From 13f88013792ddbc12465b131758ed7545999db69 Mon Sep 17 00:00:00 2001
From: M_Kececi <you@example.com>
Date: Wed, 18 Feb 2026 15:17:46 +0300
Subject: [PATCH] Merge remote-tracking branch 'origin/master'

---
 deploy/deploy.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index bdfed42..52f87f3 100644
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 set -euo pipefail
+umask 022
 
 export NODE_OPTIONS="--max_old_space_size=4096"
 export CI="true"
@@ -74,6 +75,20 @@ ensure_pdf_fonts() {
   fi
 }
 
+ensure_ui_permissions() {
+  ui_root="$APP_DIR/ui/dist/spa"
+
+  if [[ ! -d "$ui_root" ]]; then
+    echo "ERROR: UI build output not found at $ui_root"
+    return 1
+  fi
+
+  # Nginx must be able to traverse parent directories and read built assets.
+  chmod 755 "$APP_DIR" "$APP_DIR/ui" "$APP_DIR/ui/dist" "$ui_root"
+  find "$ui_root" -type d -exec chmod 755 {} \;
+  find "$ui_root" -type f -exec chmod 644 {} \;
+}
+
 build_api_binary() {
   if ! command -v go >/dev/null 2>&1; then
     echo "go command not found; cannot build backend binary."
@@ -129,6 +144,9 @@ run_deploy() {
 
   npm run build
 
+  echo "== ENSURE UI PERMISSIONS =="
+  ensure_ui_permissions
+
   echo "== BUILD API =="
   build_api_binary