Lets the photographer edit config/site.json from /dashboard instead
of SSHing in and hand-editing the file. Two tiers:
- Quick-edit form for the fields actually touched day to day (site
title/tagline/hero, photographer bio, contact/social, Venmo
username, session pricing, theme colors)
- Raw JSON textarea for everything else (portfolio categories,
locations, session types, Immich settings) - the form's fields are
a subset of this, not a separate source of truth
Backend: GET/PUT /api/admin/config, gated by the existing requireAdmin
middleware (OIDC admin session or legacy ADMIN_SECRET). PUT validates
the body is an object with the required top-level sections, writes
atomically (temp file + rename), and keeps one prior version as
site.json.bak before overwriting.
Required a docker-compose.yml change: the api service had no volume
mount for config/ at all before this (only portfolio/nginx did, and
read-only) - added a read-write mount so the API can actually write
the file the live site reads.
- Fix applyConfig self-recursion (const _origApply captured the hoisted
wrapper itself): site.json config — theme, portfolio, socials, bio —
was never applied; site silently fell back to hardcoded brown defaults
- Strengthen theme test to assert the configured primary color exactly
- Portfolio covers: styled placeholder on missing image (like locations),
restore img when Immich carousel kicks in; overlay always visible on touch
- Optional hero photo via site.heroImage with soft scrim (activates only
when the image loads); site.json points at /images/hero.jpg
- Option cards: equal height, centered content
- /#book deep link also works via hashchange
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- api/auth.js: zero-dep OIDC authorization-code flow with PKCE against
Authentik; HMAC-signed HttpOnly session cookies (SESSION_SECRET)
- requireAdmin now accepts an OIDC session in the admin group; legacy
ADMIN_SECRET bearer kept for n8n and scripts
- New client endpoints: GET /api/my-bookings, owner-gated contract download
- Bookings created while signed in are bound to the client's OIDC sub
- Dashboard: "Sign in with SSO" alongside passphrase fallback
- New /my-bookings portal page (nginx route + themed page)
- Fix booking modal: content area now scrolls; nav no longer overlaps the
calendar on short viewports (was swallowing clicks on date cells)
- 10 new Playwright tests; suite green at 67
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- api/google-calendar.js: service account JWT auth + freebusy query
using only Node.js built-in crypto (no new npm deps). In-memory cache:
5-min busy dates, 1-hr OAuth token. Gracefully returns empty busy list
when GOOGLE_CALENDAR_ID / GOOGLE_SERVICE_ACCOUNT_JSON not configured.
- api/server.js: GET /api/availability?year=YYYY&month=MM endpoint
with 5-min Cache-Control; errors return { busy:[], configured:false }
so the UI always works even if Calendar is unavailable.
- src/index.html: replace plain <input type="date"> in step 1 with a
custom month-grid calendar (dpInit/dpRender/dpNav/dpSelectDate).
Hidden #session-date input carries the value for the rest of the wizard.
Past dates and busy dates are visually blocked; month nav pre-fetches.
- tests/booking.spec.js: 4 new calendar UI tests + updated openAndPickDate
helper to click a rendered day cell.
- tests/api.spec.js: 2 new availability endpoint tests.
Setup: set GOOGLE_CALENDAR_ID and GOOGLE_SERVICE_ACCOUNT_JSON in api/.env.
See api/google-calendar.js header for step-by-step instructions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jhodgkin