Three of the four Ablauf steps had no duration and therefore rendered a
red "[Dauer?]" placeholder. Requested: drop those, keep the "2–3 Tage"
on step 03.
The span is now only rendered when step.dauer is filled, instead of
falling back to a placeholder. Each .ablauf-step is its own grid, so the
auto-width third column simply collapses and the text takes the space -
no layout shift. The editor label no longer claims that an empty field
produces a placeholder.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dropped on request. The two bios were never written, so the section
rendered two red placeholder paragraphs asking for three to four
sentences each.
Removed in all four places so nothing dangles: the .about-bios markup
block and its CSS rule in index.astro, the laraBio/pascalBio keys in
content/site.json, and the two fields in the admin editor's schema -
otherwise the editor would still offer inputs that no longer render.
The about section keeps its eyebrow, title, quote and three paragraphs,
the last of which already explains that the name is built from Lara and
Pascal plus "paso".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
.build-log set display:flex unconditionally, which as an author rule
beat the browser's default [hidden]{display:none} (author styles always
win over user-agent styles regardless of the hidden attribute). Add an
explicit .build-log[hidden]{display:none} rule so closing the panel -
and its initial hidden state on page load - actually works.
Rich-text fields (hero lead, paragraphs, FAQ-style copy, datenschutz
sections, etc.) now use a proper toolbar editor - bold/italic/underline
buttons plus a per-selection font picker drawn from the same curated
font list as the Design tab - instead of typed **markdown** syntax.
Content is stored as a small allowlisted HTML subset (strong/em/u/span
with a validated data-font/br) and sanitized server-side with
sanitize-html on every save (admin/lib/rich-sanitize.js), independent
of what the client sends - verified this rejects script tags, event
handlers, and made-up font names while preserving legitimate markup,
and that re-saving already-sanitized content is a no-op.
The Astro site mirrors the same allowlist at render time for
defense-in-depth (src/lib/rich-sanitize.ts) and only requests Google
Fonts for fonts actually referenced somewhere in content, in addition
to the two Design-tab fonts - verified a font used via a data-font span
gets its own Google Fonts request and [data-font] CSS rule in the
built page, and that unused fonts don't get requested.
Migrated the three existing fields that used the old markdown-lite
syntax (**bold**/*italic*) to real HTML so they keep rendering
correctly under the new system.
Also replaces the single long scrolling admin page with a tabbed
sidebar (grouped "Inhalte"/"Design") to cut down on clutter, per
feedback that the all-in-one-page layout was hard to navigate.
ADMIN_USERNAME/ADMIN_PASSWORD_HASH now optionally extends to _2, _3, ...
for additional accounts (e.g. a second login for Lara), all with equal
access - no roles, still no self-service password reset. Falls back to
a dummy bcrypt compare on unknown usernames to keep login timing
consistent. Verified locally: both users log in, wrong password and
unknown usernames are rejected, and single-user setups still work
unchanged (backward compatible).
Also documents the optional second-user setup in DEPLOYMENT_ADMIN.md (B6/B7).
Adds a self-service editor at admin.larpaso.de so texts, images, links,
Impressum/Datenschutz, fonts, font sizes and colors can be changed without
a developer. All homepage/legal content moves into content/site.json and
a new content/theme.json drives every CSS color/font/size token; the
Astro pages read from these at build time.
The admin/ service (Node/Express) provides bcrypt+session login with
rate limiting, a schema-driven form UI (including a hex/RGB/alpha color
picker), image upload, and a publish action that runs the Astro build
and republishes into a volume shared with the nginx website container -
so edits go live without redeploying that container.
See DEPLOYMENT_ADMIN.md for the server-side setup steps.
