From c90649fc1e5feff9bf722bc39edd7e89127d4c5e Mon Sep 17 00:00:00 2001
From: Oliver Rasche <o.rasche@evomedien.de>
Date: Fri, 11 Sep 2026 13:24:28 +0200
Subject: [PATCH] Drop headless-mixed set; widen asset permissions to all of
 fileadmin

The headless-mixed set was active although the site runs full headless. On
any request whose Accept header equals exactly 'application/json' it
re-imported the headless page configuration, and 'page < lib.headlessPage'
replaced the whole page object - dropping every field later sets had added:
mainNavigation, footerMenu, metaMenu, megaMenu, jsonLd. The header is not
part of the page cache key, so whichever request rendered first decided what
everyone got, which made it look like a concurrency race. Removing the set
restores the full 15-key payload for every Accept variant.

fix-asset-perms.sh only covered _assets, fileadmin/icons and the extension's
Resources/Public, so anything an importer wrote under public/fileadmin kept
the mount's permissions and returned 403 - most visibly the success-story
images in the megamenu. It now covers public/fileadmin as a whole.
---
 config/sites/vitec/config.yaml |  1 -
 fix-asset-perms.sh             | 12 +++++++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/config/sites/vitec/config.yaml b/config/sites/vitec/config.yaml
index 3a657c9..5576bdc 100644
--- a/config/sites/vitec/config.yaml
+++ b/config/sites/vitec/config.yaml
@@ -6,7 +6,6 @@ dependencies:
   - typo3/form
   - typo3/seo-sitemap
   - friendsoftypo3/headless
-  - friendsoftypo3/headless-mixed
   - nb-headless-content-blocks/headless-content-blocks
   - evomedien/vitecset
   - vitec/content-blocks-bundle
diff --git a/fix-asset-perms.sh b/fix-asset-perms.sh
index 5413bc8..ad2a0f4 100755
--- a/fix-asset-perms.sh
+++ b/fix-asset-perms.sh
@@ -16,9 +16,15 @@ set -u
 cd "$(dirname "$0")" || exit 1
 
 echo "[perms] Project root: $(pwd)"
-echo "[perms] Setting files 644 / directories 755 under Resources/Public + _assets ..."
-find public/_assets public/fileadmin/icons packages/vitec/Resources/Public -type f -exec chmod 644 {} \; 2>/dev/null
-find public/_assets public/fileadmin/icons packages/vitec/Resources/Public -type d -exec chmod 755 {} \; 2>/dev/null
+# public/fileadmin as a whole, not just icons: every editorial upload and every
+# importer output lands there (success_stories_import, blog-import, downloads,
+# user_upload/products ...) and hits the same 403 otherwise. Found 2026-09-11,
+# when the imported success-story images stayed invisible in the megamenu.
+TARGETS="public/_assets public/fileadmin packages/vitec/Resources/Public"
+
+echo "[perms] Setting files 644 / directories 755 under $TARGETS ..."
+find $TARGETS -type f -exec chmod 644 {} \; 2>/dev/null
+find $TARGETS -type d -exec chmod 755 {} \; 2>/dev/null
 
 echo "[perms] Flushing TYPO3 caches ..."
 if [ -x vendor/bin/typo3 ]; then