ld
04eb8727eb
- feat: connect login and logout to the REST API with session-scoped tokens, protected routing, single-flight refresh, and authenticated query cache cleanup. - feat: add the Ant Design application shell with root file listing, pagination, small-file upload, and authenticated download. - test: cover session storage and API retry and error behavior with Vitest. - docs: document the browser milestone, same-origin API topology, and deferred transfer and account features.
3.1 KiB
3.1 KiB
Technical Decisions
2026-07-14: Client-rendered Web Foundation
Context: MyGO needs a browser client now and native clients later. The Web application must share the versioned REST API instead of introducing browser-only server logic.
Decisions:
| Area | Choice | Guidance |
|---|---|---|
| Rendering | Pure client-side rendered SPA | Vite emits static assets; do not introduce SSR, React Server Components, or a Node API server. |
| Application stack | React, strict TypeScript, React Router, and TanStack Query | Keep routing and remote-data state explicit and client-side. |
| UI system | Ant Design plus Tailwind CSS 4 | Ant Design owns reusable controls and theme tokens; Tailwind initially owns layout, spacing, and responsive utilities. |
| Dependency policy | Install capabilities when their feature starts | Keep API generation, transfer, virtualization, drag-and-drop, test, and preview libraries deferred in docs/web/roadmap.md. |
Consequences:
- The Web and future native clients consume the same client-neutral API contracts.
- MyGO or a reverse proxy may host
web/distwith an SPA fallback without changing the rendering model. - MyGO domain components own file-browser behavior and must not depend on Ant Design request behavior for business logic.
2026-07-14: Browser Authentication and Root File Workflow
Context: The first Web milestone needs to exercise the existing login, file list, upload, and download APIs without committing to the later directory, account, admin, or large-transfer designs.
Decisions:
| Area | Choice | Guidance |
|---|---|---|
| API topology | Same-origin /api/v1 |
Vite proxies /api to the local Go server. Production uses a same-origin reverse proxy; the milestone does not add CORS or Go static hosting. |
| Browser session | Token pair in sessionStorage |
Reloading the tab preserves the session, while closing the tab clears it. Do not add persistent login until the token transport design is revisited. |
| Token refresh | Refresh once after a protected request returns 401 | Share one in-flight refresh across concurrent failures, store the rotated pair, and retry each request once. Clear the session if refresh or the retry fails. |
| File scope | Root directory only | List root entries, upload one file to root, and download files. Show directories as non-interactive rows. |
| Transfer model | Browser FormData upload and authenticated Blob download |
This is intentionally limited to the small-file milestone; progress, streaming-to-disk, chunking, resume, and queues remain deferred. |
Consequences:
- The API client owns bearer headers, error parsing, refresh coordination, and session invalidation; pages consume operation-specific functions.
- TanStack Query caches are cleared whenever an authenticated session ends so one user cannot see another user's cached file metadata.
- The file picker is independent of Ant Design upload request behavior, keeping transfer policy in MyGO code.
- Handwritten TypeScript wire types remain temporary until an OpenAPI contract is available.