fix(ci): align PAYLOAD_SECRET for post-deploy cleanup and enhance diagnostics

.gitea/workflows/deploy.yml

@@ -532,7 +532,7 @@ jobs:
         env:
           NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
           GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET }}
+          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET || 'you-need-to-set-a-payload-secret' }}
           PUPPETEER_EXECUTABLE_PATH: /usr/bin/chromium
         run: pnpm run check:forms
 

components/AgbHistoryBlock.tsx

@@ -1,7 +1,7 @@
 import React from 'react';
 import { getPayload } from 'payload';
 import configPromise from '@payload-config';
-import { Container, Card, Heading } from '@/components/ui';
+import { Heading } from '@/components/ui';
 
 export const AgbHistoryBlock: React.FC<{ title: string }> = async ({ title }) => {
   const payload = await getPayload({ config: configPromise });

components/PayloadRichText.tsx

@@ -796,8 +796,8 @@ const jsxConverters: JSXConverters = {
         </Section>
       );
     },
-    imageGallery: ({ node }: any) => <Gallery />,
+    imageGallery: ({ node: _node }: any) => <Gallery />,
-    'block-imageGallery': ({ node }: any) => <Gallery />,
+    'block-imageGallery': ({ node: _node }: any) => <Gallery />,
     categoryGrid: ({ node }: any) => {
       const cats = node.fields.categories || [];
       return (

package.json

@@ -139,7 +139,7 @@
     "prepare": "husky",
     "preinstall": "npx only-allow pnpm"
   },
-  "version": "2.3.22-rc.2",
+  "version": "2.3.22-rc.3",
   "pnpm": {
     "onlyBuiltDependencies": [
       "@parcel/watcher",

payload-types.ts

@@ -73,6 +73,7 @@ export interface Config {
     'form-submissions': FormSubmission;
     products: Product;
     pages: Page;
+    'agbs-collection': AgbsCollection;
     'payload-kv': PayloadKv;
     'payload-locked-documents': PayloadLockedDocument;
     'payload-preferences': PayloadPreference;
@@ -86,8 +87,11 @@ export interface Config {
     'form-submissions': FormSubmissionsSelect<false> | FormSubmissionsSelect<true>;
     products: ProductsSelect<false> | ProductsSelect<true>;
     pages: PagesSelect<false> | PagesSelect<true>;
+    'agbs-collection': AgbsCollectionSelect<false> | AgbsCollectionSelect<true>;
     'payload-kv': PayloadKvSelect<false> | PayloadKvSelect<true>;
-    'payload-locked-documents': PayloadLockedDocumentsSelect<false> | PayloadLockedDocumentsSelect<true>;
+    'payload-locked-documents':
+      | PayloadLockedDocumentsSelect<false>
+      | PayloadLockedDocumentsSelect<true>;
     'payload-preferences': PayloadPreferencesSelect<false> | PayloadPreferencesSelect<true>;
     'payload-migrations': PayloadMigrationsSelect<false> | PayloadMigrationsSelect<true>;
   };
@@ -358,6 +362,19 @@ export interface Page {
   createdAt: string;
   _status?: ('draft' | 'published') | null;
 }
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "agbs-collection".
+ */
+export interface AgbsCollection {
+  id: number;
+  title: string;
+  versionDate: string;
+  file: number | Media;
+  isCurrent?: boolean | null;
+  updatedAt: string;
+  createdAt: string;
+}
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "payload-kv".
@@ -405,6 +422,10 @@ export interface PayloadLockedDocument {
     | ({
         relationTo: 'pages';
         value: number | Page;
+      } | null)
+    | ({
+        relationTo: 'agbs-collection';
+        value: number | AgbsCollection;
       } | null);
   globalSlug?: string | null;
   user: {
@@ -592,6 +613,18 @@ export interface PagesSelect<T extends boolean = true> {
   createdAt?: T;
   _status?: T;
 }
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "agbs-collection_select".
+ */
+export interface AgbsCollectionSelect<T extends boolean = true> {
+  title?: T;
+  versionDate?: T;
+  file?: T;
+  isCurrent?: T;
+  updatedAt?: T;
+  createdAt?: T;
+}
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "payload-kv_select".
@@ -980,7 +1013,6 @@ export interface Auth {
   [k: string]: unknown;
 }
 
-
 declare module 'payload' {
   export interface GeneratedTypes extends Config {}
-}
+}

scripts/check-forms.ts

@@ -115,8 +115,10 @@ async function main() {
     // Intercept Next.js chunks and data to bypass Varnish 404-caching
     // Includes standard /_next/ and subpath /gatekeeper/_next/
     if (
-      (url.includes('/_next/static/') || url.includes('/_next/data/') || url.includes('/gatekeeper/_next/')) && 
+      (url.includes('/_next/static/') ||
-      !url.includes('?cb=') && 
+        url.includes('/_next/data/') ||
+        url.includes('/gatekeeper/_next/')) &&
+      !url.includes('?cb=') &&
       !url.includes('&cb=')
     ) {
       const buster = `cb=${Date.now()}`;
@@ -154,10 +156,10 @@ async function main() {
   const navigateWithRetry = async (url: string, label: string) => {
     chunkErrorsDetected = false;
     console.log(`\n🧪 Testing ${label} on: ${url}`);
-    
+
     // First attempt: Wait for network to be relatively idle
     await page.goto(url, { waitUntil: 'networkidle2', timeout: 30000 });
-    
+
     // REDIRECTION CHECK: Logging redirected landing page
     const finalUrl = page.url();
     if (finalUrl !== url && !finalUrl.includes(url)) {
@@ -167,7 +169,9 @@ async function main() {
     if (chunkErrorsDetected) {
       const buster = `cb=${Date.now()}`;
       const cbUrl = finalUrl.includes('?') ? `${finalUrl}&${buster}` : `${finalUrl}?${buster}`;
-      console.warn(`   ⚠️ Assets failed to load (Varnish staleness suspected). Retrying with cache-buster: ${cbUrl}`);
+      console.warn(
+        `   ⚠️ Assets failed to load (Varnish staleness suspected). Retrying with cache-buster: ${cbUrl}`,
+      );
       chunkErrorsDetected = false;
       await page.goto(cbUrl, { waitUntil: 'networkidle2', timeout: 30000 });
     }
@@ -266,10 +270,10 @@ async function main() {
     console.log(`   🔔 Alert text: ${alertText}`);
 
     // Detection robust for both English and German versions
-    const isError = 
+    const isError =
-      alertText?.toLowerCase().includes('failed') || 
+      alertText?.toLowerCase().includes('failed') ||
       alertText?.toLowerCase().includes('wrong') ||
-      alertText?.toLowerCase().includes('fehlgeschlagen') || 
+      alertText?.toLowerCase().includes('fehlgeschlagen') ||
       alertText?.toLowerCase().includes('schief gelaufen') ||
       alertText?.toLowerCase().includes('fehler');
 
@@ -329,10 +333,10 @@ async function main() {
     const alertText = await page.$eval('[role="alert"]', (el) => el.textContent);
     console.log(`   🔔 Alert text: ${alertText}`);
 
-    const isError = 
+    const isError =
-      alertText?.toLowerCase().includes('failed') || 
+      alertText?.toLowerCase().includes('failed') ||
       alertText?.toLowerCase().includes('wrong') ||
-      alertText?.toLowerCase().includes('fehlgeschlagen') || 
+      alertText?.toLowerCase().includes('fehlgeschlagen') ||
       alertText?.toLowerCase().includes('schief gelaufen') ||
       alertText?.toLowerCase().includes('fehler');
 
@@ -349,9 +353,15 @@ async function main() {
   // 5. Cleanup: Delete test submissions from Payload CMS
   console.log(`\n🧹 Starting cleanup of test submissions...`);
   const payloadSecret = process.env.PAYLOAD_SECRET;
-  
+
   if (!payloadSecret) {
-    console.warn(`   ⚠️ PAYLOAD_SECRET not found in environment. Cleanup will likely fail with 403.`);
+    console.warn(
+      `   ⚠️ PAYLOAD_SECRET not found in environment. Cleanup will likely fail with 403 if the server expects a secret.`,
+    );
+  } else {
+    console.log(
+      `   🔐 PAYLOAD_SECRET found (${payloadSecret.substring(0, 3)}...). Sending x-e2e-secret header.`,
+    );
   }
 
   try {
@@ -361,7 +371,7 @@ async function main() {
 
     // Fetch test submissions with bypass header
     const searchResponse = await axios.get(searchUrl, {
-      headers: { 
+      headers: {
         Cookie: `klz_gatekeeper_session=${gatekeeperPassword}`,
         'x-e2e-secret': payloadSecret || '',
       },
@@ -373,29 +383,31 @@ async function main() {
     for (const doc of testSubmissions) {
       try {
         await axios.delete(`${apiUrl}/${doc.id}`, {
-          headers: { 
+          headers: {
             Cookie: `klz_gatekeeper_session=${gatekeeperPassword}`,
             'x-e2e-secret': payloadSecret || '',
           },
         });
         console.log(`   ✅ Deleted submission: ${doc.id} (${doc.name})`);
       } catch (delErr: any) {
-        console.warn(
+        console.warn(`   ⚠️ Cleanup attempt on ${doc.id} failed: ${delErr.message}`);
-          `   ⚠️ Cleanup attempt on ${doc.id} failed: ${delErr.message}`,
-        );
       }
     }
-    
+
     if (testSubmissions.length > 0) {
       console.log(`✅ Cleanup completed successfully.`);
     }
   } catch (err: any) {
     if (err.response?.status === 403) {
-      console.error(
+      console.error(`   ❌ Cleanup failed with 403 Forbidden.`);
-        `   ❌ Cleanup failed with 403 Forbidden. Ensure FormSubmissions access control and PAYLOAD_SECRET are aligned.`,
+      console.error(`      Detail: The server rejected the x-e2e-secret header.`);
-      );
+      console.error(`      Server Response: ${JSON.stringify(err.response.data)}`);
     } else {
       console.error(`   ❌ Cleanup fetch failed: ${err.message}`);
+      if (err.response) {
+        console.error(`      Status: ${err.response.status}`);
+        console.error(`      Body: ${JSON.stringify(err.response.data)}`);
+      }
     }
   }