From 2816c4382b075893d006a357806488c7d99083e2 Mon Sep 17 00:00:00 2001
From: umamaheswar <40281735+Skyrider3@users.noreply.github.com>
Date: Wed, 17 Jun 2026 23:20:05 -0400
Subject: [PATCH] fix: correct public agent-card URLs shown to users

The public URL surfaced to users was wrong or 404'd in several places:

- Personal card URLs are keyed by the user's handle
  (/personal/:handle/:slug.json), but the README intro example, the API
  table row, the identity-types prose, and the landing page all showed
  an email-based URL. The handle column is regex-constrained and can
  never equal an email, so following those examples 404s. Switch all of
  them to the handle format.
- The dashboard rendered a copyable "Public URL" for every card, even
  ones flagged Private or Inactive. The server only serves a card when
  status='active' AND is_public=TRUE, so those URLs 404. Only show the
  URL (and Copy button) when the card is actually served publicly;
  otherwise show a muted note.
- The edit-page banner gated on is_public but not status, so a
  public+inactive card still showed an "Open" link that 404s. Tighten
  it to is_public && active for consistency.

No backend, route, or schema changes.
---
 README.md                                 |  6 ++---
 web/src/app/dashboard/cards/[id]/page.tsx |  8 +++---
 web/src/app/dashboard/page.tsx            | 30 ++++++++++++++---------
 web/src/app/page.tsx                      |  5 ++--
 4 files changed, 28 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index 96153cb..e4175a0 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ host39 lets individuals and businesses register agent identities and publish A2A
 
 ```
 GET /moonbakery.com/orders.json         # domain identity
-GET /personal/john@email.com/card.json  # personal identity
+GET /personal/john/card.json            # personal identity
 GET /.well-known/ai-catalog.json        # all active cards
 ```
 
@@ -66,7 +66,7 @@ docker compose up --build
 
 | Method | Path | Description |
 |---|---|---|
-| `GET` | `/personal/:email/:slug.json` | Fetch a personal agent card |
+| `GET` | `/personal/:handle/:slug.json` | Fetch a personal agent card |
 | `GET` | `/:domain/:slug.json` | Fetch a domain agent card |
 | `GET` | `/.well-known/ai-catalog.json` | All active cards |
 | `GET` | `/health` | Liveness probe |
@@ -75,7 +75,7 @@ docker compose up --build
 
 ## Identity types
 
-**Personal (email)** — for individuals. Cards are served under `/personal/<email>/`.
+**Personal (email)** — for individuals. Cards are served under `/personal/<handle>/`, where `<handle>` is the username chosen at registration.
 
 **Domain (business)** — for orgs with a domain. Cards are served under `/<domain>/`. Only one user can register a given domain.
 
diff --git a/web/src/app/dashboard/cards/[id]/page.tsx b/web/src/app/dashboard/cards/[id]/page.tsx
index 716c8b8..54b9b86 100644
--- a/web/src/app/dashboard/cards/[id]/page.tsx
+++ b/web/src/app/dashboard/cards/[id]/page.tsx
@@ -200,8 +200,8 @@ export default function EditCardPage() {
       description="Update your agent card details."
     >
       <div className="max-w-lg space-y-6">
-        {/* Public URL banner */}
-        {isPublic ? (
+        {/* Public URL banner — only when the card is actually served publicly */}
+        {isPublic && status === "active" ? (
           <div className="rounded-3xl border border-black/10 bg-white p-5 shadow-sm">
             <p className="mb-2 text-xs font-semibold uppercase tracking-[0.18em] text-slate-500">
               Public URL
@@ -228,8 +228,8 @@ export default function EditCardPage() {
           </div>
         ) : (
           <div className="rounded-3xl border border-amber-200 bg-amber-50 p-5">
-            <p className="text-xs font-semibold uppercase tracking-[0.18em] text-amber-600">Private</p>
-            <p className="mt-1 text-sm text-amber-700">This card is not publicly accessible. Enable &ldquo;Public&rdquo; below to publish it.</p>
+            <p className="text-xs font-semibold uppercase tracking-[0.18em] text-amber-600">Not public</p>
+            <p className="mt-1 text-sm text-amber-700">This card is not publicly served. Set it to &ldquo;Public&rdquo; and &ldquo;Active&rdquo; below to publish it.</p>
           </div>
         )}
 
diff --git a/web/src/app/dashboard/page.tsx b/web/src/app/dashboard/page.tsx
index e3922f1..f2c86b6 100644
--- a/web/src/app/dashboard/page.tsx
+++ b/web/src/app/dashboard/page.tsx
@@ -165,18 +165,24 @@ export default function DashboardPage() {
                           <p className="mt-1 text-sm text-slate-500 line-clamp-1">{card.description}</p>
                         )}
 
-                        {/* Public URL */}
-                        <div className="mt-3 flex items-center gap-2">
-                          <code className="min-w-0 flex-1 truncate rounded-lg border border-black/5 bg-slate-50 px-3 py-1.5 font-mono text-xs text-slate-600">
-                            {publicUrl}
-                          </code>
-                          <button
-                            onClick={() => copyUrl(publicUrl, card.id)}
-                            className="shrink-0 rounded-lg border border-black/10 bg-white px-3 py-1.5 text-xs text-slate-600 hover:bg-slate-50"
-                          >
-                            {copiedId === card.id ? "Copied!" : "Copy"}
-                          </button>
-                        </div>
+                        {/* Public URL — only shown when the card is actually served publicly */}
+                        {card.is_public && card.status === "active" ? (
+                          <div className="mt-3 flex items-center gap-2">
+                            <code className="min-w-0 flex-1 truncate rounded-lg border border-black/5 bg-slate-50 px-3 py-1.5 font-mono text-xs text-slate-600">
+                              {publicUrl}
+                            </code>
+                            <button
+                              onClick={() => copyUrl(publicUrl, card.id)}
+                              className="shrink-0 rounded-lg border border-black/10 bg-white px-3 py-1.5 text-xs text-slate-600 hover:bg-slate-50"
+                            >
+                              {copiedId === card.id ? "Copied!" : "Copy"}
+                            </button>
+                          </div>
+                        ) : (
+                          <p className="mt-3 text-xs text-slate-400">
+                            Not publicly served — set Public and Active to publish.
+                          </p>
+                        )}
                       </div>
 
                       <Link
diff --git a/web/src/app/page.tsx b/web/src/app/page.tsx
index fa05264..1d3a504 100644
--- a/web/src/app/page.tsx
+++ b/web/src/app/page.tsx
@@ -115,10 +115,11 @@ export default function HomePage() {
           <div className="rounded-3xl border border-black/10 bg-white p-6 shadow-sm">
             <p className="text-xs font-semibold uppercase tracking-[0.18em] text-slate-500">Personal / Email</p>
             <code className="mt-3 block rounded-xl border border-black/5 bg-slate-50 p-4 font-mono text-sm text-slate-800">
-              /personal/john@hotmail.com/card.json
+              /personal/john/card.json
             </code>
             <p className="mt-3 text-sm text-slate-600">
-              Register with your email for personal agent cards — great for developers and individuals.
+              Register with your email and pick a username — your personal cards live at a clean
+              handle-based URL. Great for developers and individuals.
             </p>
           </div>
         </div>