Sites Changelog

1.0.0

• Add: Content APIs served from the site's own domain — a request to /public/cms/v1/... on the site origin is proxied to the Experience Manager carrying the Site's Access Token, so an application bundle reads content same-origin with no CORS and no upstream host visible to the browser (UC-605)
• Add: Asset endpoints serve the file itself at a stable site-origin path — the presigned storage URL is resolved internally and refreshed once if the signature has expired, so a page cached for a day never holds a dead media link (UC-605)
• Add: Image service requests carry the same token, so resized images are served from the site's own domain alongside the content that references them (UC-605)
• Add: A Collection a Site has not been given is refused at the edge without an upstream request; the Experience Manager stays authoritative and refuses a detached Collection however stale the site's manifest (UC-605)
• Add: Proxied content sits behind site access control — on a protected site an API request is challenged like any other, so content cannot be read by skipping the password (UC-605)
• Add: Site access control — a site may require a password, a rotating access code, or accept either, with a login screen that returns the visitor to the page they originally asked for (UC-581)
• Add: Rotating access codes — an 8-digit code that changes every 60 seconds, and a QR link that signs a visitor in on scan; both are accepted one step either side of the current one to tolerate clock drift (UC-581)
• Add: Sessions last 24 hours for a password and 1 hour for a rotating code, which implies someone physically present — rotating the session secret in the Experience Manager signs out every visitor at once (UC-581)
• Add: Failed sign-in attempts are throttled per IP address, with a limit chosen for a venue where every visitor shares one public address (UC-581)
• Add: Unauthenticated requests for a protected site's static assets are refused, so a bundle cannot be read around the login screen (UC-581)
• Add: Static site hosting — versioned bundles served from R2, routed by a per-hostname manifest in KV, with ETag revalidation, correct content types, and a fallback to index.html for client-side routing (UC-589)
• Add: Sites are served on *.atlasss.site (UC-589)
• Fix: A protected site's cached responses advertised themselves as publicly cacheable — a cache hit returned the long-lived directive used for edge storage instead of the private one, so a shared proxy could have held an authenticated visitor's asset (UC-581)
• Fix: index.html served from the edge cache told browsers to hold it for 60 seconds rather than revalidate, so a released update could go unseen until that expired (UC-581)
• Fix: index.html is held in the edge cache while browsers still revalidate on every request — the directive keeping browsers current had also been stopping the edge from caching it at all (HOTFIX)