rimskij
released this
2026-08-25 19:06:36 +02:00
| 36 commits to dev since this release
Added
- Logo page —
/logo (linked from the header next to Pieśni) presents the choir's brand assets as thumbnails grouped into Logo, Paleta barw and Social media, each with a PNG download and, where one exists, the print-quality PDF. The files previously lived only in docs/LOGO/, which is not served, so there was no way to get the logo for a poster or a Facebook event
Fixed
- Admin login was impossible —
ADMIN_PASSWORD_HASH is read from .env, where Next.js expands $ as a variable reference; a bcrypt hash starts $2b$12$, so the app received a truncated 47-character fragment and rejected every password as a mismatch. Broken since the 2026-06-04 security hardening introduced the hashed password. verifyPassword now validates the hash shape and reports the misconfiguration by name instead of blaming the password
- PDF files under
public/ returned 404 — the locale middleware redirected any unprefixed path, and its static-asset skip-list covered images and fonts but not .pdf, so every PDF resolved to 301 → /en/…pdf → 404. The skip rule now lives in one tested place rather than inline in the middleware
- Download links were indistinguishable to screen readers — every logo tile's links were named just "PNG" and "PDF", so browsing by links list gave twenty identically-named entries (WCAG 2.4.4). Each now carries its asset caption
Changed
- Slop gate is now enforced — a calibrated
slopgate.config.json makes /commit, /push and /ship block on an over-budget diff and scores introduced duplication, which was previously never measured in this repo
Downloads