From d31b22b39450f49e377fc4600bb70e543a6e480b Mon Sep 17 00:00:00 2001
From: Jason <jason@christit.com>
Date: Wed, 15 Jul 2026 16:07:42 -0500
Subject: [PATCH] Harden hosted deploy source checks

---
 CHANGELOG.md           |  5 +++++
 ROADMAP.md             |  8 +++++---
 package-lock.json      |  4 ++--
 package.json           |  2 +-
 scripts/deploy-web.ps1 | 21 ++++++++++++++++++++-
 5 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16843cf..5ffca1f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.31 - 2026-07-15
+
+- Started Phase 3 deploy-from-Gitea hardening by making the hosted deploy script refuse dirty or unpushed Libre Study and LibreBible data repos.
+- Added the LibreBible data commit and `origin/main` source marker to hosted deploy metadata.
+
 ## 0.1.30 - 2026-07-15
 
 - Started Phase 2 hosted accounts with a server-side user table, password hashing, login sessions, and authenticated per-user workspace persistence.
diff --git a/ROADMAP.md b/ROADMAP.md
index 8a9b5f3..3bd9b20 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -98,12 +98,14 @@ Definition of done:
 
 Goal: make local changes flow predictably to the live app through Git.
 
+Current foundation note: the hosted deploy script now verifies that both Libre Study and LibreBible data are clean and equal to `origin/main` before it builds or publishes, and records both deployed commit hashes in deploy metadata.
+
 Tasks:
 
 - Keep Christ Unscripted Gitea as the remote source of truth for deployable code.
-- Add a deployment script that pulls or receives the pushed commit, installs/builds as needed, and publishes the web build.
-- Record the deployed commit hash somewhere visible or inspectable.
-- Decide whether deploys are manual first, then later automatic after push.
+- Add a deployment script that pulls or receives the pushed commit, installs/builds as needed, and publishes the web build. Started with a manual script that only deploys clean `origin/main` state.
+- Record the deployed commit hash somewhere visible or inspectable. Started with `deploy-info.json`, including both app and LibreBible data commits.
+- Decide whether deploys are manual first, then later automatic after push. Manual deploy remains the current private-alpha default.
 - Keep LibreBible package generation/deployment separate from Libre Study app deployment, but make the app consume the deployed package catalog.
 
 Definition of done:
diff --git a/package-lock.json b/package-lock.json
index 6035db3..a9933c9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "libre-study",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "libre-study",
-      "version": "0.1.30",
+      "version": "0.1.31",
       "dependencies": {
         "@tauri-apps/api": "^2.11.1",
         "jszip": "^3.10.1",
diff --git a/package.json b/package.json
index de2e3aa..57cce3e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "libre-study",
   "private": true,
-  "version": "0.1.30",
+  "version": "0.1.31",
   "type": "module",
   "scripts": {
     "dev": "vite --host 0.0.0.0",
diff --git a/scripts/deploy-web.ps1 b/scripts/deploy-web.ps1
index 340a654..f033bf7 100644
--- a/scripts/deploy-web.ps1
+++ b/scripts/deploy-web.ps1
@@ -18,11 +18,28 @@ function ConvertTo-BashSingleQuoted([string]$Value) {
   return "'" + $Value.Replace("'", "'\''") + "'"
 }
 
+function Assert-CleanPushedRepo([string]$Path, [string]$Name) {
+  git -C $Path fetch origin main
+  if ($LASTEXITCODE -ne 0) { throw "$Name fetch failed." }
+
+  $status = git -C $Path status --porcelain
+  if ($status) { throw "$Name has uncommitted changes. Commit or revert them before deploying." }
+
+  $head = (git -C $Path rev-parse HEAD).Trim()
+  $origin = (git -C $Path rev-parse origin/main).Trim()
+  if ($head -ne $origin) {
+    throw "$Name HEAD $head does not match origin/main $origin. Push the repo before deploying."
+  }
+
+  return $head
+}
+
 $repoRoot = Split-Path -Parent $PSScriptRoot
 $dataRepo = Resolve-Path (Join-Path $repoRoot "..\libre-bible-data")
+$commit = Assert-CleanPushedRepo $repoRoot "Libre Study"
+$dataCommit = Assert-CleanPushedRepo $dataRepo "LibreBible data"
 $repoRootWsl = ConvertTo-WslPath $repoRoot
 $dataRepoWsl = ConvertTo-WslPath $dataRepo
-$commit = (git -C $repoRoot rev-parse HEAD).Trim()
 $deployedAt = (Get-Date).ToUniversalTime().ToString("o")
 
 Push-Location $repoRoot
@@ -41,8 +58,10 @@ finally {
 
 $deployInfo = @{
   commit = $commit
+  libreBibleDataCommit = $dataCommit
   deployedAt = $deployedAt
   source = "libre-study"
+  sourceRemote = "origin/main"
 } | ConvertTo-Json -Compress
 $deployInfoPath = Join-Path $env:TEMP "libre-study-deploy-info.json"
 Set-Content -Path $deployInfoPath -Value $deployInfo -NoNewline