Merge pull request #29 from niteeshkanna-sh/claude/stoic-rubin-fnglq7

Ship the admin panel with the build, where the host actually serves from

Author: niteeshkanna-sh

my-app/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && vite",
-    "build": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && tsc -b && vite build && node scripts/prerender-seo.mjs",
+    "build": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && tsc -b && vite build && node scripts/copy-admin-panel.mjs && node scripts/prerender-seo.mjs",
     "lint": "oxlint",
     "preview": "vite preview"
   },

my-app/scripts/copy-admin-panel.mjs

@@ -0,0 +1,52 @@
+// Copies the PHP admin panel into the build output, so it ships with the site.
+//
+// Hostinger deploys this repository by running `npm run build` and serving
+// my-app/dist. That means dist is the document root: anything not in it does
+// not exist as far as the web is concerned, which is why niteshacars.in/admin
+// returned the site's own "page not found" while the panel sat perfectly well
+// in the repository.
+//
+// Vite copies public/ verbatim into dist/, so the panel could simply live
+// there -- but public/ is for the website's own assets, and burying a PHP
+// application inside it would be a surprise to anyone reading the tree. This
+// copies it explicitly instead, after the build, where the intent is visible.
+//
+// config.php is never copied. It holds the database password, it is gitignored,
+// and dist is rebuilt from scratch on every deploy -- so anything written into
+// it is temporary by construction. The panel finds its configuration outside
+// the build output; see config() in the panel's src/db.php.
+
+import { cp, mkdir, rm, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const source = join(dirname(root), 'public_html', 'admin.niteshacars.in', 'admin');
+const target = join(root, 'dist', 'admin');
+
+// Never ship these. The test tooling is not a security boundary, but it is
+// noise on a public server and some of it takes arguments.
+const SKIP = new Set(['config.php', '.ftp-deploy-sync-state.json', '.ftp-deploy-admin-state.json']);
+
+try {
+  await stat(source);
+} catch {
+  console.error(`copy-admin-panel: no panel at ${source}`);
+  process.exit(1);
+}
+
+await rm(target, { recursive: true, force: true });
+await mkdir(dirname(target), { recursive: true });
+
+let copied = 0;
+await cp(source, target, {
+  recursive: true,
+  filter: (src) => {
+    const name = src.slice(src.lastIndexOf('/') + 1);
+    if (SKIP.has(name)) return false;
+    copied += 1;
+    return true;
+  },
+});
+
+console.log(`copy-admin-panel: ${copied} entries into dist/admin`);

public_html/admin.niteshacars.in/admin/src/db.php

@@ -15,6 +15,58 @@ function config_set(array $values): void
     $GLOBALS['__config_override'] = $values;
 }
 
+/**
+ * Finds config.php.
+ *
+ * It used to be one fixed path, next to the panel. That stopped working when
+ * the host began deploying this repository by building it: the build output is
+ * the document root and it is recreated from scratch every time, so anything
+ * written beside the panel is erased on the next push. Keeping the file there
+ * would mean re-uploading the database password after every deploy.
+ *
+ * So the panel looks outward instead. A directory named nitesha-config,
+ * anywhere above the panel, holds the file; being outside the document root it
+ * survives deploys and cannot be fetched over HTTP even if a rule is
+ * misconfigured, which is where a database password belongs anyway.
+ *
+ * The old location is still checked first, so an install that predates this
+ * keeps working untouched.
+ *
+ * Returns null when there is nothing to load; the caller decides what to say.
+ */
+function config_path(): ?string
+{
+    $explicit = getenv('NITESHA_CONFIG');
+    if (is_string($explicit) && $explicit !== '' && is_file($explicit)) {
+        return $explicit;
+    }
+
+    // Beside the panel: how this has always worked, and still right for an
+    // install that is uploaded rather than built.
+    $beside = __DIR__ . '/../config.php';
+    if (is_file($beside)) {
+        return $beside;
+    }
+
+    // Then upwards. Six levels is past the account root on every layout this
+    // has run on, and stopping at the filesystem root keeps it terminating on
+    // any layout it has not.
+    $dir = dirname(__DIR__);
+    for ($i = 0; $i < 6; $i++) {
+        $candidate = $dir . '/nitesha-config/config.php';
+        if (is_file($candidate)) {
+            return $candidate;
+        }
+        $parent = dirname($dir);
+        if ($parent === $dir) {
+            break;
+        }
+        $dir = $parent;
+    }
+
+    return null;
+}
+
 function config(?string $key = null): mixed
 {
     static $config = null;
@@ -24,8 +76,8 @@ function config(?string $key = null): mixed
     }
 
     if ($config === null) {
-        $path = __DIR__ . '/../config.php';
-        if (!is_file($path)) {
+        $path = config_path();
+        if ($path === null) {
             http_response_code(500);
             exit('Not set up yet. Open install.php in your browser to get started.');
         }