Merge remote-tracking branch 'origin/main' into web

Author: yinebebt

.env.example

@@ -8,7 +8,8 @@ DEEPLINK_SQLITE_DSN=deeplink.db
 # Only used when DEEPLINK_STORE=redis.
 DEEPLINK_REDIS_ADDR=localhost:6379
 DEEPLINK_REDIS_PASSWORD=
-# Comma-separated origins allowed to call the JSON API from a browser.
+
+# Comma-separated origins for the dashboard SPA.
 DEEPLINK_ALLOWED_ORIGINS=http://localhost:5173
 DEEPLINK_TEMPLATE_DIR=
 DEEPLINK_SKIP_PATHS_FILE=
@@ -27,5 +28,5 @@ DEEPLINK_API_KEY=
 # DEEPLINK_TWITTER_SITE=@example
 # DEEPLINK_FEDIVERSE_CREATOR=@user@instance.tld
 
-# Vite (repo-root .env). Keep in sync with DEEPLINK_LISTEN_ADDR.
+# Browser → API origin for the SPA (dev proxy + production build).
 VITE_API_URL=http://localhost:8090

.github/workflows/ci-web.yml

@@ -0,0 +1,35 @@
+name: CI Web
+
+on:
+  push:
+    branches: [web]
+  pull_request:
+    branches: [web]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-web-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  web:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build (typecheck + bundle)
+        run: npm run build

.github/workflows/ci.yml

@@ -7,37 +7,13 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  changes:
-    runs-on: ubuntu-latest
-    outputs:
-      go: ${{ steps.filter.outputs.go }}
-      web: ${{ steps.filter.outputs.web }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          filters: |
-            go:
-              - '**/*.go'
-              - 'go.mod'
-              - 'go.sum'
-              - '.golangci.yaml'
-              - '.github/workflows/ci.yml'
-            web:
-              - 'web/**'
-              - '.github/workflows/ci.yml'
-
   test:
-    needs: changes
-    if: needs.changes.outputs.go == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -54,25 +30,3 @@ jobs:
 
       - name: Test
         run: go test -race -count=1 ./...
-
-  web:
-    needs: changes
-    if: needs.changes.outputs.web == 'true'
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: web
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: web/package-lock.json
-
-      - name: Install
-        run: npm ci
-
-      - name: Build (typecheck + bundle)
-        run: npm run build

.gitignore

@@ -12,11 +12,12 @@ seed.sh
 /cmd/deeplink/deeplink
 /example/custom/custom
 
-# Dashboard SPA
+# Dashboard SPA (this branch)
 /web/node_modules
 /web/dist
 /web/*.log
 .env*.local
+
 *.db
 *.db-shm
 *.db-wal

README.md

@@ -67,11 +67,14 @@ See [example/custom](example/custom/) for a working custom processor with tests.
 
 ## Standalone server
 
-A ready-to-run Redis-backed server is included:
+SQLite by default (zero infra). Redis is optional for multi-instance setups:
 
 ```bash
-docker compose up -d
 go run ./cmd/deeplink
+
+# Redis:
+docker compose up -d
+DEEPLINK_STORE=redis go run ./cmd/deeplink
 ```
 
 ## Stores
@@ -205,24 +208,15 @@ are omitted, so scrapers never see `content=""`.
 Pages also emit `robots: noindex,follow` so short links don't compete with
 the destination URL in search.
 
-## Dashboard
-
-A React + TypeScript dashboard lives in [`web/`](web/), configured by
-`VITE_API_URL` (see [`.env.example`](.env.example)).
-
-```bash
-cd web && npm install && npm run dev   # http://localhost:5173
-```
+## Dashboard / site UI
 
-It reads the API key from `localStorage` (`deeplink.apiKey`) and sends it as
-`X-API-Key`, so set `DEEPLINK_API_KEY` to enforce auth. For a cross-origin
-deploy, add the origin to `DEEPLINK_ALLOWED_ORIGINS`.
+The React landing page and demo dashboard live on the [`web`](https://github.com/yinebebt/deeplink/tree/web) branch (not in `main`). Build and deploy that SPA separately against this API. Set `DEEPLINK_ALLOWED_ORIGINS` (and `DEEPLINK_API_KEY` for mutating routes) when the UI is cross-origin.
 
 ## Development
 
 ```bash
 go test ./...          # run tests
-go run ./cmd/deeplink  # run standalone server (needs Redis)
+go run ./cmd/deeplink  # standalone server (SQLite by default)
 ```
 
 ## License

cmd/migrate/main.go

@@ -286,12 +286,12 @@ func (s *Service) handleLinkDetail(w http.ResponseWriter, r *http.Request) {
 	s.config.Logger.Info("link detail fetched", "shortID", shortID, "duration", time.Since(start).String())
 }
 
-// linkListAllCap bounds GET /links so a runaway store cannot OOM the
-// dashboard. The dashboard is a single-page view, not a paginated API.
+// linkListAllCap bounds GET /links so a runaway store cannot OOM clients
+// that load the full list (e.g. the dashboard on the web branch).
 const linkListAllCap = 500
 
 // handleLinkListAll returns every non-deleted link across all registered
-// types. The dashboard SPA uses this as its single data source.
+// types (full list, not a paginated API).
 func (s *Service) handleLinkListAll(w http.ResponseWriter, r *http.Request) {
 	start := time.Now()
 
@@ -449,8 +449,7 @@ func (s *Service) handleWellKnown(w http.ResponseWriter, r *http.Request) {
 	http.ServeFile(w, r, filePath)
 }
 
-// handleTypes returns all registered processor type names for the
-// dashboard's create-form dropdown.
+// handleTypes returns registered processor type names (e.g. for create forms).
 func (s *Service) handleTypes(w http.ResponseWriter, _ *http.Request) {
 	respondJSON(w, http.StatusOK, s.registry.Types())
 }

server.go

@@ -6,7 +6,7 @@ const repoRoot = path.resolve(__dirname, "..");
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, repoRoot, "");
-  const apiURL = env.VITE_API_URL || "http://localhost:8091";
+  const apiURL = env.VITE_API_URL || "http://localhost:8090";
 
   // GET/HEAD stay on Vite (SPA assets); other methods proxy to the Go API
   // so PATCH/DELETE /{shortID} don't collide with the root SPA route.