1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
<!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
# Progmaweb
Progmaweb is the public web and account surface for Progmasoft. The repository intentionally keeps presentation and
account policy in one deployable workspace while preserving a strict process boundary between the Next.js frontend and
the ASP.NET Core API.
## Public hosts
- `progmasoft.com` serves the canonical organization homepage; `www.progmasoft.com` redirects to it.
- `account.progmasoft.com` serves account discovery and authentication.
- `account.progmasoft.com/login` signs an existing account in.
- `account.progmasoft.com/register` creates a new account after server-side validation.
- `account.progmasoft.com/<Account>/dashboard` serves the authenticated account dashboard.
- `viget.progmasoft.com` serves the public Visual X# package catalog.
- `viget.progmasoft.com/dslplugins/` serves the separate Kotlin DSL plugin catalog.
Account names preserve their original display case but reserve names case-insensitively, preventing visually confusing
duplicates. Email uniqueness is also evaluated case-insensitively by the API.
ViGet does not maintain a separate publisher name. A package coordinate's `<Publisher>` segment is exactly the
canonical Progmasoft `<Account>` name, with the same spelling and case.
## Architecture
- `apps/web` is a Next.js App Router application. Host-aware routing keeps the public organization, account, and ViGet
surfaces in one build without coupling their page hierarchies.
- `apps/api` is an ASP.NET Core minimal API. It owns account-name policy, password hashing, session issuance, secure
cookies, rate limiting, and authorization.
- The browser never receives password hashes, session digests, deployment secrets, or database credentials.
- Production account maintenance is an explicit operations workflow. The public API does not contain bulk-delete,
reset-all, seed-password, or environment-password endpoints.
## Requirements
- Node.js 24 or newer
- pnpm 11 or newer
- .NET SDK 10
The initial Progmaweb release, Git tag, and GitHub Release use version `1.0.0`. Visual X# compiler versions belong to
the language repositories and do not determine this website's version.
## Development
Install frontend dependencies and start Next.js:
```text
pnpm install --frozen-lockfile
pnpm dev
```
Start the account API in another terminal:
```text
dotnet run --project apps/api/Progmaweb.Api.csproj
```
The frontend defaults to `http://localhost:5085` for server-side API requests. Set `PROGMAWEB_API_ORIGIN` when the API
uses another origin. Browser requests use the same-origin `/api` boundary so production can proxy them without exposing
an internal address.
Google sign-in uses a server-side authorization-code flow. Configure `Authentication__Google__ClientId` and
`Authentication__Google__ClientSecret` only in the process environment or secret manager. The production OAuth client
uses `https://account.progmasoft.com` as its JavaScript origin and
`https://account.progmasoft.com/api/v1/accounts/oauth/google/callback` as its exact redirect URI. Never commit the
downloaded Google client JSON.
## Verification
```text
pnpm check
pnpm test
pnpm test:coverage
pnpm build
dotnet build apps/api/Progmaweb.Api.csproj --configuration Release
dotnet test --project apps/api-tests/Progmaweb.Api.Tests.csproj --configuration Release
dotnet test --project apps/api-tests/Progmaweb.Api.Tests.csproj --configuration Release --coverlet --coverlet-output-format cobertura
```
Frontend tests exercise the published locale contract and account/ViGet metadata without starting a production service.
The frontend LCOV and API Cobertura reports are retained as one-day artifacts, then uploaded to Codecov by separate
jobs. Only those upload jobs receive `id-token: write`; dependency installation, builds, and tests do not receive OIDC
permissions, and fork-originated pull requests skip the upload jobs. CodeQL and Codacy provide static analysis;
Dependabot proposes dependency updates without merging them automatically.
## License
Progmaweb project-owned source code is licensed under `AGPL-3.0-or-later`, matching the Visual X# website, with the
additional Progmasoft Patent Grant, Version 1.1. See `LICENSE.txt`, `PATENTS`,
`LICENSES/AdditionRef-Progmasoft-Patent-Grant-1.1.txt`, and `NOTICE.txt`. Third-party dependencies remain under their
respective licenses.
|