Merge remote-tracking branch 'origin/master'

deploy/deploy.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 set -euo pipefail
+umask 022
 
 export NODE_OPTIONS="--max_old_space_size=4096"
 export CI="true"
@@ -74,6 +75,20 @@ ensure_pdf_fonts() {
   fi
 }
 
+ensure_ui_permissions() {
+  ui_root="$APP_DIR/ui/dist/spa"
+
+  if [[ ! -d "$ui_root" ]]; then
+    echo "ERROR: UI build output not found at $ui_root"
+    return 1
+  fi
+
+  # Nginx must be able to traverse parent directories and read built assets.
+  chmod 755 "$APP_DIR" "$APP_DIR/ui" "$APP_DIR/ui/dist" "$ui_root"
+  find "$ui_root" -type d -exec chmod 755 {} \;
+  find "$ui_root" -type f -exec chmod 644 {} \;
+}
+
 build_api_binary() {
   if ! command -v go >/dev/null 2>&1; then
     echo "go command not found; cannot build backend binary."
@@ -129,6 +144,9 @@ run_deploy() {
 
   npm run build
 
+  echo "== ENSURE UI PERMISSIONS =="
+  ensure_ui_permissions
+
   echo "== BUILD API =="
   build_api_binary