bvandeusenandClaude Opus 5.5 d411693bb2 feat(server): security headers and a hash-based CSP for the web app (M462 #4980) ...

There were no security headers at all. Now:
- every response: nosniff, Referrer-Policy strict-origin-when-cross-origin,
  Permissions-Policy (no camera/mic/geolocation), X-Frame-Options DENY;
  each set only if the handler hasn't.
- HSTS only when the trusted proxy reports HTTPS (rule 94); never a redirect.
- index.html carries a Content-Security-Policy whose script-src is 'self'
  plus the sha256 of each inline script in the page as served, computed
  after the branding template runs. No 'unsafe-inline' or 'unsafe-eval'
  for scripts. img-src admits remote https/http because Lidarr suggestion
  art is a remote poster URL.

Hashing in Go rather than via SvelteKit's kit.csp covers the inline scripts
SvelteKit doesn't know about (app.html's theme bootstrap and the branding
global injected at build) and stays correct whatever the app name is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:29:26 -04:00

..

build

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

scripts

test(web/m7-362): tokens-to-css generator unit test

2026-05-03 13:52:13 -04:00

src

feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

2026-10-06 08:32:39 -04:00

static

fix(web): vendor the web fonts instead of loading them from Google

2026-09-09 13:49:47 -04:00

.gitignore

refactor(web): extract design tokens to tokens.json source of truth

2026-05-02 14:55:46 -04:00

csp_test.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

csp.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

embed_test.go

fix(server,web): update test fixtures for new New/Handler signatures

2026-05-03 18:44:34 -04:00

embed.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

package-lock.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

package.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

postcss.config.cjs

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

svelte.config.js

refactor(web): sweep 8 test files to use pageUrlModule() (#375)

2026-05-10 15:39:25 -04:00

tailwind.config.js

feat(web/m7-362): add Tailwind text-action-fg alias for non-flipping label color

2026-05-03 13:40:20 -04:00

template_test.go

test(server/m7-363): script-context XSS test asserts </script> count

2026-05-03 17:24:42 -04:00

template.go

feat(server/m7-363): branding-aware index handler with html/template

2026-05-03 17:21:30 -04:00

tsconfig.json

feat(web): add Shell component with header, sidebar, and user menu

2026-04-22 22:20:18 -04:00

vite.config.ts

refactor(web): drive vite-injected theme-color from tokens.json (#375)

2026-05-10 15:29:48 -04:00

vitest.config.ts

test(web): un-skip discover/requests route tests — mock $app (#374)

2026-05-19 15:42:11 -04:00

vitest.setup.ts

test(web): no-op scrollIntoView in vitest setup (jsdom lacks it) — #1931

2026-07-22 21:27:35 -04:00