bvandeusenandClaude Opus 5.5 2f3fbccab6 feat(auth): first account on a new server needs the setup token from the server log (M462 #4982) ...

While no accounts exist, the server mints a random setup token at boot and
logs it. Registering the first account (which becomes admin) must carry it,
so whoever reaches a freshly exposed instance first cannot claim it. The
register page asks GET /api/auth/setup-status and shows a "Setup token"
field in place of the invite field while setup is pending.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:35:52 -04:00

..

build

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

scripts

test(web/m7-362): tokens-to-css generator unit test

2026-05-03 13:52:13 -04:00

src

feat(auth): first account on a new server needs the setup token from the server log (M462 #4982)

2026-10-06 09:35:52 -04:00

static

fix(web): vendor the web fonts instead of loading them from Google

2026-09-09 13:49:47 -04:00

.gitignore

refactor(web): extract design tokens to tokens.json source of truth

2026-05-02 14:55:46 -04:00

csp_test.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

csp.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

embed_test.go

fix(server,web): update test fixtures for new New/Handler signatures

2026-05-03 18:44:34 -04:00

embed.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

package-lock.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

package.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

postcss.config.cjs

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

svelte.config.js

refactor(web): sweep 8 test files to use pageUrlModule() (#375)

2026-05-10 15:39:25 -04:00

tailwind.config.js

feat(web/m7-362): add Tailwind text-action-fg alias for non-flipping label color

2026-05-03 13:40:20 -04:00

template_test.go

test(server/m7-363): script-context XSS test asserts </script> count

2026-05-03 17:24:42 -04:00

template.go

feat(server/m7-363): branding-aware index handler with html/template

2026-05-03 17:21:30 -04:00

tsconfig.json

feat(web): add Shell component with header, sidebar, and user menu

2026-04-22 22:20:18 -04:00

vite.config.ts

refactor(web): drive vite-injected theme-color from tokens.json (#375)

2026-05-10 15:29:48 -04:00

vitest.config.ts

test(web): un-skip discover/requests route tests — mock $app (#374)

2026-05-19 15:42:11 -04:00

vitest.setup.ts

test(web): no-op scrollIntoView in vitest setup (jsdom lacks it) — #1931

2026-07-22 21:27:35 -04:00