Merge pull request #85 from theta42/release-1.1.14

Bump version to 1.1.14

CHANGELOG.md

@@ -6,6 +6,16 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.1.14] - 2026-07-17
+
+### Changed
+- Bumped `@simpleworkjs/conf` to 1.2.0 and `jq-repeat` to 2.2.0. The Docker entrypoint now sets the new `CONF_SECRETS` env var to point directly at a mounted `sso-secrets.js` instead of symlinking it into `/app/conf/secrets.js` — the app no longer needs write access to its own `conf/` directory to pick up mounted secrets.
+
+## [1.1.13] - 2026-07-17
+
+### Fixed
+- The new concept docs' cross-links (`concepts-accounts.html` etc.) are the correct, working URL on the Jekyll/GitHub Pages build (where the page's URL is its filename stem) but didn't resolve in the in-app docs viewer, which serves docs at a separate short slug (`/docs/accounts`). The in-app renderer now also resolves a doc's real filename as a fallback, so one link written in a doc works on both targets.
+
 ## [1.1.12] - 2026-07-17
 
 ### Added
@@ -14,12 +24,12 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 ### Fixed
 - The in-app docs viewer rendered every `docs/*.md` page with a garbled heading and a stray horizontal rule at the top — Jekyll front matter (meant only for the GitHub Pages build) was never stripped before being handed to the markdown renderer. Also fixed: cross-doc links (`ldap.html`, `index.html`, etc.) never resolved in-app, since this viewer serves docs at `/docs/<slug>` with no `.html` suffix — they're now rewritten to the correct in-app URL, the same way image paths already were.
 
-Bumps to v1.1.12.
+## [1.1.11] - 2026-07-17
 
 ### Changed
 - Moved the help (❓) link out of the global header and onto each relevant card individually (Invite User, Add new user, User List, Service Accounts, group cards, OAuth/LDAP integration cards, My groups, Members of `<uid>`'s group, New API Token) — each now deep-links straight to the doc that actually covers it, instead of one generic header icon.
 
-Bumps to v1.1.11.
+## [1.1.10] - 2026-07-17
 
 ### Added
 - A help icon (❓) in the top-right header now deep-links to the doc most relevant to the current page (falls back to the docs index elsewhere).
@@ -96,7 +106,9 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 - Unix/POSIX and LDAP bind-only service account support, distinct from real-person accounts.
 - Merged OAuth Apps + LDAP Info into a single Integrations page.
 
-[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.12...HEAD
+[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.14...HEAD
+[1.1.14]: https://github.com/theta42/sso-manager-node/compare/v1.1.13...v1.1.14
+[1.1.13]: https://github.com/theta42/sso-manager-node/compare/v1.1.12...v1.1.13
 [1.1.12]: https://github.com/theta42/sso-manager-node/compare/v1.1.11...v1.1.12
 [1.1.11]: https://github.com/theta42/sso-manager-node/compare/v1.1.10...v1.1.11
 [1.1.10]: https://github.com/theta42/sso-manager-node/compare/v1.1.9...v1.1.10

docker-entrypoint.sh

@@ -6,12 +6,12 @@
 # production, run a dedicated LDAP server and point the app at it via app_*
 # env vars (or a mounted conf/secrets.js) using the app-only image.
 #
-# The app reads its configuration from conf/base.js + conf/secrets.js, deep-merged
-# by @simpleworkjs/conf, with `app_*` environment variables as the
-# highest-precedence override layer. This entrypoint exports those `app_*`
-# vars so the app connects to the bundled slapd without any mounted secrets
-# file. Any `app_*` var already set in the environment wins (the values below
-# are defaults/fallbacks only).
+# The app reads its configuration from conf/base.js + a secrets file, deep-merged
+# by @simpleworkjs/conf (requires >= 1.2.0, pinned in nodejs/package-lock.json),
+# with `app_*` environment variables as the highest-precedence override layer.
+# This entrypoint exports those `app_*` vars so the app connects to the bundled
+# slapd without any mounted secrets file. Any `app_*` var already set in the
+# environment wins (the values below are defaults/fallbacks only).
 
 set -e
 
@@ -33,14 +33,15 @@ error() { echo "[ERROR] $*" >&2; }
 # ── Optional: load operational config from a mounted secrets.js ──────────────
 # The unified theta-env stack mounts ./config/sso-secrets.js at /config and
 # treats it as the authoritative source for the SSO's config (LDAP base, admin
-# password, org name, JWT secret, ...). When present, symlink it into
-# /app/conf/secrets.js so @simpleworkjs/conf reads it, and override the
-# env-derived operational vars below with the file's values. When absent
-# (standalone / env-var deployments) the env vars set above stay in effect and
-# the app_* exports further down are emitted as before.
+# password, org name, JWT secret, ...). When present, point CONF_SECRETS at it
+# so @simpleworkjs/conf reads it directly (no write access to /app/conf
+# needed), and override the env-derived operational vars below with the
+# file's values. When absent (standalone / env-var deployments) the env vars
+# set above stay in effect and the app_* exports further down are emitted as
+# before.
 SECRETS_JS_MODE=0
 if [[ -f /config/sso-secrets.js ]]; then
-    ln -sf /config/sso-secrets.js /app/conf/secrets.js
+    export CONF_SECRETS=/config/sso-secrets.js
     SECRETS_JS_MODE=1
     # Pull the entrypoint's operational vars out of secrets.js in one node call.
     # Node emits `KEY<TAB>base64(value)` lines; we decode each with base64 -d and

nodejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.12",
+  "version": "1.1.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.1.12",
+      "version": "1.1.14",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
@@ -1127,9 +1127,9 @@
       }
     },
     "node_modules/@simpleworkjs/conf": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.1.0.tgz",
-      "integrity": "sha512-MKRQQ4JAH2tbEm87NdkmfikTT58Tyk/SFbvCC7zKja0bK6j8zYyBXTQUJ0rnvFOVEalDWd/au4AEiptOCEqgvA==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
+      "integrity": "sha512-X4u1oRb0A0x7wzmyiIH5hPYYIFJYUXhYVe9CPX6G6INouRIeZuHlx0pthHlihiAAIc3+KqZBx18qirFN8RoJwA==",
       "license": "MIT",
       "dependencies": {
         "extend": "^3.0.2"
@@ -4357,9 +4357,9 @@
       }
     },
     "node_modules/jq-repeat": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/jq-repeat/-/jq-repeat-2.1.0.tgz",
-      "integrity": "sha512-e1OmSWeBEHEtyOhNVysx0bnT5wd6HlZ37JZgPcGPmACJ0K9bXDPq0xOwrM1slQMSTw7FOSNDX+MD6VwvPeeZyQ==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/jq-repeat/-/jq-repeat-2.2.0.tgz",
+      "integrity": "sha512-OdKAQJ8SOTZzoNL/76o5+WJehXnMCoP8aXbDtZCmDh3vuGGdXfN14FkPTqLpZC5xmlv+QVfTXu/UaIRsDjVuhA==",
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.12",
+  "version": "1.1.14",
   "private": true,
   "author": [
     {
@@ -23,7 +23,7 @@
   "dependencies": {
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
-    "@simpleworkjs/conf": "^1.1.0",
+    "@simpleworkjs/conf": "^1.2.0",
     "bcrypt": "^6.0.0",
     "bootstrap": "^5.3.8",
     "compression": "^1.8.1",
@@ -31,7 +31,7 @@
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.2",
     "extend": "^3.0.2",
-    "jq-repeat": "^2.1.0",
+    "jq-repeat": "^2.2.0",
     "jquery": "^3.7.1",
     "jsonwebtoken": "^9.0.3",
     "ldapts": "^8.1.2",

nodejs/routes/docs.js

@@ -60,10 +60,22 @@ function fixImagePaths(html) {
 // at /docs/<slug> with no .html suffix. Rewrite known doc links to the
 // in-app route, same idea as fixImagePaths() above. Only touches slugs that
 // actually exist, so an unrelated "foo.html" link is left alone.
+// Docs are also linked by their real filename stem (e.g. "concepts-accounts.html"
+// for docs/concepts-accounts.md) -- the correct, working link on the Jekyll/
+// GitHub Pages build, where the URL IS the filename stem. That doesn't match
+// this viewer's own short slugs (DOCS keys, e.g. "accounts"), so also resolve
+// by filename as a fallback -- one link written in a doc works correctly on
+// both targets, rather than needing two different link forms.
+const slugByFilename = Object.fromEntries(
+	Object.entries(DOCS).map(([slug, d]) => [path.basename(d.file, '.md'), slug])
+);
 function fixDocLinks(html) {
 	return html
 		.replace(/href="index\.html"/g, 'href="/docs"')
-		.replace(/href="([a-z0-9-]+)\.html"/g, (match, slug) => DOCS[slug] ? `href="/docs/${slug}"` : match);
+		.replace(/href="([a-z0-9-]+)\.html"/g, (match, name) => {
+			const slug = DOCS[name] ? name : slugByFilename[name];
+			return slug ? `href="/docs/${slug}"` : match;
+		});
 }
 
 // docs/*.md files (not the repo-root README/CHANGELOG/API.md) carry Jekyll