From 8c72b8a309d8aaedb3cb6f94a5b4e6e7206036c3 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Tue, 29 Sep 2026 03:37:56 +0000 Subject: [PATCH] Cloud README: GET /admin/status is for anyone signed in; only POST /admin/build is admin-only The route table put both under OIDC_ADMIN_GROUPS. admin.mjs checks the admin group on the build only; status answers any signed-in team member (commit SHAs and build state, nothing more). Measured: a designer reads /admin/status (200) and is refused the build (403, "builds are for team admins"). --- deployment/cloud/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md index 0000e9307..a6f9db18b 100644 --- a/deployment/cloud/README.md +++ b/deployment/cloud/README.md @@ -70,7 +70,8 @@ With the sign-in on, the container also runs PocketBase and can publish a produc | `/pb/` | signed-in (its `/_/` dashboard: `OIDC_ADMIN_GROUPS` only). With `PB_OIDC_CLIENT_SECRET`, its `/api/` is public and PocketBase signs people in itself (see below); `_superusers` and system collections stay admin-only | PocketBase **dev**, the team's shared backend | | `/api-prod/api/` | **public** | PocketBase **prod**'s API; its dashboard is never exposed | | `/cdn/dx-maps/` | **public** | the last published build: `manifest.json` at a stable URL, CORS open for embeds | -| `POST /admin/build` ยท `GET /admin/status` | `OIDC_ADMIN_GROUPS` only | build and publish the pulled commit | +| `POST /admin/build` | `OIDC_ADMIN_GROUPS` only | build and publish the pulled commit | +| `GET /admin/status` | signed-in | the published and pulled commits, and whether a build is running | A build runs one at a time (a second gets `409`), on a snapshot of the pulled commit, with Node's heap capped. It removes everything in [`public-exclusions.txt`](./public-exclusions.txt) **before**