Hand an inheritor a token that works, and stop claiming one is present without checking
The golden path told a new author to fetch a token from doxa.life/api/maps/token. Measured: that token is URL-restricted to doxa.life, so a tile request without that Referer returns 403 and every basemap in their smoke test renders blank while the pins draw fine. That is exactly the symptom the Driver reported as loading the pins but not the underlying map, and it is why tokenUrl was emptied in the build config the day before. The first command in the hand-off doc reproduced a known bug. It now reads the token from the build config, which is the source that works: same tile request, config token 200, endpoint token 403. That is a pk. public key baked deliberately, protected by URL restrictions rather than secrecy, and check:public-hygiene allows pk. while failing the build on sk. and tk. -- so it is safe to read and never a secret to guard. The doc shows the command, not the key. The aggregator had the same bug and a worse symptom: it fetched from the same endpoint and printed "token present", which meant a string had been obtained, not that it worked. So a run could report a present token while every map gate measured a blank basemap. It now prefers the config token, falls back to the endpoint, and validates whichever it gets with one tile request. Verified in all three states: the config token reports "present and serves tiles", a fabricated token reports "tiles 401 - basemaps will be blank", and the old endpoint token reports "tiles 403 - URL-restricted?". The banner reports what was measured rather than what was fetched.
This commit is contained in:
doxa-maps-88655c70
parent
9d6b0ecd0f
commit
7e1baac4a1
2 changed files with 51 additions and 4 deletions
|
|
@ -99,14 +99,27 @@ a thrown `setup()` removes the subtree silently, and the build stays green.
|
|||
> step exists.
|
||||
|
||||
```sh
|
||||
# a token is required or map profiles cannot mount (see below)
|
||||
MAPBOX_TOKEN=$(curl -s -A "Mozilla/5.0" https://doxa.life/api/maps/token \
|
||||
| python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
|
||||
# A token is required or map profiles cannot mount. Take it from the build config, which is
|
||||
# the one source that works from a local gate — see the note below before changing this.
|
||||
MAPBOX_TOKEN=$(python3 -c "import json;print(json.load(open('vite.doxa-maps-build-config.json'))['token'])")
|
||||
|
||||
MAPBOX_TOKEN=$MAPBOX_TOKEN bun run smoke:embeds # every profile in the manifest
|
||||
MAPBOX_TOKEN=$MAPBOX_TOKEN node internal/embed-smoke.mjs --grep <your-plugin> # just yours
|
||||
```
|
||||
|
||||
> **Do not fetch the token from `https://doxa.life/api/maps/token` here — measured 2026-09-23, it does
|
||||
> not work for this.** That endpoint serves a token URL-restricted to `doxa.life`, so a tile request
|
||||
> without that Referer returns **403** and every basemap in your smoke test renders blank while the pins
|
||||
> draw fine. That is the exact symptom the Driver reported as *"it's loading the pins, but it's not
|
||||
> loading the actual underlying map"*, and it is why `tokenUrl` was emptied in the build config on
|
||||
> 2026-09-22. This doc used to hand you that command, so an inheritor's first run reproduced the bug.
|
||||
>
|
||||
> The `token` field in `vite.doxa-maps-build-config.json` is the one that works: measured, the config
|
||||
> token returns **200** for a tile request with no Referer while the endpoint token returns **403**. It
|
||||
> is a `pk.` public key, baked deliberately (Driver ruling 2026-09-21) so a map works on any host —
|
||||
> protected by URL restrictions rather than secrecy. `check:public-hygiene` allows `pk.` and fails the
|
||||
> build on `sk.`/`tk.`, so this is safe to read and never a secret to guard.
|
||||
|
||||
`smoke:embeds` serves `public/` and opens **every bundle × profile × preconfigured instance** from
|
||||
`manifest.json`, asserting each custom element defines, attaches a shadow root and fills it. Expect
|
||||
`N/N pages mount cleanly`. Measured 2026-09-21: **40/40**.
|
||||
|
|
|
|||
|
|
@ -125,16 +125,50 @@ try {
|
|||
|
||||
// A token is optional: the map gates need one to paint, the chrome gates do not. Fetch once and
|
||||
// share it, rather than letting six gates each pay for the round trip.
|
||||
// ★ "TOKEN PRESENT" USED TO MEAN "A STRING WAS OBTAINED", NOT "A TOKEN THAT WORKS", and the two
|
||||
// differ. The only source here was https://doxa.life/api/maps/token, which serves a token
|
||||
// URL-RESTRICTED to doxa.life: measured 2026-09-23, a tile request without that Referer returns 403,
|
||||
// so every basemap renders blank while the pins draw fine — the exact symptom the Driver reported as
|
||||
// "loading the pins, but not the actual underlying map". This banner still said "(token present)".
|
||||
//
|
||||
// Order matters: the BUILD CONFIG token is tried first because it is the one that works from a local
|
||||
// gate (measured: config token 200, endpoint token 403, same request). It is a `pk.` public key baked
|
||||
// deliberately (Driver ruling 2026-09-21), protected by URL restrictions rather than secrecy;
|
||||
// check:public-hygiene allows pk. and fails the build on sk./tk.. The endpoint stays as a fallback
|
||||
// because a future config may legitimately carry no baked token.
|
||||
//
|
||||
// The token is then VALIDATED with one tile request, so the banner reports what was measured rather
|
||||
// than what was fetched. A gate that computes a value and reports it without checking it is the
|
||||
// defect family this repo keeps finding; the banner is no different.
|
||||
let token = process.env.MAPBOX_TOKEN || ''
|
||||
if (!token) {
|
||||
try {
|
||||
const cfg = JSON.parse(readFileSync(join(ROOT, 'vite.doxa-maps-build-config.json'), 'utf8'))
|
||||
if (typeof cfg.token === 'string' && cfg.token.trim()) token = cfg.token.trim()
|
||||
} catch { /* fall through to the endpoint */ }
|
||||
}
|
||||
if (!token) {
|
||||
try {
|
||||
const r = await fetch('https://doxa.life/api/maps/token', { signal: AbortSignal.timeout(8000) })
|
||||
if (r.ok) token = (await r.json()).token || ''
|
||||
} catch { /* the chrome gates still run; the map gates will say so themselves */ }
|
||||
}
|
||||
let tokenNote = 'NO TOKEN — map gates may report blank'
|
||||
if (token) {
|
||||
try {
|
||||
const t = await fetch(
|
||||
`https://api.mapbox.com/v4/mapbox.mapbox-streets-v8/1/1/1.vector.pbf?access_token=${token}`,
|
||||
{ signal: AbortSignal.timeout(8000) })
|
||||
tokenNote = t.ok
|
||||
? 'token present and serves tiles'
|
||||
: `token present but tiles ${t.status} — URL-restricted? basemaps will be blank`
|
||||
} catch {
|
||||
tokenNote = 'token present, tile check unreachable (offline?)'
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`BROWSER-ALL: ${GATES.length} gate(s) over ${bundleCount} bundle(s) at ${BASE}` +
|
||||
`${token ? ' (token present)' : ' (NO TOKEN — map gates may report blank)'}\n`)
|
||||
` (${tokenNote})\n`)
|
||||
|
||||
const results = []
|
||||
for (const g of GATES) {
|
||||
|
|
|
|||
Loading…
Reference in a new issue