The reviewer noted the static sitemap.xml had a hardcoded domain in a
white-label app. Instead of writing files to disk, we now serve
sitemap.xml and robots.txt as dynamic API endpoints that read
KMTN_WEBSITE_URL at runtime.
- Nginx proxies /sitemap.xml and /robots.txt to the backend API so
search crawlers reach them at root paths.
- Removed the startup filesystem-write that would fail in Docker
(backend can't write to Nginx container's static dir).
- Simplified sitemap_export.py to pure generation functions (no I/O).
- Added /api/sitemap/regenerate admin endpoint for consistency.
- CI workflow: replace hardcoded branch list with ['**'] wildcard so
pipeline runs on every branch push, not just 4 named branches.
- Sitemap/robots.txt: moved from static files to dynamic generation.
New sitemap_export.py module (follows theme_export.py pattern) uses
KMTN_WEBSITE_URL to generate tenant-aware sitemap.xml and robots.txt
on app startup. Atomic writes to STATIC_FILES_DIR so Nginx serves them.
- Added /api/sitemap endpoint with /status (public) and /regenerate
(admin-only) for runtime control.
Addresses reviewer comments on PR #4:
1. 'more general way to ensure this runs on any branch on push'
2. 'whitelabel app - this file may need to be dynamically generated'
- Import RouterLinkWithHref in footer and events components (required for queryParams binding on <a>)
- Add social media fields to DEFAULT_CONFIG in station-config.service.ts
- Add public/robots.txt (allow all, disallow /admin and /login, reference sitemap)
- Add public/sitemap.xml (5 public routes with change frequencies and priorities)
- Fix heading hierarchy: h2 -> h1 on about, schedule, events, contact pages
- Remove dead footer href="#" links:
- Volunteer/Corporate Giving/Planned Giving -> routerLink to /contact with subject query param
- Social media links -> conditional on config().social_* fields (hidden when empty)
- Fix logo ARIA: add aria-hidden="true" to decorative logo in about page divider
- Add social_facebook, social_twitter, social_instagram, social_youtube to:
- StationConfig DB model + startup migration
- StationConfigResponse and StationConfigUpdate schemas
- Frontend StationConfig TypeScript interface
- Fix events "Learn More" dead link -> routerLink to /contact
The login endpoint already provisions the first admin user on demand
with a proper password_hash. The startup block in main.py created the
user without a password_hash, causing the login endpoint to see
has_admins=True and reject bootstrap credentials with 403.
Fix: remove the startup user-creation block so the login endpoint's
bootstrap path runs first and provisions the user correctly.
- Add users.password_hash to _migrate_add_missing_columns pending list
- Skip tables that don't exist yet (prevents crash on fresh DB)
- Handle nullable columns (no DEFAULT clause) in ALTER TABLE
- Fix SQLite column type (use sql_type instead of hardcoded TEXT)
- Update migrate_roles.py to create schema columns/tables before seeding roles
- Add unit tests for migration: adds column, nullable, idempotent, no-op
The previous check counted ALL users (func.count(User.id)), which
incorrectly blocked bootstrap login if any non-admin user (e.g.,
Google OAuth sign-in) already existed. The fix queries specifically
for admin users using the legacy is_admin flag OR the admin role
assignment in user_roles.
Also add tests for the non-admin-user-only scenario and fix the
stale test_non_admin_user_cannot_login_as_admin assertion (401
not 403 — bootstrap path is still active when no admin exists).
Backend:
- /api/admin/users: GET list, POST create, PUT update, DELETE
- Admin users can be added with email, display name, and password
- Self-deletion and last-admin deletion are blocked
- Admin role auto-assigned on creation
Frontend:
- AdminUsersTabComponent: list + add/delete admin users
- AdminUserService: HTTP client for admin user CRUD
- AdminUser interface
- 'Admins' tab added to admin dashboard
Tests:
- 10 new tests for admin user management endpoints
- 140 total tests pass (130 original + 10 new)
- Add Role model and user_roles association table (many-to-many)
- Add password_hash column to User model (nullable, for future bcrypt)
- Keep is_admin boolean for backward compatibility
- Add is_admin_effective property: true if legacy is_admin OR 'admin' role
- Update auth dependency (get_current_admin_user) to use is_admin_effective
- Update bootstrap login to auto-create 'admin' role and assign on login
- Update Google OAuth login to use is_admin_effective for token creation
- Add migrate_roles.py: idempotent migration script to backfill roles
- Add unit tests for Role, User, association table, and is_admin_effective
The Programs feature is superseded by Shows, which provides a more
flexible model with schedule slots. This commit removes all Programs
code across frontend and backend:
Frontend:
- Delete admin-program-form component (ts/html/scss)
- Delete program.service.ts and program.ts interface
- Remove Programs tab, form modal, and all CRUD logic from admin
component (ts + html)
Backend:
- Delete programs API router
- Remove Program ORM model and ProgramCreate/Update/Response schemas
- Remove programs router registration from main.py
- Remove Program from seed data, seed helpers, and truncate/reset
Hermes Robot
robot
kfj001