3 Commits

Include renames

Author	SHA1	Message	Date
sneak	1d2411dd2e	Log out with a form and count logouts instead of timing them (part of #256) ... Logging out is now a POST in the CSRF-protected route group, sent by a form on the generator page, so a link or image on another page of the same site cannot end every login session. The session manager keeps a count of logouts instead of the time of the latest one: each session carries the count at its login and is refused once it has changed. No clock is compared, so a login after a logout always works. Model: opus-5-5	2026-10-15 14:09:16 +00:00
clawbot	842372250f	Remove unsafe-inline from the Content-Security-Policy (closes #125) ... script-src and style-src now allow only 'self'. The generator page's two inline onclick handlers, which selected the generated URL and copied it, move into internal/static/generator.js and are attached with addEventListener. The bundled Tailwind script, which built styles in the browser and injected them at runtime, is replaced by a small hand-written internal/static/style.css holding only the rules the login and generator pages use; the templates carry a few plain class names in place of Tailwind's. No build step. The pages keep their layout, not every pixel of it. Model: opus-5-5	2026-10-04 18:58:40 +02:00
sneak	aad5e59d23	Add static files and HTML templates for web UI ... Embedded Tailwind CSS and login/generator templates. Self-contained with no external dependencies.	2026-01-08 07:38:09 -08:00