bonna61/Bonna-Moon-Studio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9e21895232ef6859ccb6f1eb31ae40fdfefbd96c
Bonna-Moon-Studio/CLAUDE.md
tonym 9e21895232 app: OTM integrations — operator-magic + account SSO + suggestion jots + self-update (v0.4.0) 
Three new doors, all wire-contract ports of the shared @otm/account-panel
factories (this backbone is plain Node — the Next factories can't mount):

- GET /api/auth/operator-magic — OTM 'Log in as admin'. HS256 verify against
  OPERATOR_SHARED_SECRET (alg allowlist, constant-time, action-claim rejected
  for flow separation), single-use jti via OperatorMagicConsumed (+ who/when
  audit), 1-HOUR session with cookie Max-Age derived from the payload, 🔑
  support-session banner in the app, every failure a 302 reason redirect.
- GET /api/auth/otm-sso — the OTM /account tile. Stricter sso-ticket verify
  (exp mandatory, audience compared), email-then-role actor mapping, safeNext.
- 💡 suggestion jot chip — files a Gitea issue (shared attribution footer,
  8k cap, 10s timeout); on any failure the jot is kept as a note instead.
  Success also leaves a '#N — …' note so she has her own record.
- Footer version chip + one-tap self-update (HMAC-signed OTM proxy with
  explicit field picking — foreign JSON can never reach the _setSession/_redirect
  control keys), owner-gated, 10-min sessionStorage cache on the check.

Hardening that rode along: session key now derived from OPERATOR_SHARED_SECRET
(managed boot REFUSES the old derivable DATABASE_URL fallback), 1MB JSON body
cap, login.html prototype-lookup fix. NOTE: server.mjs previously contained a
literal NUL byte that made git treat it as binary — this commit re-encodes it
as an escape (behavior identical) and adds .gitattributes so source diffs can
never go blind again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmybqyQmZWfcqA1vMP4jbQ
2026-08-09 22:31:34 -05:00

139 lines
7.4 KiB
Markdown
Raw Blame History

# Bonna Moon Studio — access notes
Status as of 2026-08-06: **provisioned and live** at
https://bonnamoonstudio.poweredbyotm.com (`site` template v0.11.0, container
`site-bonnamoonstudio` on anvil). The repo now holds the studio-backbone
**vision, Phase 1 designs, and a working local prototype** — see
[VISION.md](VISION.md) and [prototype/README.md](prototype/README.md). The
`site` instance's code still lives in the platform monorepo, not here (see "The
plan" below); this repo is the backbone's home. Local branch is now `main`,
tracking `gitea/main`.
The long-term product vision — a custom "studio backbone" app in the FMB mold
(glaze recipes, firing log, inventory, accounting, market scanner, kiln control) —
is captured in [VISION.md](VISION.md). The `site` instance is the storefront layer.
**The backbone is LIVE (2026-08-06): https://bms.poweredbyotm.com** — template
`bms-backbone-next` (otm-admin 0.111.0), container `bms-backbone-bms` on anvil,
built from this repo's `app/` (Postgres + Prisma port of the prototype, OTM
owner-seed auth). Deploy sequence: bump `app/lib/version.mjs` **and
`app/package.json`** + push here → the push webhook now AUTO-BUILDS the image
(`autoBuildOnly`, otm-admin 0.111.1) → deploying it stays a manual click on
OTM `/instances` (or `redeploy_service` via the MCP).
Bonna's laptop data was migrated; `prototype/` is now legacy reference (the
laptop `.command` still works but the hosted notebook is the daily driver).
## v0.4.0 — OTM integrations (what needs which env)
All three are provision-injected via the template's flags; a hand-provision
that misses one degrades silently, so here's the lookup:
| Feature | Env it needs | Symptom when unset |
|---|---|---|
| OTM "Log in as admin" (`GET /api/auth/operator-magic`) + OTM account SSO (`GET /api/auth/otm-sso`) | `OPERATOR_SHARED_SECRET`; SSO also `OTM_SSO_SECRET` + `OTM_SSO_AUDIENCE` | `/login?reason=not_enabled` |
| Suggestion jots → Gitea issues (the 💡 chip) | `GITEA_URL` + `GITEA_TOKEN` + `GITEA_REPO` | jot saved as a note tagged `suggestion` instead (`fallback: true`) — never lost |
| Self-update (footer ✨ chip) | `OTM_API_BASE` + `OTM_SERVICE_ID` + `OPERATOR_SHARED_SECRET` | footer shows no update chip; API answers 503 `not_configured` |
Session-signing note: the cookie key is derived from `OPERATOR_SHARED_SECRET`
(domain-separated HMAC) unless an explicit `SESSION_SECRET` is set; a managed
instance (`OTM_MANAGED=true`) with neither refuses to boot. OTM sign-ins are
recorded in `OperatorMagicConsumed` (jti + who + when); operator sessions last
1h and show a 🔑 support-session banner.
## The repo
- Gitea: `https://git.poweredbyotm.com/bonna61/Bonna-Moon-Studio.git`
- Remote name here is **`gitea`** (not `origin`) — matches the FMB convention.
- Local branch is `master`; FMB and the platform both use **`main`**. Rename before
the first commit, or let `git checkout main` create the tracking branch after the
remote has one.
```sh
cd "/Users/bonnamoon/Projects/Bonna Moon Studio"
git fetch gitea && git checkout main # once the remote has content
```
**Auth: macOS keychain.** There is no `~/.gitconfig` and no `~/.git-credentials` on
this machine; `credential.helper=osxkeychain` is set at the git *system* level. A
`git ls-remote gitea` completes with no prompt, so pushes and fetches over
`https://git.poweredbyotm.com` just work. Nothing needs a token in the URL.
Commit identity is set **locally** in this repo (there's no global fallback — commits
would fail without it):
```
user.name = Bonna
user.email = bonna@fullmoonbakehouse.com
```
### The other Gitea address — ⚠️ TWO instances now, NAS is legacy
**Corrected 2026-08-06 (the hard way):** `git.poweredbyotm.com` and the home NAS
are **separate Gitea instances**. They diverged at some point; an earlier version
of this file claimed they were one instance with three addresses. They are not.
| Address | What it is |
|---|---|
| `https://git.poweredbyotm.com` | **Production Gitea. Use this, always.** Keychain auth. Holds this repo, `tonym/platform` (the real one — admin 0.111.0-era), `bonna61/Moonbase`, etc. |
| `http://192.168.0.5:3022` / `http://167.237.9.184:3022` | **Legacy home-NAS Gitea (LAN / public IP of the same box). Being retired** — Tony confirmed 2026-08-06. Its `tonym/platform` is frozen at ~0.80.0; pushing there deploys nothing. A stray bms commit (`e2ea2b3`) landed there before the divergence was discovered. |
Do not push platform work to the NAS. If a doc, remote URL, or memory points at
`192.168.0.5:3022` / `167.237.9.184:3022`, treat it as stale until verified.
The sibling repos (`moonbase`, `moon-household-budget`, `otm-platform`) embed an
access token directly in their remote URL against `192.168.0.5:3022`. Those tokens
are **only** recorded in those URLs — the `~/Projects/CLAUDE.md` that
[moonbase/docs/git-deploy-guide.md](../moonbase/docs/git-deploy-guide.md) refers to
does not exist on this machine. Read one back with:
```sh
git -C /Users/bonnamoon/Projects/moonbase remote get-url origin
```
Never commit a token.
## Hosts
- **`anvil`** = `debian@51.81.80.250` — OVH VPS, **production, live**. Serves
`*.poweredbyotm.com` with real Let's Encrypt certs. Wildcard `*` A-record, so any
new `<slug>.poweredbyotm.com` resolves with zero DNS work. Host user is `debian`,
not `tonym`. Can't reach the home LAN — its builds use `167.237.9.184:3022`.
- **`forge`** = `tonym@192.168.0.83` — Unraid VM, staging, `*.local` hostnames with a
local CA. Needs the home LAN.
- OTM Admin: **https://admin.poweredbyotm.com** (anvil) — provisioning, template
builds, per-service ops, logs.
A connected MCP server exposes the same control plane read/write (`platform_status`,
`list_instances`, `list_templates`, `onboard`, deploy + log tools). Call
`platform_status` or `list_instances` first for an overview. It points at **live
production** — treat `onboard`, deploys, and restarts as real-world actions.
Platform source: `/Users/bonnamoon/Projects/platform` (and `otm-platform`). Its
`CLAUDE.md` is the authority on deploys, the CI-gated auto-deploy webhook, and the
long list of anvil-vs-forge gotchas.
## The plan (executed 2026-08-06)
One app with public pages **plus** an `/admin` back office — the **`site`** template
("Web — hosting + site + account", v0.11.0), same as `home`, `overthemoon`, and
`vvts`. Public site plus the drag-and-drop CMS page editor from `@otm/account-panel`.
Provisioned via `onboard`: customer **Bonna Moon Studio**, app/service slug
`bonnamoonstudio`, industry `universal`, owner **bonna@bonnamoonstudio.com**.
Live at **https://bonnamoonstudio.poweredbyotm.com** (admin at `/admin`). The
seeded owner password was captured and handed to Bonna at provisioning time; it is
deliberately not recorded anywhere in this repo.
What it is: Bonna's **art studio** — ceramics, carved wood, and sterling
silver/ceramic jewelry. The prior site at bonnamoonstudio.com (shop temporarily
closed during the studio rebuild) has the source content: product lines, collector
testimonials, newsletter signup. That domain still points at the old site; cutover
is a future DNS step.
Remaining notes:
- **The `site` template does not use this repo.** Its code lives in the platform
monorepo at `apps/site`; per-instance content lives in that instance's Postgres, not
in git. This repo staying empty is expected. Giving it real code means authoring a
new platform template and build chain — days, not minutes.
Reference in New Issue View Git Blame Copy Permalink