Close the last three UI leftovers: shared staff HTML, cookie domain, stock Swagger label.
Some checks are pending
offline / test (push) Waiting to run

verae-staff-ui holds one review template for CS and access-staff.
Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host.
/docs stays vendor Swagger with an integrator banner only.
This commit is contained in:
George Lambert 2026-09-11 18:22:57 -04:00
parent b68fefdea8
commit d8efffe8be
23 changed files with 368 additions and 44 deletions

View file

@ -17,11 +17,13 @@ Follow-up to the 2026-09-11 review PDF. Items the review listed as open are now
## Still to consider
| Severity | Issue | Suggestion |
|----------|-------|------------|
| Med | Swagger `/docs` remains stock | Keep it for integrators; do not skin. Portal already labels it as stock OpenAPI explorer. |
| Low | access-staff and CS HTML are twins | Share one template file if those packages ever merge. |
| Low | Staff cookie is host-scoped (`127.0.0.1`) | Fine on one operator host. For multiple DNS names, put a reverse proxy in front. |
None of the previous review leftovers are open.
| Severity | Issue | What shipped |
|----------|-------|----------------|
| Med | Swagger `/docs` stock | Left as vendor Swagger. Title + banner: “OpenAPI explorer — stock Swagger UI for integrators.” Not skinned. |
| Low | access-staff and CS HTML twins | Shared template in `verae-staff-ui` (`review.html` + tokens). Both servers load it in the monorepo. |
| Low | Staff cookie host-scoped | `STAFF_COOKIE_DOMAIN` / `STAFF_COOKIE_SECURE` plus nginx example on `verae-staff-session`. |
## How to use each surface