You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

History

Elijah Voigt bc4c952533 feat(pages): update a page in place via re-upload [pages-ytau] Updating a page meant deleting it and re-creating it under the same name. Add PUT /api/pages/:slug, which replaces an existing page's content while keeping its URL, owner, trust flag, and created_at. Authorized to owner-or-admin (core::origin::can_replace, same rule as delete) and can_upload, so a revoked uploader can't keep pushing content to pages they already own. The replace can't roll back the way create does — R2 has no multi-object transaction and the previous bytes aren't retained — so the ordering bounds the damage instead: new objects are written before any old key is deleted (a viewer mid-update sees old-or-new per file, never a blank page), stale keys are pruned last and best-effort (a failure only orphans an object), and the D1 stats are refreshed only once R2 succeeds. Design §4.6b covers the reasoning; §5's "no page overwrite" scope cut is retired. In the UI, the always-visible upload card becomes a modal driven by two entry points: "+ New Page" (create) and a per-row "Update" (replace, with the slug pre-filled and read-only). Verified end to end against wrangler dev with local D1/R2 — create, serve, replace, stale assets pruned, stats/trust/ownership preserved, plus the 401/403/404/400/413 paths — and the UI driven in jsdom (37 assertions). 152 unit + 19 doctests, both-target clippy clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		1 week ago
..
.beans	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
docs	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
infra	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
migrations	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
src	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
static	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
.beans.yml	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
.dev.vars.example	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
.gitignore	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
CLAUDE.md	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
Cargo.lock	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
Cargo.toml	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
README.md	feat(pages): update a page in place via re-upload [pages-ytau]	1 week ago
justfile	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago
wrangler.toml	feat(pages): static-site host at pages.elijah.run (v0)	1 week ago

README.md

pages

A micro static-site host at pages.elijah.run, running entirely on Cloudflare (Workers + R2 + D1) with the Worker written in Rust compiled to WebAssembly.

What it does

Browse all live pages at pages.elijah.run.
Log in with GitHub, upload a single .html file or a .zip of static assets (drag & drop), pick a name, and the content is served at pages.elijah.run/<name>/.
Update a page in place: Update on any page you own re-uploads its content under the same name (the URL never changes, and files the new upload doesn't include are removed).
Admins approve which users may upload, and can delete or update any page.

Hosted pages are intended to be client-side-only single-page apps. They are served with a sandboxing Content-Security-Policy (opaque origin): no cookies, no localStorage — see docs/plans/2026-07-12-pages-design.md §2.1. An admin can mark a specific page, or all of a user's pages, as trusted to opt them out of that sandbox (e.g. for local-first apps that need localStorage) — see the "Trust escape hatch" addendum in §2.1 for the exact semantics and the security trade-off that comes with it.

How it works

One Cloudflare Worker routes everything:

/ — embedded management UI (list, login, upload, admin)
/auth/* — GitHub OAuth + session cookies (sessions in D1, hashed)
/api/* — JSON API (list/upload/update/delete pages, manage users)
/<slug>/* — page content served from R2 with strict security headers

Uploads are validated hard: strict slug grammar + reserved names, zip path-traversal rejection, decompression limits (10 MiB compressed, 25 MiB uncompressed, 300 files). See the design doc for the full security analysis.

Run locally

# from pages/
cp .dev.vars.example .dev.vars   # fill in a GitHub OAuth app's id/secret
wrangler d1 execute pages --local --file migrations/schema.sql
wrangler dev                      # builds via worker-build and serves locally

Test

# from pages/
cargo fmt
cargo check --target wasm32-unknown-unknown
cargo clippy --all-targets -- -D warnings
cargo test

Deploy

Infrastructure (R2 bucket, D1 database, DNS, rate limits) is OpenTofu in infra/; the Worker itself deploys with wrangler deploy (see infra/README.md). Secrets via wrangler secret put GITHUB_CLIENT_SECRET.

License

Dual-licensed under Apache-2.0 and MIT, like the rest of this repository.

Disclaimer

This software was written with Claude Code. Design, review and orchestration by Claude Fable 5 (claude-fable-5); implementation by Claude Sonnet agents with Claude Opus review agents.