# Deploy CA Lab Studio

Deploy this CA Lab Studio app into `/opt/glitch_automata_lab` on the server.

This app is the CA Lab Studio service:

- Express API at `/api/ca/*`
- React admin app at `/admin`
- React viewer/recorder routes at `/view/*`
- Postgres database via `DATABASE_URL`
- Cross-subdomain lab access via the shared gnommoweb `auth_token` JWT cookie

## Lab Access

In production, the lab expects gnommoweb to be the identity issuer:

```env
JWT_SECRET=...                         # same value as gnommoweb
LAB_AUTH_ENABLED=true
LAB_KEYCARD_REQUIRED=true
GNOMMOWEB_URL=https://glitch.university
LAB_KEYCARD_MERIT_SLUG=lab-keycard
LAB_USER_PROFILE_URL=https://glitch.university/api/user/profile
LAB_SIGN_IN_URL=https://glitch.university/auth/google?returnTo={returnTo}
```

The gnommoweb side should set `auth_token` with `Domain=.glitch.university`
and expose `LAB_USER_PROFILE_URL`. Access is granted immediately if the verified
JWT contains:

```json
{ "merit_slug": "lab-keycard" }
```

If the JWT does not contain that claim, the lab calls the user profile endpoint
with the same `auth_token` cookie and expects the profile to include:

```json
{
  "merits": [
    { "slug": "lab-keycard" }
  ]
}
```

Local development keeps auth disabled unless `LAB_AUTH_ENABLED=true` is set.

## Build

```bash
nvm use 20
npm --prefix backend ci
npm run build
```

The build creates:

```txt
backend/dist/server.js
backend/public/admin/index.html
backend/public/admin/assets/*
```

## Start

```bash
DATABASE_URL=postgres://... PORT=3100 npm start
```

Run migrations before starting or during release:

```bash
DATABASE_URL=postgres://... npm run migrate
```

## Docker

```bash
docker build -t ca-lab-studio .
docker run --rm -p 3100:3100 \
  -e DATABASE_URL=postgres://... \
  ca-lab-studio
```

The container serves the app at:

```txt
http://localhost:3100/admin
http://localhost:3100/view/decks/:deckId
```