@bygghammar/cms-platform 0.26.0 → 0.28.0

package/src/backoffice/SiteSettingsView.tsx

@@ -18,6 +18,11 @@ export type SiteSettingsDeps = {
   saveSettings: (input: { data: SiteSettingOverrides }) => Promise<unknown>;
   clearSetting: (input: { data: { key: string } }) => Promise<unknown>;
   refresh: () => Promise<unknown> | void;
+  /**
+   * Where the running public origin came from. `"environment"` means the host
+   * set `SITE_URL` for this deployment; `"code"` means the compiled fallback.
+   */
+  originSource?: "environment" | "code";
 };
 
 const FEATURE_LABELS: Record<keyof SiteFeatureFlags, string> = {
@@ -54,6 +59,7 @@ const cardClass = "border border-ink/10 bg-white p-6";
  */
 export function SiteSettingsView({ deps }: { deps: SiteSettingsDeps }) {
   const { config, overrides, saveSettings, clearSetting, refresh } = deps;
+  const originSource = deps.originSource ?? "code";
   const [name, setName] = useState(config.name);
   const [company, setCompany] = useState({ ...EMPTY_COMPANY, ...config.company });
   const [features, setFeatures] = useState<SiteFeatureFlags>({ ...config.features });
@@ -99,23 +105,38 @@ export function SiteSettingsView({ deps }: { deps: SiteSettingsDeps }) {
     <div className="p-8 md:p-12 w-full">
       <h1 className="font-serif text-3xl md:text-4xl text-ink">Site settings</h1>
       <p className="mt-3 max-w-2xl text-sm text-ink/60">
-        These values come from the site configuration in code. Anything you change here is stored as
-        an override in the database and can be reset back to the code default.
+        Site name, company details, brand colours and modules are editable here — a change is stored
+        as an override in the database and can be reset back to the code default. The fields below
+        are set outside the backoffice and shown for reference only.
       </p>
 
       <dl className="mt-8 grid gap-4 md:grid-cols-4">
         {[
-          ["Site key", config.key],
-          ["Public origin", config.origin],
-          ["Locales", config.locales.join(", ")],
-          ["Backoffice", `${config.backofficePath} (${config.backofficeLocale})`],
-        ].map(([label, value]) => (
+          ["Site key", config.key, "Set in code"],
+          [
+            "Public origin",
+            config.origin,
+            originSource === "environment" ? "From SITE_URL" : "Code fallback \u2014 SITE_URL unset",
+          ],
+          ["Locales", config.locales.join(", "), "Set in code"],
+          [
+            "Backoffice",
+            `${config.backofficePath} (${config.backofficeLocale})`,
+            "Set in code",
+          ],
+        ].map(([label, value, source]) => (
           <div key={label} className="border border-ink/10 bg-white p-4">
             <dt className="text-xs uppercase tracking-wider text-ink/50">{label}</dt>
             <dd className="mt-1 text-sm text-ink">{value}</dd>
+            <dd className="mt-2 text-[11px] uppercase tracking-wider text-ink/40">{source}</dd>
           </div>
         ))}
       </dl>
+      <p className="mt-3 max-w-2xl text-xs text-ink/50">
+        These four are structural: the locale set and backoffice path are compiled into the build,
+        and the public origin differs per environment. They are read from code and environment on
+        purpose, so a deployment can never disagree with what the database says.
+      </p>
 
       <section className={`mt-8 ${cardClass}`}>
         <SectionHeader

package/src/config/site-config.ts

@@ -140,6 +140,28 @@ export function defineSiteConfig(input: SiteConfigInput): SiteConfig {
   };
 }
 
+/**
+ * Resolve the canonical public origin for this deployment.
+ *
+ * The origin is a deployment fact, not editable content: preview, staging and
+ * production all differ, so it comes from the environment (`SITE_URL`) and only
+ * falls back to the value compiled into `site.config.ts`. It is deliberately
+ * never stored in the database — canonical URLs, sitemaps and auth redirects
+ * must be correct before any database read.
+ */
+export function resolveSiteOrigin(fallback: string, rawEnvValue?: string | null): string {
+  const raw = (rawEnvValue ?? "").trim().replace(/\/+$/, "");
+  if (!raw) return fallback.replace(/\/$/, "");
+  const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+  // Anything malformed is ignored rather than breaking every canonical URL.
+  return /^https?:\/\/[^/]+$/.test(withScheme) ? withScheme : fallback.replace(/\/$/, "");
+}
+
+/** True when the running origin came from the environment, not from code. */
+export function originIsFromEnvironment(fallback: string, rawEnvValue?: string | null): boolean {
+  return resolveSiteOrigin(fallback, rawEnvValue) !== fallback.replace(/\/$/, "");
+}
+
 /**
  * Keys the backoffice may override from the database. Everything else is
  * code-only on purpose: routing, locale set and origin must be deployable and