[imanimanyara]

Summary

Two changes, one per commit.

The browser page at a configurable path (ICHAVA_BROWSER_PATH)

ichava.com wants the browser at https://ichava.com/app. This makes that a host setting rather than a fork:

• browser.path (ICHAVA_BROWSER_PATH, read through Helpers::browserPath()) moves the browser page and its icon pages (/{path}/{id}), under the same route names ichava.inertia.browser and ichava.inertia.icons.show. Unset, nothing changes: /{prefix}/icons as before, and no redirect route is registered.
• The API and everything else stay under the prefix: /{prefix}/api/v1/..., /{prefix}/settings, /{prefix}/stats, and so on.
• Old URLs keep working. When moved, /{prefix}/icons and /{prefix}/icons/{id} answer 301 to the new URLs with the query string kept (MovedBrowserRedirectController). Route::redirect() was not used because it drops the query, and the browser's deep links live there (?icon=12&q=home). /{prefix} redirects to the new path.
• ValidateIchavaRoute accepts the moved path as well as the prefix.
• Links in the app follow it. The pages share ichava.browserPath; the four Inertia pages that link icon pages build them through iconPageBase() instead of /${prefix}/icons, with a guard test that fails any page building them from the prefix. react-icon-browser itself reads window.location, so its in-app history and permalinks follow without change.
• Canonical URL. The browser page and its icon pages carry <link rel="canonical"> to their own URL without the filter query.
• Bad values are ignored: empty, not a plain path (letters, digits, ., _, -, / between segments, no ./..), the bare prefix (would loop with the home redirect), or under {prefix}/api.
• CSP and prerender: the moved page is the same page with the same assets and nonce handling, so a host CSP needs no change. Anything that caches or prerenders by URL needs the new path; ichava.com's prerender covers the landing only.

Re-vendored react-icon-browser at 41b0a4b (react-icon-browser#214)

npm run sync:react-icon-browser from a fresh build:lib, then a fresh npm install --no-package-lock and npm run build:prod, as committed-build.yml does. zustand is held at >=5.0.15 <5.1.0, matching the vendored library: 5.1.0 came out today and changes the useStore type react-icon-browser publishes, so a fresh build taking it would not match the committed bundle. Brings the shared popover caret (drawn in the panel's colours over its edge, centred on the trigger, now on the menus too) and the movable "Cookies & storage" notice.

41b0a4b is react-icon-browser#214's head. If that PR is squash-merged rather than merged, the vendored commit is not on its main and check:consumers will refuse the next release there; re-vendor from the merge then.

Tests

• tests/Feature/BrowserPathTest.php: default unchanged, no redirect routes, canonical link, 11 bad values ignored, a nested path accepted.
• New MovedBrowser suite (MovedBrowserTestCase, browser.path = /app/): route names, page and canonical at /app, 301s with the query kept, icon pages, /ichava redirect, API and other pages still under the prefix, the shared prop, and unrelated paths still 404.
• resources/js/core/browserPath.test.ts.
• Locally: vendor/bin/pest 438 passed, the new tests included, pint, phpstan (single-process; parallel cannot bind a socket in the sandbox), npm run test:js 119 passed, typecheck:inertia, eslint.
• Not run: e2e/a11y.spec.ts, which needs a running seeded host (ICHAVA_E2E_URL).

Consumers

ichava.com needs a tag containing this before it can set ICHAVA_BROWSER_PATH=app (its PR depends on ^0.1.1).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.