Separate ViGet catalogs from Progmasoft account ownership. Move login, registration, recovery, and dashboard navigation to account.progmasoft.com, document the canonical account.progmasoft.com/<Account>/dashboard route, and define each ViGet Publisher as that exact Progmasoft Account identity. Redirect legacy ViGet account routes to the account service and expose only the exact registry status endpoint while closing the retired standalone authentication and token API surface.

8 files changed, 67 insertions, 32 deletions

diff --git a/README.md b/README.md
index 3f2cd43..df54f06 100644
--- a/README.md
+++ b/README.md
@@ -13,9 +13,9 @@ This repository contains the public web surface for the Visual X# programming la
 - `frontend/` is the Astro website. It is emitted as static HTML and assets.
 - `backend/` is the ASP.NET Core Identity and package-registry API. It owns password and Google authentication,
   verification/recovery mail, secure session cookies, PostgreSQL persistence, and digest-only CLI tokens.
-The registry account dashboard is available at
-[`viget.progmasoft.com/dashboard`](https://viget.progmasoft.com/dashboard/). Package publication remains closed while
-the compiler package contract is completed. Registry tokens follow the Cargo model: the plaintext is returned once,
+Account dashboards use the canonical
+`https://account.progmasoft.com/<Account>/dashboard` route. Package publication remains closed while the compiler
+package contract is completed. Registry tokens follow the Cargo model: the plaintext is returned once,
 only a SHA-256 digest is retained, and a user can revoke each token independently. Account deletion permanently
 removes the Identity account, external logins, verification records, and registry tokens.
 
@@ -24,26 +24,23 @@ ViGet keeps DSL plugins and Visual X# packages in separate canonical catalogs:
 - `https://viget.progmasoft.com/dslplugins/<Publisher>/<Name>/` contains Kotlin DSL plugin JARs.
 - `https://viget.progmasoft.com/<Publisher>/<Name>/` contains Visual X# `.vipkg` packages.
 
+`<Publisher>` is not a second registry identity. It is exactly the canonical Progmasoft `<Account>` name used by
+`https://account.progmasoft.com/<Account>/dashboard`; ViGet does not register a separate publisher name.
+
 These paths reserve catalog identity; they do not imply that publishing or downloading is available before the registry
 HTTP contract is implemented.
 
-Authentication and registry APIs are same-origin under `https://viget.progmasoft.com/api/`. The Visual X# language host
-does not expose registry pages, login or registration routes, and the retired `api.xsharp-lang.xyz` host is not part of
-the production contract.
+Login, registration, recovery, and dashboards belong to `account.progmasoft.com`; ViGet owns package catalogs. The
+Visual X# language host does not expose registry pages or account routes, and the retired `api.xsharp-lang.xyz` host is
+not part of the production contract.
 
 The PostgreSQL provider is selected solely by `ConnectionStrings__Registry`. Production uses the PostgreSQL instance on
 the project-owned server over a local Unix socket; the database is not delegated to a hosted database service or exposed
 to the browser. Google OAuth client credentials, the database connection, auth-code pepper, and data-protection
 certificate stay in host-managed secrets.
 
-The Google OAuth web client callback is
-`https://viget.progmasoft.com/api/v1/auth/google/callback`. Configure it through
-`Authentication__Google__ClientId` and `Authentication__Google__ClientSecret`. Until both values exist, the frontend
-keeps the Google button visible but disabled and email/password authentication remains available.
-Every completed Google authorization still requires the short-lived Visual X# email code before a registry session is issued.
-New accounts choose a publisher username before email verification. The canonical spelling is case-sensitive and must contain
-8–128 ASCII letters or digits, beginning with an uppercase letter. Ownership is case-insensitively unique, so case-only
-variants cannot impersonate an existing publisher; `Progmasoft` and `Leitwolf` are reserved.
+OAuth and account registration belong to the Progmasoft account service. The ViGet deployment must not enable its retired
+standalone Google client or ask for a second publisher username.
 
 ## Requirements
 
diff --git a/backend/Auth/AuthEndpoints.cs b/backend/Auth/AuthEndpoints.cs
index 9b490d0..d866a48 100644
--- a/backend/Auth/AuthEndpoints.cs
+++ b/backend/Auth/AuthEndpoints.cs
@@ -15,9 +15,9 @@ namespace XSharp.Web.Api.Auth;
 
 internal static class AuthEndpoints
 {
-    private const string DashboardUrl = "https://viget.progmasoft.com/dashboard/";
-    private const string LoginUrl = "https://viget.progmasoft.com/login/";
-    private const string RegisterUrl = "https://viget.progmasoft.com/register/";
+    private const string DashboardUrl = "https://account.progmasoft.com/";
+    private const string LoginUrl = "https://account.progmasoft.com/login";
+    private const string RegisterUrl = "https://account.progmasoft.com/register";
 
     public static void MapAuthEndpoints(this WebApplication app)
     {
diff --git a/frontend/public/scripts/auth-flow.v3.js b/frontend/public/scripts/auth-flow.v3.js
index 6c16437..5570e8b 100644
--- a/frontend/public/scripts/auth-flow.v3.js
+++ b/frontend/public/scripts/auth-flow.v3.js
@@ -133,7 +133,7 @@ form?.addEventListener("submit", async (event) => {
     }
     const response = await request("login", { email, password });
     if (!response.ok) return explainFailure(response);
-    window.location.assign("https://viget.progmasoft.com/dashboard/");
+    window.location.assign("https://account.progmasoft.com/");
     return;
   }
 
@@ -165,7 +165,7 @@ form?.addEventListener("submit", async (event) => {
     }
     const response = await request("verify-email", { email, code, publisherName });
     if (!response.ok) return explainFailure(response);
-    window.location.assign("https://viget.progmasoft.com/dashboard/");
+    window.location.assign("https://account.progmasoft.com/");
     return;
   }
 
@@ -176,7 +176,7 @@ form?.addEventListener("submit", async (event) => {
   }
   const response = await request("recovery/complete", { email, code: recoveryCode, password });
   if (!response.ok) return explainFailure(response);
-  window.location.assign("https://viget.progmasoft.com/dashboard/");
+  window.location.assign("https://account.progmasoft.com/");
 });
 
 initializeGoogleVerification();
diff --git a/frontend/public/scripts/dashboard.v1.js b/frontend/public/scripts/dashboard.v1.js
index 3337df3..9b3ce97 100644
--- a/frontend/public/scripts/dashboard.v1.js
+++ b/frontend/public/scripts/dashboard.v1.js
@@ -67,7 +67,7 @@ async function revokeToken(id) {
 async function initialize() {
   const response = await fetch("/api/v1/auth/me", { credentials: "include" });
   if (response.status === 401) {
-    window.location.replace("https://viget.progmasoft.com/login/");
+    window.location.replace("https://account.progmasoft.com/login");
     return;
   }
   if (!response.ok) return showAlert("Account information could not be loaded.", true);
@@ -90,7 +90,7 @@ async function initialize() {
 
 root?.querySelector("[data-signout]")?.addEventListener("click", async () => {
   await fetch("/api/v1/auth/logout", { method: "POST", credentials: "include" });
-  window.location.assign("https://viget.progmasoft.com/login/");
+  window.location.assign("https://account.progmasoft.com/login");
 });
 root?.querySelector("[data-token-open]")?.addEventListener("click", () => dialog?.showModal());
 dialog?.querySelector("[data-token-close]")?.addEventListener("click", () => dialog?.close());
@@ -122,7 +122,7 @@ deleteForm?.addEventListener("submit", async (event) => {
     showAlert("The account could not be deleted.", true);
     return;
   }
-  window.location.replace("https://viget.progmasoft.com/?account=deleted");
+  window.location.replace("https://account.progmasoft.com/?account=deleted");
 });
 
 tokenForm?.addEventListener("submit", async (event) => {
diff --git a/frontend/src/components/AuthPanel.astro b/frontend/src/components/AuthPanel.astro
index 96ad487..dd7f46f 100644
--- a/frontend/src/components/AuthPanel.astro
+++ b/frontend/src/components/AuthPanel.astro
@@ -14,7 +14,7 @@ const copy = {
     submit: "Next",
     switchText: "New to the registry?",
     switchLabel: "Create an account",
-    switchHref: "https://viget.progmasoft.com/register/",
+    switchHref: "https://account.progmasoft.com/register",
   },
   register: {
     title: "Create account",
@@ -22,7 +22,7 @@ const copy = {
     submit: "Next",
     switchText: "Already have an account?",
     switchLabel: "Sign in",
-    switchHref: "https://viget.progmasoft.com/login/",
+    switchHref: "https://account.progmasoft.com/login",
   },
   recover: {
     title: "Recover account",
@@ -30,7 +30,7 @@ const copy = {
     submit: "Send code",
     switchText: "Remembered your password?",
     switchLabel: "Sign in",
-    switchHref: "https://viget.progmasoft.com/login/",
+    switchHref: "https://account.progmasoft.com/login",
   },
 } as const;
 const content = copy[mode];
@@ -99,7 +99,7 @@ const content = copy[mode];
         <button class="auth-submit" type="submit">{mode === "register" ? "Create account" : "Sign in"}</button>
         {
           mode === "login" && (
-            <a class="auth-recovery" href="https://viget.progmasoft.com/recover/">Forgot password?</a>
+            <a class="auth-recovery" href="https://account.progmasoft.com/recover">Forgot password?</a>
           )
         }
       </div>
diff --git a/frontend/src/components/RepositoryHeader.astro b/frontend/src/components/RepositoryHeader.astro
index 4732ca4..625bf2c 100644
--- a/frontend/src/components/RepositoryHeader.astro
+++ b/frontend/src/components/RepositoryHeader.astro
@@ -22,11 +22,11 @@ const { authenticated = false } = Astro.props;
     <a href="https://viget.progmasoft.com/dslplugins/">DSL plugins</a>
     {
       authenticated ? (
-        <a href="https://viget.progmasoft.com/dashboard/">Dashboard</a>
+        <a href="https://account.progmasoft.com/">Account</a>
       ) : (
         <>
-          <a href="https://viget.progmasoft.com/login/">Log in</a>
-          <a class="repository-register" href="https://viget.progmasoft.com/register/">Register</a>
+          <a href="https://account.progmasoft.com/login">Log in</a>
+          <a class="repository-register" href="https://account.progmasoft.com/register">Register</a>
         </>
       )
     }
diff --git a/frontend/src/pages/repo/dashboard/index.astro b/frontend/src/pages/repo/dashboard/index.astro
index a004b92..1c8a09f 100644
--- a/frontend/src/pages/repo/dashboard/index.astro
+++ b/frontend/src/pages/repo/dashboard/index.astro
@@ -106,7 +106,7 @@ import SiteLayout from "../../../layouts/SiteLayout.astro";
               <strong>Password</strong>
               <span>Change your password through a verified recovery email.</span>
             </div>
-            <a class="button secondary glass-panel" href="https://viget.progmasoft.com/recover/">Reset password</a>
+            <a class="button secondary glass-panel" href="https://account.progmasoft.com/recover">Reset password</a>
           </div>
         </section>
       </div>
diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 7881759..5c57ff6 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -88,7 +88,39 @@ server {
 
     include /etc/nginx/snippets/repository-security-headers.conf;
 
-    location /api/ {
+    location = /login {
+        return 308 https://account.progmasoft.com/login$is_args$args;
+    }
+
+    location = /login/ {
+        return 308 https://account.progmasoft.com/login$is_args$args;
+    }
+
+    location = /register {
+        return 308 https://account.progmasoft.com/register$is_args$args;
+    }
+
+    location = /register/ {
+        return 308 https://account.progmasoft.com/register$is_args$args;
+    }
+
+    location = /recover {
+        return 308 https://account.progmasoft.com/recover$is_args$args;
+    }
+
+    location = /recover/ {
+        return 308 https://account.progmasoft.com/recover$is_args$args;
+    }
+
+    location = /dashboard {
+        return 308 https://account.progmasoft.com/$is_args$args;
+    }
+
+    location = /dashboard/ {
+        return 308 https://account.progmasoft.com/$is_args$args;
+    }
+
+    location = /api/v1/status {
         proxy_http_version 1.1;
         proxy_pass http://127.0.0.1:5080;
         proxy_set_header Host $host;
@@ -98,6 +130,12 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
     }
 
+    # Account registration and registry-token ownership use the canonical
+    # Progmasoft Account service. ViGet does not expose its retired auth API.
+    location ^~ /api/ {
+        return 404;
+    }
+
     location /_astro/ {
         alias /srv/xsharp/website/current/frontend/_astro/;
         include /etc/nginx/snippets/repository-security-headers.conf;