Visual X# website

This repository contains the public web surface for the Visual X# programming language at xsharp-lang.xyz.

Workspaces

• frontend/ is the Astro website. It is emitted as static HTML and assets.
• backend/ is the ASP.NET Core Identity and package-registry API. It owns password and Google authentication, verification/recovery mail, secure session cookies, PostgreSQL persistence, and digest-only CLI tokens.
• java.xsharp-lang.xyz is the read-only Java artifact catalog. Its package descriptions are rendered from trusted Markdown at build time and Maven-compatible files are served separately from the static catalog.

The Java 25 surface reserves org.progmasoft.visual_xsharp.xmm.writer, org.progmasoft.visual_xsharp.xmm.reader, and org.progmasoft.java_utilities.ffi.c as its canonical public packages.

The registry account dashboard is available at viget.xsharp-lang.xyz/dashboard. Package publication remains closed while the compiler package contract is completed. Registry tokens follow the Cargo model: the plaintext is returned once, only a SHA-256 digest is retained, and a user can revoke each token independently. Account deletion permanently removes the Identity account, external logins, verification records, and registry tokens.

The PostgreSQL provider is selected solely by ConnectionStrings__Registry; production can use a Supabase PostgreSQL connection without exposing database or service credentials to the browser. Google OAuth client credentials, the database connection, auth-code pepper, and data-protection certificate stay in host-managed secrets.

The Google OAuth web client callback is https://viget.xsharp-lang.xyz/api/v1/auth/google/callback. Configure it through Authentication__Google__ClientId and Authentication__Google__ClientSecret. Until both values exist, the frontend keeps the Google button visible but disabled and email/password authentication remains available. Every completed Google authorization still requires the short-lived Visual X# email code before a registry session is issued.

Requirements

• Node.js 22.12 or newer
• npm 9.6.5 or newer
• .NET SDK 10 with the ASP.NET Core targeting pack
• PostgreSQL 16 or newer
• Postfix and OpenDKIM for production transactional mail

Production runs the API as the non-login xsharp_web operating-system account. PostgreSQL uses a matching local role over its Unix socket with peer authentication, so the web process does not need a database password and PostgreSQL is never exposed through the firewall.

Development

cd frontend
npm install
npm run dev

In another terminal:

cd backend
dotnet run

Run the release checks with:

npm --prefix frontend ci
npm --prefix frontend run check
npm --prefix frontend run build
dotnet restore backend/XSharp.Web.Api.csproj
dotnet build backend/XSharp.Web.Api.csproj --no-restore

Restore the pinned Entity Framework tool and create a migration with:

dotnet tool restore
dotnet tool run dotnet-ef migrations add <Name> --project backend/XSharp.Web.Api.csproj --output-dir Data/Migrations

Email verification and recovery use an eight-character, short-lived, single-use code. Messages are sent by the automated noreply@xsharp-lang.xyz identity; it is not a mailbox. See ops/mail/README.md for the transport boundary.

Release policy

The website is a rolling deployment with fixed package and Git tag version 1.0.0. The repository does not publish GitHub Releases; deployment history is represented by ordinary commits while the 1.0.0 tag follows the deployed baseline.

License

The Visual X# website is licensed under the GNU Affero General Public License, version 3 or any later version. A deployed modified version must offer its corresponding source to users who interact with it over a network. The canonical source link is github.com/Progmasoft/website.