Stray worktrees accidentally created at the repo root by the executor
|
|
# or by manual `git worktree add` invocations. Without this, any such
|
|
# directory gets captured as a 160000 gitlink by `git add -A` during
|
|
# merger amend, producing broken submodule entries in HEAD (see FN-2152).
|
|
.tmp-fn-*
|
|
.tmp-kb-*
|
|
|
|
# Pi
|
|
.pi/
|
|
|
|
# VS Code Local History (editor auto-saved snapshots)
|
|
.history/
|
|
|
|
# Ad-hoc task completion notes left by agents after a run; per-session scratch,
|
|
# never meant to be committed.
|
|
.DONE
|
|
|
|
# Local kb state and backups
|
|
.kb/
|
|
.fusion-backup/
|
|
.fusion-backup-*/
|
|
|
|
# Stray runtime databases
|
|
fusion.db
|
|
fusion.db-wal
|
|
fusion.db-shm
|
|
|
|
# Capacitor mobile platform directories (generated by `cap add`)
|
|
packages/dashboard/ios/
|
|
packages/dashboard/android/
|