From ccc41a20185e72f939dc72adb53c045abacfacf2 Mon Sep 17 00:00:00 2001
From: Arnaud <anelissen@solem.fr>
Date: Sun, 12 Jul 2026 12:33:53 +0200
Subject: [PATCH] fix: MinIO CORS blocking browser uploads, changelog
 admin-only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- MinIO had no CORS config at all, so the browser's direct PUT to a
  presigned URL (cross-origin: app on :3001/:3000, storage on :9000)
  was blocked outright. Added MINIO_API_CORS_ALLOW_ORIGIN — "*" in
  dev, the app's own origin in prod. Verified end-to-end: photo
  upload now succeeds with zero console errors.
- Removed the public /changelog page and its account-menu link —
  changelog is admin-only now (/admin/changelog).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 apps/web/app/(app)/changelog/page.tsx | 19 -------------------
 apps/web/components/layout/nav.tsx    |  8 +-------
 apps/web/messages/en.json             |  1 -
 apps/web/messages/fr.json             |  1 -
 compose.prod.yml                      |  4 ++++
 compose.yml                           |  4 ++++
 6 files changed, 9 insertions(+), 28 deletions(-)
 delete mode 100644 apps/web/app/(app)/changelog/page.tsx

diff --git a/apps/web/app/(app)/changelog/page.tsx b/apps/web/app/(app)/changelog/page.tsx
deleted file mode 100644
index 87f76e2..0000000
--- a/apps/web/app/(app)/changelog/page.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import type { Metadata } from "next";
-import { ChangelogList } from "@/components/shared/changelog-list";
-import { APP_VERSION } from "@/lib/changelog";
-
-export const metadata: Metadata = {};
-
-export default function ChangelogPage() {
-  return (
-    <div className="space-y-2">
-      <div>
-        <h1 className="text-3xl font-bold tracking-tight">Changelog</h1>
-        <p className="text-muted-foreground mt-1">Currently running v{APP_VERSION}.</p>
-      </div>
-      <div className="pt-4">
-        <ChangelogList />
-      </div>
-    </div>
-  );
-}
diff --git a/apps/web/components/layout/nav.tsx b/apps/web/components/layout/nav.tsx
index a5b813a..f085419 100644
--- a/apps/web/components/layout/nav.tsx
+++ b/apps/web/components/layout/nav.tsx
@@ -3,7 +3,7 @@
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { useTheme } from "next-themes";
-import { BookOpen, Calendar, Package, ChefHat, User, Rss, FolderOpen, ShoppingCart, Shield, Search, Compass, Menu, Sun, Moon, Monitor, Apple, History } from "lucide-react";
+import { BookOpen, Calendar, Package, ChefHat, User, Rss, FolderOpen, ShoppingCart, Shield, Search, Compass, Menu, Sun, Moon, Monitor, Apple } from "lucide-react";
 import { cn } from "@/lib/utils";
 import { Button, buttonVariants } from "@/components/ui/button";
 import {
@@ -131,12 +131,6 @@ export function Nav() {
               <DropdownMenuItem>
                 <Link href="/settings" className="w-full">{t("settings")}</Link>
               </DropdownMenuItem>
-              <DropdownMenuItem>
-                <Link href="/changelog" className="w-full flex items-center gap-2">
-                  <History className="h-3.5 w-3.5 text-muted-foreground" />
-                  {t("changelog")}
-                </Link>
-              </DropdownMenuItem>
               <div
                 role="group"
                 aria-label={t("systemMode")}
diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json
index fe4dd67..b76aed3 100644
--- a/apps/web/messages/en.json
+++ b/apps/web/messages/en.json
@@ -11,7 +11,6 @@
     "pantry": "Pantry",
     "shopping": "Shopping",
     "settings": "Settings",
-    "changelog": "Changelog",
     "admin": "Admin",
     "signOut": "Sign out",
     "apiKeys": "API keys",
diff --git a/apps/web/messages/fr.json b/apps/web/messages/fr.json
index 3f68aab..73e0b0d 100644
--- a/apps/web/messages/fr.json
+++ b/apps/web/messages/fr.json
@@ -11,7 +11,6 @@
     "pantry": "Garde-manger",
     "shopping": "Courses",
     "settings": "Paramètres",
-    "changelog": "Journal des modifications",
     "admin": "Admin",
     "signOut": "Se déconnecter",
     "apiKeys": "Clés API",
diff --git a/compose.prod.yml b/compose.prod.yml
index 55866cd..17753de 100644
--- a/compose.prod.yml
+++ b/compose.prod.yml
@@ -27,6 +27,10 @@ services:
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      # The browser PUTs photo uploads directly to MinIO using a presigned URL
+      # (STORAGE_PUBLIC_URL) — without CORS allowed for that origin, the browser
+      # blocks the request. Restricted to the app's own origin, not "*".
+      MINIO_API_CORS_ALLOW_ORIGIN: ${BETTER_AUTH_URL}
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"
diff --git a/compose.yml b/compose.yml
index 681d51e..53fd2fc 100644
--- a/compose.yml
+++ b/compose.yml
@@ -40,6 +40,10 @@ services:
     environment:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: minioadmin
+      # The browser PUTs photo uploads directly to MinIO using a presigned URL,
+      # which is cross-origin from the Next.js app (different port) — without
+      # this, the browser blocks the request with a CORS error.
+      MINIO_API_CORS_ALLOW_ORIGIN: "*"
     ports:
       - "9000:9000"
       - "9001:9001"