Public static wrapper for https://ams.ahlab.org — the AHL Asset Management System.
This repo is intentionally tiny. It's a single page that embeds the gated Apps Script app (private repo ahl-ams-appscript) in a full-bleed <iframe>, plus a branded loading splash, social card and PWA manifest. All data, the @ahlab.org gate and the account picker live inside the embedded app — nothing sensitive is in this repo.
index.html full-bleed <iframe> of the Apps Script /exec URL + splash
og-card.html source for og-image.png (1200×630)
og-image.png social share card, served at /og-image.png
CNAME ams.ahlab.org
manifest.webmanifest PWA metadata
Pasting the URL into WhatsApp/Slack/iMessage renders og-image.png — a 1200×630
branded card, not the bare lab logo (which chat apps blow up to full width). Edit
og-card.html, then regenerate:
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
--headless=new --hide-scrollbars --window-size=1200,630 \
--screenshot="og-image.png" "$(pwd)/og-card.html"Chat apps cache previews aggressively — after deploying, re-scrape via the
Facebook Sharing Debugger or append
a throwaway ?v=2 to the URL to see the new card. The same card is used for QR
deep links (?asset=…), since the query string doesn't change the <head>.
ams.ahlab.org previously used an external Apache redirect to the Apps Script …/a/macros/ahlab.org/s/…/exec URL. That domain-scoped form forces a specific Workspace account and dead-ends visitors on the wrong Google account ("unable to open the file"). This wrapper instead embeds the generic …/macros/s/…/exec form, so the app's in-code @ahlab.org gate runs and shows a friendly account picker to wrong-account visitors.
To cut over: point ams.ahlab.org DNS at GitHub Pages (CNAME → augmented-human-lab.github.io) and remove the old Apache redirect. The CNAME file here pins the custom domain.
Asset/holder/location QR codes encode ams.ahlab.org/?asset=…, ?user=…, ?location=…. The wrapper forwards the incoming query string into the iframe's /exec URL, so deep links keep working.
A domain-gated Apps Script app needs the visitor's Google session; a cross-origin background fetch() can't carry it. The iframe does — and inside it the app uses google.script.run (Apps Script's internal bridge, not a cross-origin request), so there is no CORS.
GitHub Pages serves this repo's main branch root.
git add -A && git commit -m "…" && git push # that's the deployThe embedded /exec URL in index.html must match the fixed deployment ID in ahl-ams-appscript's deploy.js. That repo always releases with node deploy.js, keeping the /exec URL stable, so this file rarely changes.