Merge remote-tracking branch 'origin/main' into feature/thirty-day-sessions

5 files changed, 34 insertions, 9 deletions

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 69d57bc..ace8b98 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -17,7 +17,7 @@ This repository owns `progmasoft.com`, `account.progmasoft.com`, and `viget.prog
 
 ### Observed and expected behavior
 
-Describe what happened, what you expected, and any visible status code or safe error message. If the issue involves a package path, distinguish `/<Publisher>/<Name>/` ViPkgs from `/dslplugins/<Publisher>/<Name>/` JAR plugins; do not attach private packages.
+Describe what happened, what you expected, and any visible status code or safe error message. If the issue involves a package path, distinguish `/langs/tala/<Publisher>/<Name>/` ViPkgs from `/dslplugins/tazel/<Publisher>/<Name>/` JAR plugins; do not attach private packages.
 
 ### Reproduction
 
diff --git a/apps/api-tests/AccountEndpointTests.cs b/apps/api-tests/AccountEndpointTests.cs
index 9459081..c5c305e 100644
--- a/apps/api-tests/AccountEndpointTests.cs
+++ b/apps/api-tests/AccountEndpointTests.cs
@@ -33,6 +33,21 @@ public sealed class AccountEndpointTests
         Assert.Contains("state=", location.Query, StringComparison.Ordinal);
     }
 
+    [Theory]
+    [InlineData("/api/v1/accounts/oauth/google/callback")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?error=access_denied&state=declined")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?code=forged&state=forged")]
+    public async Task GoogleCallbackThatCannotFinishReturnsToTheSignInPage(string callback)
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateAccountClient(handleCookies: false);
+
+        HttpResponseMessage response = await client.GetAsync(callback, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        Assert.Equal("/login?google=failed", response.Headers.Location?.OriginalString);
+    }
+
     [Fact]
     public async Task GoogleStartRejectsInvalidAccountNameBeforeLeavingTheSite()
     {
diff --git a/apps/api/Program.cs b/apps/api/Program.cs
index 3eb96c9..688fe7d 100644
--- a/apps/api/Program.cs
+++ b/apps/api/Program.cs
@@ -44,6 +44,14 @@ if (!string.IsNullOrWhiteSpace(googleClientId) && !string.IsNullOrWhiteSpace(goo
         options.CallbackPath = "/api/v1/accounts/oauth/google/callback";
         options.SignInScheme = AccountEndpoints.ExternalCookieScheme;
         options.SaveTokens = false;
+        // A callback that cannot finish (the visitor declined on Google, or the state cookie is missing or
+        // expired) would otherwise end in an unhandled 500. The sign-in page explains a failed Google sign-in.
+        options.Events.OnRemoteFailure = context =>
+        {
+            context.Response.Redirect("/login?google=failed");
+            context.HandleResponse();
+            return Task.CompletedTask;
+        };
     });
 }
 builder.Services.AddProblemDetails();
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index cb4b20f..b2b46d6 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -45,8 +45,9 @@ One build serves three hosts. The host of a request, not a separate deployment,
    same URL without the parameter. See [Localization](LOCALIZATION.md).
 2. **Account root.** `/` on the account host is rewritten to the internal `/account` page, so the account landing page
    has the short URL.
-3. **ViGet.** On the ViGet host `/` is rewritten to `/viget` and `/dslplugins` to `/viget/dslplugins`. `/login`,
-   `/register` and `/recover` redirect to the account host.
+3. **ViGet.** On the ViGet host `/` is rewritten to `/viget`, `/langs/tala` to `/viget/langs/tala` and
+   `/dslplugins/tazel` to `/viget/dslplugins/tazel`. `/langs` and `/dslplugins` redirect permanently to those two
+   catalogs. `/login`, `/register` and `/recover` redirect to the account host.
 4. **Internal trees stay internal.** `/viget/...` on any other host redirects to the ViGet host, and `/account` on any
    other host redirects to the account host.
 
@@ -63,11 +64,12 @@ The host is read from `X-Forwarded-Host` first and `Host` second, without the po
 | `/account` (shown as `/` on the account host) | account landing page | no |
 | `/login`, `/register`, `/recover` | authentication and recovery | no |
 | `/<Account>/dashboard` | dashboard of the signed-in account | no |
-| `/viget` (shown as `/` on the ViGet host) | package catalog | yes |
-| `/viget/dslplugins` (shown as `/dslplugins`) | DSL plugin catalog | yes |
+| `/viget` (shown as `/` on the ViGet host) | registry status and the list of catalogs | yes |
+| `/viget/langs/tala` (shown as `/langs/tala`) | catalog of Tala packages | yes |
+| `/viget/dslplugins/tazel` (shown as `/dslplugins/tazel`) | catalog of Tazel DSL plugins | yes |
 
-`robots.txt` and `sitemap.xml` are generated per host: the ViGet host lists its two catalog pages, every other host
-lists the apex homepage only. Nginx additionally sends `X-Robots-Tag: noindex` for the whole account host.
+`robots.txt` and `sitemap.xml` are generated per host: the ViGet host lists its home page and its two catalog pages,
+every other host lists the apex homepage only. Nginx additionally sends `X-Robots-Tag: noindex` for the whole account host.
 
 Pages are rendered on the server for every request, because the language depends on the request. Two components run
 in the browser: the authentication form and the dashboard.
diff --git a/ops/README.md b/ops/README.md
index 59a2e20..d316a6a 100644
--- a/ops/README.md
+++ b/ops/README.md
@@ -98,8 +98,8 @@ There is no scheduled backup yet; see [Known limitations](../docs/LIMITATIONS.md
   of the frontend service.
 
 The Progmasoft and ViGet Nginx hosts must never reuse `/srv/xsharp/website/current`. Tala compiler and language
-content belongs to `xsharp-lang.xyz`; sharing an origin server does not imply sharing a document root or application
-process. The temporary ViGet status API remains on its dedicated loopback service while catalog pages are served by
+content belongs to `tala.run` and its subdomains; sharing an origin server does not imply sharing a document root or
+application process. The temporary ViGet status API remains on its dedicated loopback service while catalog pages are served by
 Progmaweb.
 
 ## Mail boundary