3 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	d411693bb2	feat(server): security headers and a hash-based CSP for the web app (M462 #4980) ... There were no security headers at all. Now: - every response: nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy (no camera/mic/geolocation), X-Frame-Options DENY; each set only if the handler hasn't. - HSTS only when the trusted proxy reports HTTPS (rule 94); never a redirect. - index.html carries a Content-Security-Policy whose script-src is 'self' plus the sha256 of each inline script in the page as served, computed after the branding template runs. No 'unsafe-inline' or 'unsafe-eval' for scripts. img-src admits remote https/http because Lidarr suggestion art is a remote poster URL. Hashing in Go rather than via SvelteKit's kit.csp covers the inline scripts SvelteKit doesn't know about (app.html's theme bootstrap and the branding global injected at build) and stays correct whatever the app name is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:29:26 -04:00
bvandeusen	004d935512	feat(server/m7-363): branding-aware index handler with html/template	2026-05-03 17:21:30 -04:00
bvandeusen	8fe4a5f578	refactor(web): move embed package to web/ so go:embed reaches build/ ... go:embed paths are relative to the source file and cannot reach parent directories, so internal/web/embed.go could not see web/build/ without duplicating the placeholder. Relocating to web/embed.go lets the directive resolve to the real SvelteKit build output with no copy step.	2026-04-22 10:29:31 -04:00