Refactor configuration handling: implement dynamic loading of config and cache paths for improved security and flexibility in Docker environments

scripts/build-dist.js

@@ -6,9 +6,14 @@
  *
  * This is an allowlist by design: only the files and folders listed below
  * are copied. Dev-only stuff (node_modules/, src/, package*.json, .git/,
- * .claude/, docker-compose.yaml, dev.sh, .hintrc, config.example.php, the
- * live db/fitz.sqlite, ...) never ends up in dist/ — including anything
- * added later, since it has to be added here explicitly first.
+ * .claude/, docker-compose.yaml, dev.sh, .hintrc, config.php,
+ * config.example.php, the live db/fitz.sqlite, ...) never ends up in
+ * dist/ — including anything added later, since it has to be added here
+ * explicitly first.
+ *
+ * config.php is deliberately excluded: it holds live secrets and lives
+ * outside the web root on the server (see FITZ_CONFIG_PATH in
+ * docker-compose.yaml), so a deploy can never overwrite it.
  *
  * Run with: npm run dist
  */
@@ -25,7 +30,6 @@ const FILES = [
   'main.js',
   'styles.css',
   'robots.txt',
-  'config.php', // holds the live FB_PAGE_ACCESS_TOKEN — see README before sharing dist/ anywhere but the server
 ];
 
 const DIRS = ['admin', 'assets', 'bin', 'inc'];

scripts/dev-router.php

@@ -24,4 +24,14 @@ if (preg_match($blocked, $path)) {
 	return true;
 }
 
+// Apache (mod_dir) redirects /admin to /admin/; the built-in server just
+// serves admin/index.php at /admin. Every relative link on that page then
+// resolves against / instead of /admin/ — "menu.php" lands on the public
+// menu, "users.php" 404s. Match Apache so dev behaves like production.
+if ($path !== '/' && !str_ends_with($path, '/') && is_dir(__DIR__ . '/..' . $path)) {
+	$query = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_QUERY);
+	header('Location: ' . $path . '/' . ($query ? '?' . $query : ''), true, 301);
+	return true;
+}
+
 return false;