palette

4 Commits

Include renames

Author	SHA1	Message	Date
fen	72dbfb1b3c	Fix invisible select chevron in all presets (#136 ) CI / test (pull_request) Successful in 28s Details CI / docker (pull_request) Skipped Details Two compounding causes: - CSP img-src fell back to default-src (self), blocking the data: URI chevron image on all served pages, so no select ever painted it. - .editor-head select used the background shorthand, wiping the background-image set by the later select rule. Chevron stroke is now a per-preset --chevron token (light stroke for dark presets, dark for light presets) instead of hardcoded #888. CSP gains img-src 'self' data: so the data-URI icons can load.	2026-09-09 23:25:15 -05:00
fen	073d39ccba	Fix #116 : allow inline styles in CSP (style-src 'self' 'unsafe-inline') CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:18:53 -05:00
fen	3d415edbdc	fix #84 : security headers dropped because they were set post-flush; set pre-handler CI / test (pull_request) Successful in 21s Details CI / docker (pull_request) Skipped Details	2026-09-09 10:54:16 -05:00
palette-agent	e08cafe9c8	security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59 ) CI / test (pull_request) Successful in 30s Details CI / docker (pull_request) Skipped Details - web.SecurityHeaders middleware wired into the chi router - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none' - Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff - Applied only to text/html responses; JSON API and /raw pass through unchanged - Regression test internal/web/securityheaders_test.go	2026-09-09 09:16:42 -05:00