Bendik LynghaugandClaude Opus 5 c9faaeb4a6 Serve a content repo's .well-known/ at the site root ...

Everything a site has to publish for another program to find it lives
under /.well-known/, and portal had no way to put a file there: the
catch-all answered those paths 200 with the app shell, so a client
probing for security.txt or matrix/server got HTML where it expected a
document, and could not tell a missing file from a present one.

The prefix is the one place this is safe to overlay. RFC 8615 reserves
it, and a question's id comes from a file name under questions/, which
cannot begin with a dot - so no file a repo ships can shadow a page. The
path still goes through is_safe_site_path, so it cannot climb out of the
repo either, and a miss is a real 404.

Types: an extensionless file under the prefix is JSON, which is what
matrix/server and nodeinfo are; .mobileconfig is the Apple profile type,
without which iOS downloads a profile instead of offering to install it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o

2026-10-07 10:30:13 +02:00

..

aggregates

A record may leave its lists some time after reaching a state: leaves_after

2026-09-30 20:50:28 +02:00

content

Serve a content repo's .well-known/ at the site root

2026-10-07 10:30:13 +02:00

events

Storylines: the same site told several ways, one per visitor, counted

2026-09-30 15:11:27 +02:00

lint

iris check --findings: every finding as JSON with a stable id

2026-10-03 10:48:09 +02:00

server

The header knows who is here; my cases; controls that scale with the text

2026-09-30 17:32:41 +02:00

trainer

generate follows its findings through, and stops when it stalls

2026-10-03 10:48:09 +02:00

access.rs

Memberships: groups kept by portal itself, a person by phone number first

2026-09-30 13:28:28 +02:00

announce.rs

Storylines: the same site told several ways, one per visitor, counted

2026-09-30 15:11:27 +02:00

answers.rs

A desk shows the three newest finished records, and older on request

2026-10-02 11:25:49 +02:00

app.rs

A platform's file may name its architecture

2026-10-05 12:56:19 +02:00

auth.rs

Memberships: groups kept by portal itself, a person by phone number first

2026-09-30 13:28:28 +02:00

chain.rs

Question nav: a followup is offered only once it is earned

2026-09-22 16:58:40 +02:00

deadlines.rs

A desk shows the three newest finished records, and older on request

2026-10-02 11:25:49 +02:00

http.rs

One bounded HTTP client for every server-side fetch; uploads refused while streaming

2026-09-22 16:51:15 +02:00

i18n.rs

A releases manifest renders as a download card, the device's file first

2026-10-05 12:48:31 +02:00

lib.rs

One binary: the lint and the trainer are commands of portal

2026-09-30 15:29:30 +02:00

mail.rs

One set of mail variables for every mail, and {link} in state mails

2026-10-02 11:25:49 +02:00

main.rs

Serve a content repo's .well-known/ at the site root

2026-10-07 10:30:13 +02:00

maps.rs

A field can be a place, and a question can be about one

2026-09-24 21:17:28 +02:00

memberships.rs

A desk shows the three newest finished records, and older on request

2026-10-02 11:25:49 +02:00

people.rs

A desk shows the three newest finished records, and older on request

2026-10-02 11:25:49 +02:00

report.rs

Storylines: the same site told several ways, one per visitor, counted

2026-09-30 15:11:27 +02:00

resource.rs

A resource can show only its newest few

2026-10-04 22:51:12 +02:00

seed.rs

An invite may carry its own mail, with the form's fields and a spoken date and time

2026-10-01 18:06:12 +02:00

sessions.rs

Sessions outlive the deploy that interrupted them

2026-09-28 16:38:05 +02:00

upload.rs

An upload that did not arrive says why

2026-09-30 21:08:28 +02:00