pop
/
vibed
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
main
quotesdb
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'main'
${ noResults }
vibed/pages
History
Elijah Voigt 46e7a3dae5 feat(pages): add removable page aliases (serve-direct) 
A page keeps one canonical slug and can have up to 10 long-lived,
removable aliases in the same URL namespace. Serving is serve-direct:
routes::serve falls back to Db::get_page_by_alias on a canonical miss
and serves the canonical page's R2 content under its <slug>/ prefix — no
redirect, no second copy, and a real page always wins over an alias of
the same name.

- migrations: new `aliases` table + idx_aliases_slug (schema.sql +
  idempotent 0003-aliases.sql).
- db.rs: get_page_by_alias, insert_alias (NameTaken on collision),
  delete_alias (page-scoped), list/count/delete-for-page, alias_exists.
- api.rs: POST /api/pages/:slug/aliases (can_upload + owner-or-admin) and
  DELETE /api/pages/:slug/aliases/:alias (owner-or-admin); create_page
  rejects a name held by an alias; delete_page removes a page's aliases;
  GET /api/pages returns each page's aliases[].
- Namespace uniqueness across pages.slug + aliases.alias is enforced in
  the handlers (SQLite can't express the cross-table rule).
- Frontend: alias chips (× to remove) + an "Add alias" button.

Replaces the earlier rename+conditional-redirect idea (dropped for
301-cache fragility). No R2 or behavioral change to existing pages.
196 unit + 20 doctests, both-target clippy clean.

Bean: pages-9lsk.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 		1 day ago
..
.beans feat(pages): add removable page aliases (serve-direct) 1 day ago
docs feat(pages): add removable page aliases (serve-direct) 1 day ago
infra feat(pages): static-site host at pages.elijah.run (v0) 1 week ago
migrations feat(pages): add removable page aliases (serve-direct) 1 day ago
src feat(pages): add removable page aliases (serve-direct) 1 day ago
static feat(pages): add removable page aliases (serve-direct) 1 day ago
.beans.yml feat(pages): static-site host at pages.elijah.run (v0) 1 week ago
.dev.vars.example feat(pages): static-site host at pages.elijah.run (v0) 1 week ago
.gitignore feat(pages): update a page in place via re-upload [pages-ytau] 1 week ago
CLAUDE.md feat(pages): static-site host at pages.elijah.run (v0) 1 week ago
Cargo.lock feat(pages): accept gzip/zstd/xz compressed tar uploads 2 days ago
Cargo.toml feat(pages): accept gzip/zstd/xz compressed tar uploads 2 days ago
README.md feat(pages): update a page in place via re-upload [pages-ytau] 1 week ago
justfile feat(pages): static-site host at pages.elijah.run (v0) 1 week ago
wrangler.toml feat(pages): static-site host at pages.elijah.run (v0) 1 week ago

README.md

pages

A micro static-site host at pages.elijah.run, running entirely on Cloudflare (Workers + R2 + D1) with the Worker written in Rust compiled to WebAssembly.

What it does

  • Browse all live pages at pages.elijah.run.
  • Log in with GitHub, upload a single .html file or a .zip of static assets (drag & drop), pick a name, and the content is served at pages.elijah.run/<name>/.
  • Update a page in place: Update on any page you own re-uploads its content under the same name (the URL never changes, and files the new upload doesn't include are removed).
  • Admins approve which users may upload, and can delete or update any page.

Hosted pages are intended to be client-side-only single-page apps. They are served with a sandboxing Content-Security-Policy (opaque origin): no cookies, no localStorage — see docs/plans/2026-07-12-pages-design.md §2.1. An admin can mark a specific page, or all of a user's pages, as trusted to opt them out of that sandbox (e.g. for local-first apps that need localStorage) — see the "Trust escape hatch" addendum in §2.1 for the exact semantics and the security trade-off that comes with it.

How it works

One Cloudflare Worker routes everything:

  • / — embedded management UI (list, login, upload, admin)
  • /auth/* — GitHub OAuth + session cookies (sessions in D1, hashed)
  • /api/* — JSON API (list/upload/update/delete pages, manage users)
  • /<slug>/* — page content served from R2 with strict security headers

Uploads are validated hard: strict slug grammar + reserved names, zip path-traversal rejection, decompression limits (10 MiB compressed, 25 MiB uncompressed, 300 files). See the design doc for the full security analysis.

Run locally

# from pages/
cp .dev.vars.example .dev.vars   # fill in a GitHub OAuth app's id/secret
wrangler d1 execute pages --local --file migrations/schema.sql
wrangler dev                      # builds via worker-build and serves locally

Test

# from pages/
cargo fmt
cargo check --target wasm32-unknown-unknown
cargo clippy --all-targets -- -D warnings
cargo test

Deploy

Infrastructure (R2 bucket, D1 database, DNS, rate limits) is OpenTofu in infra/; the Worker itself deploys with wrangler deploy (see infra/README.md). Secrets via wrangler secret put GITHUB_CLIENT_SECRET.

License

Dual-licensed under Apache-2.0 and MIT, like the rest of this repository.

Disclaimer

This software was written with Claude Code. Design, review and orchestration by Claude Fable 5 (claude-fable-5); implementation by Claude Sonnet agents with Claude Opus review agents.