code/cl8y-ecosystem-legal
4
0
Fork 0
Code Issues 4 Pull requests 3 Projects Releases Packages Wiki Activity

ops: register vote.cl8y.com property + CORS + portal redirect allowlist #12

New issue
Closed
opened 2026-08-25 07:04:38 +00:00 by PlasticDigits · 2 comments
PlasticDigits commented 2026-08-25 07:04:38 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Register CL8Y Voting (vote.cl8y.com) as a dedicated Legal property and allow the production origin to call the API and return from the portal.

Integrator: voting#7 (Coolify / Legal / live wallet leftovers after voting !19). The voting dApp already uses @plasticdigits/cl8y-clickwrap with default property=vote.cl8y.com and both network=TerraClassic (Keplr) and network=EVM (MetaMask BSC 56). Without this ops change, connected wallets on https://vote.cl8y.com fail-closed (unsigned / CORS) even after a portal sign.

Acceptances are per hostname. A signature on cl8y.com or dex.cl8y.com is not evidence for vote.cl8y.com. Do not reuse those properties.

Related: #7 (wildcard CORS) does not cover this — add the exact origin. Same playbook as #8 (ust1cmm.com).

Confirm hostname with ops before the admin write. Proposed (already wired in voting): vote.cl8y.com.

Actions (Legal Coolify / hosts)

1. Register the property

From a cl8y-ecosystem-legal checkout (script prompts for ADMIN_TOKEN hidden; do not put the token in this issue or in PlasticDigits/voting):

./scripts/register-property.sh vote.cl8y.com "CL8Y Voting"
./scripts/register-property.sh --list

If that script is missing on the host, GET /api/v1/terms/latest?property=vote.cl8y.com upserts the website row; still set a display name if the admin path supports it.

2. Legal API env (api.terms.cl8y.com)

Add the exact origin to CORS_ORIGINS (comma-separated, no trailing slash):

# keep existing entries; append
CORS_ORIGINS=…,https://vote.cl8y.com

Redeploy / restart the API so build_cors picks it up.

3. Legal portal env (terms.cl8y.com web build)

Add the exact origin to VITE_REDIRECT_URI_ALLOWLIST and rebuild the portal (Vite bakes this in):

# keep existing entries; append
VITE_REDIRECT_URI_ALLOWLIST=…,https://vote.cl8y.com

Do not enable VITE_ALLOW_LOCALHOST_REDIRECT on production portal.

4. Verify

# property exists + Terra Classic and EVM sign URLs
curl -sS 'https://api.terms.cl8y.com/api/v1/terms/latest?property=vote.cl8y.com' \
  | jq '{property, version_label, terra: .sign_urls.terra_classic, evm: .sign_urls.evm}'

# CORS preflight from the dapp origin
curl -sSI -X OPTIONS 'https://api.terms.cl8y.com/api/v1/signatures/status' \
  -H 'Origin: https://vote.cl8y.com' \
  -H 'Access-Control-Request-Method: GET' \
  | grep -i 'access-control-allow-origin'
# expect: Access-Control-Allow-Origin: https://vote.cl8y.com

On https://vote.cl8y.com (after Coolify DNS):

  • Connect a new terra1… → accept → portal /sign/terra-classic?property=vote.cl8y.com&redirect_uri=https%3A%2F%2Fvote.cl8y.com%2F… → return → signed_latest: true.
  • Connect a new 0x… on BSC 56 → accept → portal /sign/evm?property=vote.cl8y.com&… → return → signed_latest: true.

Pins

Item Value
Property vote.cl8y.com
Display name CL8Y Voting
Origin https://vote.cl8y.com
Networks TerraClassic and EVM
Do not use cl8y.com, dex.cl8y.com, www.vote.cl8y.com (unless that host is actually served)

Out of scope

  • No ADMIN_TOKEN in the voting frontend.
  • No change to terms text / version unless product asks.
  • Voting Coolify does not need new Legal URLs (SDK defaults to api.terms.cl8y.com / terms.cl8y.com). Leave VITE_PLAYWRIGHT_E2E unset on the voting production build. See voting#7.
## Summary Register **CL8Y Voting** (`vote.cl8y.com`) as a dedicated Legal property and allow the production origin to call the API and return from the portal. Integrator: [voting#7](https://gitlab.com/PlasticDigits/voting/-/issues/7) (Coolify / Legal / live wallet leftovers after voting !19). The voting dApp already uses `@plasticdigits/cl8y-clickwrap` with default `property=vote.cl8y.com` and **both** `network=TerraClassic` (Keplr) and `network=EVM` (MetaMask BSC 56). Without this ops change, connected wallets on `https://vote.cl8y.com` fail-closed (unsigned / CORS) even after a portal sign. Acceptances are **per hostname**. A signature on `cl8y.com` or `dex.cl8y.com` is **not** evidence for `vote.cl8y.com`. Do not reuse those properties. Related: [#7](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/7) (wildcard CORS) does **not** cover this — add the **exact** origin. Same playbook as [#8](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/8) (`ust1cmm.com`). Confirm hostname with ops before the admin write. Proposed (already wired in voting): `vote.cl8y.com`. --- ## Actions (Legal Coolify / hosts) ### 1. Register the property From a `cl8y-ecosystem-legal` checkout (script prompts for `ADMIN_TOKEN` hidden; do **not** put the token in this issue or in PlasticDigits/voting): ```bash ./scripts/register-property.sh vote.cl8y.com "CL8Y Voting" ./scripts/register-property.sh --list ``` If that script is missing on the host, `GET /api/v1/terms/latest?property=vote.cl8y.com` upserts the website row; still set a display name if the admin path supports it. ### 2. Legal API env (`api.terms.cl8y.com`) Add the exact origin to `CORS_ORIGINS` (comma-separated, no trailing slash): ```bash # keep existing entries; append CORS_ORIGINS=…,https://vote.cl8y.com ``` Redeploy / restart the API so `build_cors` picks it up. ### 3. Legal portal env (`terms.cl8y.com` **web build**) Add the exact origin to `VITE_REDIRECT_URI_ALLOWLIST` and **rebuild** the portal (Vite bakes this in): ```bash # keep existing entries; append VITE_REDIRECT_URI_ALLOWLIST=…,https://vote.cl8y.com ``` Do **not** enable `VITE_ALLOW_LOCALHOST_REDIRECT` on production portal. ### 4. Verify ```bash # property exists + Terra Classic and EVM sign URLs curl -sS 'https://api.terms.cl8y.com/api/v1/terms/latest?property=vote.cl8y.com' \ | jq '{property, version_label, terra: .sign_urls.terra_classic, evm: .sign_urls.evm}' # CORS preflight from the dapp origin curl -sSI -X OPTIONS 'https://api.terms.cl8y.com/api/v1/signatures/status' \ -H 'Origin: https://vote.cl8y.com' \ -H 'Access-Control-Request-Method: GET' \ | grep -i 'access-control-allow-origin' # expect: Access-Control-Allow-Origin: https://vote.cl8y.com ``` On `https://vote.cl8y.com` (after Coolify DNS): - Connect a new `terra1…` → accept → portal `/sign/terra-classic?property=vote.cl8y.com&redirect_uri=https%3A%2F%2Fvote.cl8y.com%2F…` → return → `signed_latest: true`. - Connect a new `0x…` on BSC 56 → accept → portal `/sign/evm?property=vote.cl8y.com&…` → return → `signed_latest: true`. --- ## Pins | Item | Value | |------|--------| | Property | `vote.cl8y.com` | | Display name | `CL8Y Voting` | | Origin | `https://vote.cl8y.com` | | Networks | `TerraClassic` **and** `EVM` | | Do not use | `cl8y.com`, `dex.cl8y.com`, `www.vote.cl8y.com` (unless that host is actually served) | ## Out of scope - No `ADMIN_TOKEN` in the voting frontend. - No change to terms text / version unless product asks. - Voting Coolify does **not** need new Legal URLs (SDK defaults to `api.terms.cl8y.com` / `terms.cl8y.com`). Leave `VITE_PLAYWRIGHT_E2E` unset on the voting production build. See [voting#7](https://gitlab.com/PlasticDigits/voting/-/issues/7).
PlasticDigits commented 2026-08-26 01:13:49 +00:00 (Migrated from gitlab.com)
Copy link

Production probe — 2026-08-26 (read-only)

No admin writes, Coolify edits, or live wallet QA from this session. ADMIN_TOKEN was not used.

Already true

  • API health: GET https://api.terms.cl8y.com/health → {"status":"ok"}
  • Property row exists (public upsert via GET /api/v1/terms/latest?property=vote.cl8y.com): property=vote.cl8y.com, version_label=1.5, both sign URLs present:
    • https://terms.cl8y.com/sign/terra-classic?property=vote.cl8y.com
    • https://terms.cl8y.com/sign/evm?property=vote.cl8y.com
  • Portal sign routes return 200 HTML. Display name is not in the public JSON — still run register-property.sh to set CL8Y Voting.

Still failing (blocks the voting dApp)

  1. CORS — OPTIONS /api/v1/signatures/status with Origin: https://vote.cl8y.com has no Access-Control-Allow-Origin. Contrast: ust1cmm.com, dex.cl8y.com, terms.cl8y.com, cl8y.com all echo their origin. #7 wildcard CORS is not live; add the exact origin.
  2. Portal allowlist — production bundle https://terms.cl8y.com/assets/index-CwSFaYk-.js (last-modified 2026-08-18) includes cl8y.com, www.cl8y.com, dex.cl8y.com, bridge.cl8y.com, yieldomega.com, ust1cmm.com. https://vote.cl8y.com is absent. Rebuild after appending VITE_REDIRECT_URI_ALLOWLIST. VITE_ALLOW_LOCALHOST_REDIRECT is not baked as true.

Out of this issue but blocks end-to-end verify

vote.cl8y.com resolves to 168.119.120.255 but TLS is self-signed and HTTP is 503 no available server (Coolify placeholder). Live Keplr/MetaMask QA waits on voting#7.

Operator leftover (same playbook as #8)

./scripts/register-property.sh vote.cl8y.com "CL8Y Voting"
./scripts/register-property.sh --list

Coolify:

  • API (api.terms.cl8y.com): append https://vote.cl8y.com to CORS_ORIGINS, restart.
  • Portal (terms.cl8y.com): append https://vote.cl8y.com to VITE_REDIRECT_URI_ALLOWLIST, rebuild. Do not enable VITE_ALLOW_LOCALHOST_REDIRECT.
## Production probe — 2026-08-26 (read-only) No admin writes, Coolify edits, or live wallet QA from this session. `ADMIN_TOKEN` was not used. ### Already true - **API health:** `GET https://api.terms.cl8y.com/health` → `{"status":"ok"}` - **Property row exists** (public upsert via `GET /api/v1/terms/latest?property=vote.cl8y.com`): `property=vote.cl8y.com`, `version_label=1.5`, both sign URLs present: - `https://terms.cl8y.com/sign/terra-classic?property=vote.cl8y.com` - `https://terms.cl8y.com/sign/evm?property=vote.cl8y.com` - Portal sign routes return 200 HTML. Display name is **not** in the public JSON — still run `register-property.sh` to set `CL8Y Voting`. ### Still failing (blocks the voting dApp) 1. **CORS** — `OPTIONS /api/v1/signatures/status` with `Origin: https://vote.cl8y.com` has **no** `Access-Control-Allow-Origin`. Contrast: `ust1cmm.com`, `dex.cl8y.com`, `terms.cl8y.com`, `cl8y.com` all echo their origin. `#7` wildcard CORS is **not** live; add the **exact** origin. 2. **Portal allowlist** — production bundle `https://terms.cl8y.com/assets/index-CwSFaYk-.js` (last-modified 2026-08-18) includes `cl8y.com`, `www.cl8y.com`, `dex.cl8y.com`, `bridge.cl8y.com`, `yieldomega.com`, `ust1cmm.com`. **`https://vote.cl8y.com` is absent.** Rebuild after appending `VITE_REDIRECT_URI_ALLOWLIST`. `VITE_ALLOW_LOCALHOST_REDIRECT` is not baked as `true`. ### Out of this issue but blocks end-to-end verify `vote.cl8y.com` resolves to `168.119.120.255` but TLS is self-signed and HTTP is `503 no available server` (Coolify placeholder). Live Keplr/MetaMask QA waits on [voting#7](https://gitlab.com/PlasticDigits/voting/-/issues/7). ### Operator leftover (same playbook as #8) ```bash ./scripts/register-property.sh vote.cl8y.com "CL8Y Voting" ./scripts/register-property.sh --list ``` Coolify: - API (`api.terms.cl8y.com`): append `https://vote.cl8y.com` to `CORS_ORIGINS`, restart. - Portal (`terms.cl8y.com`): append `https://vote.cl8y.com` to `VITE_REDIRECT_URI_ALLOWLIST`, **rebuild**. Do not enable `VITE_ALLOW_LOCALHOST_REDIRECT`.
PlasticDigits commented 2026-08-26 01:26:36 +00:00 (Migrated from gitlab.com)
Copy link

Ops complete — verification 2026-08-26

Completed on Legal Coolify / hosts (no ADMIN_TOKEN recorded here). Same playbook as #8.

Steps done

  1. Property — ./scripts/register-property.sh vote.cl8y.com "CL8Y Voting" (and --list).
    • kind=website, identifier=vote.cl8y.com, display_name=CL8Y Voting
    • created_at=2026-08-26T01:12:32.968450+00:00
  2. API — appended https://vote.cl8y.com to CORS_ORIGINS on api.terms.cl8y.com; API restarted.
  3. Portal — appended https://vote.cl8y.com to VITE_REDIRECT_URI_ALLOWLIST; portal rebuilt. VITE_ALLOW_LOCALHOST_REDIRECT left off in production.

Automated verify (pass)

Property + Terra Classic and EVM sign URLs

GET https://api.terms.cl8y.com/api/v1/terms/latest?property=vote.cl8y.com
Field Result
property vote.cl8y.com
version_label 1.5
sign_urls.terra_classic https://terms.cl8y.com/sign/terra-classic?property=vote.cl8y.com
sign_urls.evm https://terms.cl8y.com/sign/evm?property=vote.cl8y.com
content_sha256 fe8f0029fb14fb8c1705f6c462d384153660ac98954502a406634f73822f6189

CORS preflight (OPTIONS /api/v1/signatures/status, Origin: https://vote.cl8y.com)

  • HTTP 200
  • Access-Control-Allow-Origin: https://vote.cl8y.com

Negative check: Origin: https://www.vote.cl8y.com → no Access-Control-Allow-Origin (expected; exact origin only).

Portal allowlist (production bundle)

https://terms.cl8y.com/assets/index--hE9wWsL.js includes https://vote.cl8y.com alongside existing origins (cl8y.com, www.cl8y.com, dex.cl8y.com, bridge.cl8y.com, yieldomega.com, ust1cmm.com). No VITE_ALLOW_LOCALHOST_REDIRECT string in the bundle.

Not run here

Live wallet round-trip on https://vote.cl8y.com (new terra1… / 0x… on BSC 56 → portal sign → signed_latest: true) still needs a voting Coolify host. DNS is up but the origin currently returns 503 no available server. Tracked on voting#7. API + CORS + baked redirect origin are in place for that path.

Closing: issue acceptance curls and portal bake-in succeeded.

## Ops complete — verification 2026-08-26 Completed on Legal Coolify / hosts (no `ADMIN_TOKEN` recorded here). Same playbook as #8. ### Steps done 1. **Property** — `./scripts/register-property.sh vote.cl8y.com "CL8Y Voting"` (and `--list`). - `kind=website`, `identifier=vote.cl8y.com`, `display_name=CL8Y Voting` - `created_at=2026-08-26T01:12:32.968450+00:00` 2. **API** — appended `https://vote.cl8y.com` to `CORS_ORIGINS` on `api.terms.cl8y.com`; API restarted. 3. **Portal** — appended `https://vote.cl8y.com` to `VITE_REDIRECT_URI_ALLOWLIST`; portal rebuilt. `VITE_ALLOW_LOCALHOST_REDIRECT` left off in production. ### Automated verify (pass) **Property + Terra Classic and EVM sign URLs** ``` GET https://api.terms.cl8y.com/api/v1/terms/latest?property=vote.cl8y.com ``` | Field | Result | |-------|--------| | `property` | `vote.cl8y.com` | | `version_label` | `1.5` | | `sign_urls.terra_classic` | `https://terms.cl8y.com/sign/terra-classic?property=vote.cl8y.com` | | `sign_urls.evm` | `https://terms.cl8y.com/sign/evm?property=vote.cl8y.com` | | `content_sha256` | `fe8f0029fb14fb8c1705f6c462d384153660ac98954502a406634f73822f6189` | **CORS preflight** (`OPTIONS /api/v1/signatures/status`, `Origin: https://vote.cl8y.com`) - HTTP 200 - `Access-Control-Allow-Origin: https://vote.cl8y.com` Negative check: `Origin: https://www.vote.cl8y.com` → no `Access-Control-Allow-Origin` (expected; exact origin only). **Portal allowlist (production bundle)** `https://terms.cl8y.com/assets/index--hE9wWsL.js` includes `https://vote.cl8y.com` alongside existing origins (`cl8y.com`, `www.cl8y.com`, `dex.cl8y.com`, `bridge.cl8y.com`, `yieldomega.com`, `ust1cmm.com`). No `VITE_ALLOW_LOCALHOST_REDIRECT` string in the bundle. ### Not run here Live wallet round-trip on `https://vote.cl8y.com` (new `terra1…` / `0x…` on BSC 56 → portal sign → `signed_latest: true`) still needs a voting Coolify host. DNS is up but the origin currently returns `503 no available server`. Tracked on [voting#7](https://gitlab.com/PlasticDigits/voting/-/issues/7). API + CORS + baked redirect origin are in place for that path. Closing: issue acceptance curls and portal bake-in succeeded.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-26 01:26:38 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/34
issue/37
renovate/configure
No results found.
Labels
Clear labels   
agent:implement
agent-control

  
agent:ready
agent-control

  
api

   
bot

   
bug

   
ci

   
enhancement

   
ready
agent-control

  
security

   
terra-classic

   
testing

   
ux

   
web
No labels
agent:implement
agent:ready
api
bot
bug
ci
enhancement
ready
security
terra-classic
testing
ux
web
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-ecosystem-legal#12
No description provided.