giles bc7a4a5128 Add cross-service URL functions and rights to base_context ...

blog_url, market_url, cart_url, events_url and g.rights were only
available as Jinja globals, not in the ctx dict passed to sexp
helper functions. This caused all cross-service links in the header
system (post title, cart badge, admin cog, admin nav items) to
produce relative URLs resolving to the current service domain.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-28 23:19:42 +00:00

..

__init__.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

actions.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

activitypub.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

ap_inbox_handlers.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

ap_social.py

Fix AP blueprint cross-DB queries + harden Ghost sync init

2026-02-25 14:06:42 +00:00

auth_redis.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

cart_identity.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

context.py

Add cross-service URL functions and rights to base_context

2026-02-28 23:19:42 +00:00

data_client.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

factory.py

Skip OAuth/auth for test service (public dashboard)

2026-02-28 20:24:07 +00:00

fragments.py

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

ghost_admin_token.py

Decouple cross-domain DB queries for per-app database split

2026-02-25 11:32:14 +00:00

http_utils.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

internal_auth.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

internal_inbox_client.py

Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

2026-02-26 14:49:04 +00:00

internal_inbox.py

Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

2026-02-26 14:49:04 +00:00

jinja_setup.py

Remove widget system — fully replaced by fragment composition

2026-02-25 01:20:58 +00:00

oauth.py

Fix cross-DB queries: move page_configs to cart, fix OAuth code_hash lookup

2026-02-26 17:43:21 +00:00

oembed.py

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

rate_limit.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

urls.py

Split cart into 4 microservices: relations, likes, orders, page-config→blog

2026-02-27 09:03:33 +00:00

user_loader.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00