giles 13bcf755f6 Add OOB header swaps for sx docs navigation + enable OAuth + fragments ...

- OOB nav updates: AJAX navigation now swaps both menu bar levels
  (main nav highlighting + sub-nav with current page) using the same
  oob_header_sx/oob_page_sx pattern as blog/market/events
- Enable OAuth for sx and test apps (removed from _NO_OAUTH, added sx
  to ALLOWED_CLIENTS, added app_urls for sx/test/orders)
- Fetch real cross-service fragments (cart-mini, auth-menu, nav-tree)
  instead of hardcoding empty values
- Add :selected param to ~menu-row-sx for white text current-page label
- Fix duplicate element IDs: use menu-row-sx child_id/child mechanism
  instead of manual header_child_sx wrappers
- Fix home page copy: "Server-rendered DOM over the wire (no HTML)"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-02 23:22:01 +00:00

..

__init__.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

actions.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

activitypub.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

ap_inbox_handlers.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

ap_social.py

Send all responses as sexp wire format with client-side rendering

2026-03-01 09:45:07 +00:00

auth_redis.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

cart_identity.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

context.py

Rebrand sexp → sx across web platform (173 files)

2026-03-01 11:06:57 +00:00

data_client.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

factory.py

Add OOB header swaps for sx docs navigation + enable OAuth + fragments

2026-03-02 23:22:01 +00:00

fragments.py

Rebrand sexp → sx across web platform (173 files)

2026-03-01 11:06:57 +00:00

ghost_admin_token.py

Decouple cross-domain DB queries for per-app database split

2026-02-25 11:32:14 +00:00

http_utils.py

Send all responses as sexp wire format with client-side rendering

2026-03-01 09:45:07 +00:00

internal_auth.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

internal_inbox_client.py

Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

2026-02-26 14:49:04 +00:00

internal_inbox.py

Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

2026-02-26 14:49:04 +00:00

jinja_setup.py

Remove widget system — fully replaced by fragment composition

2026-02-25 01:20:58 +00:00

oauth.py

Fix cross-DB queries: move page_configs to cart, fix OAuth code_hash lookup

2026-02-26 17:43:21 +00:00

oembed.py

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

rate_limit.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

urls.py

Split cart into 4 microservices: relations, likes, orders, page-config→blog

2026-02-27 09:03:33 +00:00

user_loader.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00