- PUBLIC_HOST/PRIVATE_HOST='*' matches any hostname (localhost, LAN IPs)
- Public route falls through to private on 404 (shared host in local dev)
- If both return 404, keep original public 404 response
- APP_BASE_URL updated to http://localhost:8787 for local dev
- Remove Public Directory tab; public links now show on home page
- Rename Private Links to My Links
- Add right-aligned user menu with hover dropdown (Profile, Settings, Admin, Logout)
- Show admin badge next to username when role=admin
- Show Sign In button when not logged in
- Admin tab only visible to admins
- New GET /api/auth/me endpoint returns current user from session
- useCurrentUser hook for auth state in React
- CSS-only hover dropdown with fade-in animation
- Placeholder pages for Profile and Settings
- POST /api/auth/dev-login creates/finds user, promotes to admin, sets session cookie
- POST /api/auth/dev-logout clears session cookie
- Dev login page at #/dev-login in the SPA
- Fix: getSessionCookieAttributes omits Secure over HTTP (local dev fix)
- Guarded: only works when PUBLIC_HOST=localhost, returns 403 otherwise
- Justfile: dev-admin and dev-logout commands
- README: local admin login instructions
- Terraform configs for D1 databases, KV namespaces, Worker custom domains
- wrangler.dev.jsonc and wrangler.prod.jsonc for environment-specific deployments
- Worker code refactored to use env vars for host checking (PUBLIC_HOST, PRIVATE_HOST)
- Configurable app URLs and cookie domain via env vars
- Deploy and migrate npm scripts for dev/prod
- Updated all tests with new env fixtures
- Deployment guide in README
junv
Hermes Agent