Web basepath

[pulk17]

[FIX]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

Follow-up to #1196–#1204, from the first real deploy. The console was only ever tested at a domain root (the Vercel demo), and a few things only show up under /app/.

What's broken on live right now

• Every page shows "Not Found" after login. The router had no basepath, so it matched /app/ against /, /runs, … and found nothing.
• Sidebar links go to the classic site. Same cause — they were built as /upload instead of /app/upload, so they land on Flask, which asks for its own login.
• Connect to GitHub crashes. GitHub's callback is registered to the classic site and reads the classic cookie session (g.user.id), which a console sign-in doesn't have, so it errors.
• /app (no trailing slash) is a 404. nginx only matches /app/.
• Console responses lose HSTS. Any add_header inside a location stops the server-level add_header lines being inherited. The assets block also sent two conflicting Cache-Control headers.
• index.html is never revalidated, so a browser can keep loading the previous build for hours after a deploy.

Separately, #1209 (dependabot) fails the web check: the newer oxlint adds react/set-state-in-effect and flags two spots.

Changes

fix console routes under /app/ — basepath from Vite's BASE_URL, so routes and links follow whatever base the build uses. Relative bases (the demo build) fall back to /.

send github linking to the classic account page

• The Connect button opens /account/manage, which already renders a working "Link GitHub" and is @login_required, so a signed-out user is asked to log in instead of hitting the crash.
• Account: the draft fields re-sync from the server during render rather than in an effect (React's documented pattern for resetting state when a prop changes). The "Saved." confirmation is kept, which a key-based remount would have cleared.
• ResetPassword: the link parameters never change, so they are read once in the useState initialiser.

redirect bare /app and keep hsts on console responses

• location = /app → 301 to /app/
• expires -1 on /app/ and expires max on /app/assets/, with no add_header, so HSTS is inherited.

Testing

• tsc -b, oxlint --deny-warnings (the pinned 1.72 and 1.83.0 from chore(deps): bump the minor-and-patch group in /web with 21 updates #1209), and build:app all pass. On master, 1.83.0 reproduces both warnings.
• Served the build:app output under /app/ with the same try_files fallback as nginx:
  • /app/ renders Home, and all 7 sidebar links carry the /app/ prefix
  • a hard load of /app/runs/9503 renders the run page
  • clicking a sidebar link stays under /app/ without a full reload
  • Account save: the input shows the server's value after refetch, and "Saved." stays visible
  • /app/reset?uid=…&expires=…&mac=… shows the form; a bare /app/reset shows the "missing part of itself" message
• I could not run nginx locally. The live headers confirmed the HSTS and duplicate Cache-Control issues.

Needs a manual step after merge

Deploys don't touch the server's nginx config. The two console blocks in /etc/nginx/sites-available/platform need replacing with the ones in install/nginx.conf (NGINX_DIR → /var/www/sample-platform), then sudo nginx -t && sudo systemctl reload nginx. The routing and GitHub fixes ship with the normal deploy.

Not in this PR

• Connecting GitHub from inside the console itself. This needs an API endpoint that exchanges the code under the bearer token, plus a state check. Worth its own PR.
• Node 20 deprecation warnings on actions/checkout@v4 / setup-node@v4. Warnings only for now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud