CANNOT publish post or page manually，but CAN publish with API Token by AI

[tableau-China]

Description

I deployed emdash on cloud server yesterday . And as Administrator , I cannot publish my page or post .
I can only save them as draft .

BUT , today , I published posts and pages using API Tokens !

--- DRAFTS --- 6 Apr 2026 (slug: 6-apr-2026, id: 01KNGTT8NX2R7FX1JMWZ5N8E23) Emdash部署完成！ (slug: emdash, id: 01KNGSAXV2AZYJVCM66Z4AD9HE) Work in Progress (slug: work-in-progress, id: 01KNCCMAKTD2Z28W0D6Y3YV7S5)
curl -s -X POST \ -H "Authorization: Bearer ec_pat_bNRGO2I9fWu2ndNV4lbXOadFo35MUtPj1kjO_v-TAgs" \ -H "Content-Type: application/json" \ -H "X-EmDash-Request: 1" \ "https://emdash.vizwise.cn/_emdash/api/content/posts/01KNGTT8NX2R7FX1JMWZ5N8E23/publish" 2>&1 | python3 -c "import sys,json;d=json.load(sys.stdin)['data']['item'];print(f'{d[\"data\"][\"title\"]} → {d[\"status\"]} (slug: {d[\"slug\"]})')" curl -s -X POST \ -H "Authorization: Bearer ec_pat_bNRGO2I9fWu2ndNV4lbXOadFo35MUtPj1kjO_v-TAgs" \ -H "Content-Type: application/json" \ -H "X-EmDash-Request: 1" \ "https://emdash.vizwise.cn/_emdash/api/content/posts/01KNGSAXV2AZYJVCM66Z4AD9HE/publish" 2>&1 | python3 -c "import sys,json;d=json.load(sys.stdin)['data']['item'];print(f'{d[\"data\"][\"title\"]} → {d[\"status\"]} (slug: {d[\"slug\"]})')" curl -s -X POST \ -H "Authorization: Bearer ec_pat_bNRGO2I9fWu2ndNV4lbXOadFo35MUtPj1kjO_v-TAgs" \ -H "Content-Type: application/json" \ -H "X-EmDash-Request: 1" \ "https://emdash.vizwise.cn/_emdash/api/content/posts/01KNCCMAKTD2Z28W0D6Y3YV7S5/publish" 2>&1 | python3 -c "import sys,json;d=json.load(sys.stdin)['data']['item'];print(f'{d[\"data\"][\"title\"]} → {d[\"status\"]} (slug: {d[\"slug\"]})')" 6 Apr 2026 → published (slug: 6-apr-2026) Emdash部署完成 → published (slug: emdash) Work in Progress → published (slug: work-in-progress)

Steps to reproduce

1. Deploy EmDash on a cloud server behind an Nginx reverse proxy with HTTPS (e.g. Tencent Cloud Lighthouse).

   • Astro dev server runs on localhost:4321 (managed via PM2).
   • Nginx handles SSL termination and proxies to http://127.0.0.1:4321.

2. Configure astro.config.mjs to allow external access:

   server: {
     host: "0.0.0.0",
     allowedHosts: ["emdash.vizwise.cn", "vizwise.cn"],
   }

3. Patch node_modules/emdash/src/auth/passkey-config.ts to force HTTPS origin (required for Passkey/WebAuthn behind reverse proxy):

   // Before:
   origin: url.origin,
   // After:
   origin: "https://" + url.hostname,

4. Start EmDash: pm2 start "npx astro dev --host" --name emdash

5. Complete the admin setup flow at https://emdash.vizwise.cn/_emdash/admin/setup (Site → Account → Passkey registration). All steps succeed.

6. Log in as administrator via Passkey. Succeed.

7. Create a new post or page, add some content, then click Publish.

   • Expected: Post/page is published and visible on the site.
   • Actual: Only "Save as draft" works. Clicking "Publish" does not publish the content — it remains in draft status. No visible error is shown in the UI.

8. Workaround: Publishing works correctly via the REST API with a Personal Access Token:

   curl -s -X POST \
     -H "Authorization: Bearer ec_pat_xxxx" \
     -H "Content-Type: application/json" \
     -H "X-EmDash-Request: 1" \
     "https://emdash.vizwise.cn/_emdash/api/content/posts/{id}/publish"
   # Response: status changes to "published" successfully

Environment

• EmDash 0.1.0 (latest via npm), Astro dev mode, Node.js 22+
• OS: OpenCloudOS 9 (Tencent Cloud Lighthouse)
• Reverse proxy: Nginx + certbot (HTTPS with separate cert for subdomain)
• Browser: Chrome 146 (latest)

Logs / error output

cannot publish content

[UpperM]

I think it's related to #315

[tableau-China]

NEW :
I cannot publish a new post directly with API , but I can save a new post to DRAFT first , and then PUBLISH it .