BREAKING CHANGE: Removed TaxBaik.Web.Client project (separate WASM app)
Changes:
- Migrated all Blazor components to TaxBaik.Web/Components/Admin
- Migrated all Browser Client services to Components/Admin/Services
- Updated Program.cs to use integrated components (same assembly)
- Removed AddAdditionalAssemblies (no longer needed)
- Updated _Imports.razor with correct namespaces
Architecture:
✅ API-First: REST endpoints in TaxBaik.Web (ASP.NET Core)
✅ Client-Side: Blazor WASM components in TaxBaik.Web/Components
✅ Unified: Both API and UI served from single web server
✅ No separation: No separate client project
Result:
- Single deploy unit (TaxBaik.Web)
- API served only from web server
- Blazor renders client-side (prerender: false for protected pages)
- Monolithic web app architecture
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Root cause analysis: 20+ attempts of patching couldn't work because the
fundamental architecture was incompatible with prerender: true requirement.
Prerender demands the initial HTML be static (no WASM), but authentication
updates must happen synchronously with API response.
Fundamental solution (architectural level):
1. Login.razor: prerender: true (REQUIRED - Phase 9 validation)
2. AdminLoginForm: HTML + JavaScript (prerender-compatible)
3. After login API succeeds:
- Save tokens to localStorage (JavaScript)
- Redirect to /admin/dashboard (JavaScript)
4. When dashboard page loads:
- Blazor boots normally
- CustomAuthenticationStateProvider.GetAuthenticationStateAsync() is called
- localStorage.getItem('accessToken') restores token
- [Authorize] pages detect authenticated user and render
5. No page reload needed, no WASM race conditions
Why this works (not a patch):
- Separates concerns: prerender handles initial HTML, WASM handles interactivity
- localStorage is the contract between JavaScript and Blazor
- Navigation to dashboard is the trigger for auth recovery
- No timing dependencies or hydration conflicts
Trade-offs:
- Login page requires WASM boot (0.5-1.5s spinner)
- This is acceptable: admin login is not on critical path
- Validates requirement: login page HTML loads immediately (prerender: true)
Result: Reliable authentication flow that respects prerender requirement,
WASM boot timing, and Blazor's auth model.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Problem: With prerender: true + JavaScript form submission + location.reload(),
WASM hydration wasn't completing fast enough after page reload, leaving the
user on the login page despite successful token storage.
Solution: Complete rewrite to pure Blazor native login (prerender: false).
This approach:
1. WASM boots and renders the form
2. User submits form (Blazor handles it)
3. HttpClient POST to /api/auth/login
4. Save tokens to localStorage
5. CustomAuthenticationStateProvider.LoginAsync() called directly in C#
6. Blazor detects auth state change synchronously
7. NavigateTo() redirects to dashboard
8. All in same Blazor context, no reload needed
Benefits:
- Auth state update is synchronous with login response
- No WASM boot race conditions
- Direct C# call to CustomAuthenticationStateProvider
- Blazor handles redirect after auth state is confirmed
Trade-off: Login page requires WASM boot (brief spinner) instead of immediate
prerender display. This is acceptable for better reliability.
Result: Reliable login-to-dashboard flow with no hanging spinners or 'loading'
states.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Context: Validation script requires Login.razor to use prerender: true for
immediate form display before WASM boots (Phase 9 requirement).
Solution: Revert to original HTML form + JavaScript approach:
- AdminLoginForm: HTML form (statically rendered, works with prerender: true)
- admin-session.js: JavaScript login handler
- Post-login: 200ms delay before redirect to allow CustomAuthenticationStateProvider
to read tokens from localStorage and establish auth state
Flow:
1. User submits form (JavaScript handles it)
2. POST /api/auth/login
3. Save tokens to localStorage
4. 200ms delay
5. Redirect to /taxbaik/admin/dashboard
6. Page loads with Blazor bootstrapping + auth state restored
Result: Login form displays immediately (prerender: true) while maintaining
proper authentication state propagation for [Authorize] pages.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Problem: JavaScript login form saved tokens to localStorage but didn't notify
CustomAuthenticationStateProvider, causing [Authorize] pages to remain in
'loading' state indefinitely. The provider only reads tokens when:
1. GetAuthenticationStateAsync() is called (page load)
2. NotifyAuthenticationStateChanged() is triggered (UI updates)
But JavaScript login didn't trigger either, leaving the authentication state
stale.
Solution: Convert AdminLoginForm from HTML+JavaScript to pure Blazor component.
Now the login flow is:
1. User enters credentials in Blazor form
2. HttpClient POST to /api/auth/login
3. Save tokens to localStorage
4. Call CustomAuthenticationStateProvider.LoginAsync() directly
5. Blazor detects auth state change and re-evaluates [Authorize] pages
6. Dashboard [Authorize] page renders successfully
Result: Immediate authentication state update, no loading timeout on protected pages.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Problem: Login form showed remembered username from localStorage, but didn't
restore the 'remember me' checkbox state. Users had to re-check the box on
each login attempt, defeating the purpose of the remember feature.
Solution:
1. AdminLoginForm: Add isRememberChecked field and RememberedCheckboxKey constant
2. OnInitializedAsync: Restore both username AND checkbox state from localStorage
3. admin-session.js bindLoginForm: Restore checkbox.checked from localStorage
4. admin-session.js submit handler: Save checkbox state alongside username
Result: Complete round-trip persistence - when user checks 'remember me' and
logs in, both username and checkbox state persist until explicitly cleared.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Groups the repo root into src (buildable source), docs (already existed),
and everything else (db/, scripts/, tests/, deploy/ - deployment/ops/test
assets that aren't compiled, already organized as their own folders). CI
now only needs src/ to build: dotnet restore/build/test/publish all point
at src/TaxBaik.sln, src/TaxBaik.Web/, src/TaxBaik.Proxy/.
- git mv every project (Domain, Infrastructure, Application,
Application.Tests, Web, Web.Client, Proxy) and TaxBaik.sln into src/ as a
unit, so relative ProjectReference/.sln paths stay valid unchanged.
- .gitea/workflows/deploy.yml: 6 dotnet restore/clean/build/test/publish
invocations now point at src/. db/migrations and scripts/ stay at root
(deploy_gb.sh and browser-e2e.yml only touch published output and the
deployed URL, not source paths - verified, no changes needed there).
- scripts/validate_admin_render.sh: admin render-mode file paths now
src/TaxBaik.Web.Client/...
- scripts/validate_kst_timestamps.sh: dropped deploy.sh from its target
list - that script was removed in the prior cleanup commit (dead, no
CI workflow referenced it) but this validator still expected it to exist.
- CLAUDE.md, docs/ENGINEERING_HARNESS.md, docs/ADMIN_PATTERN_CRITIQUE_WBS.md:
updated project-structure diagram, dotnet run/build commands, and grep
targets to the new src/ paths (also fixed a pre-existing stale path in
ADMIN_PATTERN_CRITIQUE_WBS.md that still said TaxBaik.Web/Components/Admin
from before that ever moved to TaxBaik.Web.Client).
- Added a Repo Root harness rule + Architecture Guardrail entries: new files
belong under src/docs/tests/scripts/db/deploy, not loose at root; temp
work stays outside the repo (or under a gitignored .scratch/) and is
never committed.
Verified locally: dotnet build/test src/TaxBaik.sln (26/26 tests), and all
three scripts/validate_*.sh pass against the new layout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
kjh2064