4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	258e95806e	Reword the comment on TestCORSAnswersWithConfiguredOrigin (closes #61) ... The comment was not a readable sentence; it is now one plain sentence saying what the test checks. Model: opus-5-5	2026-09-28 19:51:14 +00:00
clawbot	c8cb3cb996	Test four README settings pixa does not have yet (closes #61) ... Failing tests for access_control_allow_origin, upstream_fetch_timeout, upstream_max_response_size and downstream_timeout: their defaults, valid values from the file and the environment, invalid values aborting startup naming the key or variable and the value, the CORS middleware answering with the configured origin, and the server's write timeout coming from downstream_timeout. They do not compile until the settings exist. Model: opus-5-5	2026-09-28 19:51:14 +00:00
clawbot	b4e5300feb	feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91) ... SecurityHeaders() now also sets Strict-Transport-Security (one year, includeSubDomains), a Content-Security-Policy (default-src self, frame-ancestors none) and a Permissions-Policy denying the browser features pixa does not use. X-Frame-Options stays as the legacy fallback. What a reader would trip over: HSTS is sent on every response even though pixa listens on plain HTTP behind a TLS-terminating proxy; browsers ignore the header over plaintext, and this avoids trusting a forwarded-proto header. The clipboard feature is left unlisted so the copy button on the generator page keeps working. Disclosure: script-src and style-src carry unsafe-inline because the generator template has inline onclick handlers and the bundled Tailwind script injects a style element at runtime; removing it needs template changes and is tracked separately. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 20:43:13 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00