palette

5 Commits

Include renames

Author	SHA1	Message	Date
fen	7a74ff3e74	Fix #139 : drop unsafe-inline from script-src and style-src (#139 ) CI / test (pull_request) Successful in 30s Details CI / docker (pull_request) Skipped Details - Move all inline <script> blocks (layout head/theme, topbar dark toggle, foot, paste, new, history, mine, settings, admin, unlock) to external files under internal/web/static/. Page data reaches scripts via data-* attributes (data-paste-id, data-default-dark) instead of template vars. - Replace inline onclick handlers (copy, delete, stats toggle) with addEventListener wiring. - Convert inline style="" attributes to CSS utility classes; swatch colors are now set via CSSOM/DOM APIs instead of innerHTML strings. - script-src/style-src are now plain 'self'; img-src data: stays for the SVG data-URI backgrounds. Verified with headless chromium: zero CSP violations on all pages in dark and light presets, theme swatches, admin lock, tables and paste view render correctly.	2026-09-10 09:08:17 -05:00
fen	8dde83ff68	Admin lock: replace explanation paragraph with centered key input CI / test (pull_request) Successful in 28s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:28:11 -05:00
fen	6b95994c53	Admin lock on every load, drop settings hint, derive theme swatches from CSS vars (#112 ) CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details	2026-09-09 19:52:32 -05:00
poslop	064f05536a	Admin page: validate key before persisting to sessionStorage (#99 ) Panel was already display:none-gated until auth; tightened so a wrong submitted key is never stored in sessionStorage — the typed key is validated via the settings API first, and only persisted on 200.	2026-09-09 17:17:00 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35 ) CI / test (push) Successful in 19s Details CI / docker (push) Failing after 2m7s Details	2026-09-09 01:33:39 -05:00