The merged Renovate bumps were undone when I rsync'd a local tree over these repos while
pushing the contract tests — that local package.json was a pre-merge backup I had kept so
the PRs would be the source of the versions.
Re-applied and verified from a clean install (rm -rf node_modules package-lock.json &&
npm install && tsc && vite build), which is also what regenerates a lock file consistent
with all the bumps at once.
PlatformWebContract asserts what this app must do because it is on the platform: an /api
path matching no controller 404s rather than returning the SPA, health is UP, the liveness
and readiness probes exist, and a client-side route forwards to the shell. That first one
shipped broken to six live sites and was found by typing a URL by hand; now it fails a
build instead.
renovate.json is three lines pointing at austin/renovate-config. The rules were copied per
repo, so they matched only by luck and a change was six edits.
Platform 0.1.9.
Search downloaded every post to every visitor and filtered the list with String.includes,
so it could only ever match what a summary carries — a phrase from the body of a post was
unfindable, and the cost grew with each post published. It is now a query
(/api/posts/search) that searches the body too.
The home page picked 'the latest post' by taking element zero of that list, which was only
correct for as long as the API happened to return posts in that order. /api/home now
decides what leads, what counts as recent, and the tag counts, in one call.
Tag counting moves out of the controller into TagService, shared by both.
The LIKE escaping needed an explicit ESCAPE clause: there is no default escape character to
rely on, and posts are markdown full of literal backslashes — escaping with a backslash
turned a search for '%' into a search for backslashes and matched unrelated posts. Caught by
the new tests.
Also on platform 0.1.6 (contact-form header-injection fix).
- Admin API: list/edit posts (incl. drafts, raw markdown), moderate comments, subscribers,
author bio/links, and presigned image upload to MinIO (bucket is public-read for covers).
- Admin UI at /admin: post editor with cover-image upload, comment moderation, subscriber list.
- Public security switched to authenticated-paths so static assets (/images, /data) stay public.
Restores the real backend lost with Supabase (posts, authors, comments, subscriptions, admin) in
Postgres, seeds the existing markdown posts, and rebuilds the site as a Vite/React SPA served by
Spring — keeping the original styling (serif + tan accent) and content.
austin