10 Commits

Include renames

Author	SHA1	Message	Date
sneak	3afce48383	feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91) ... SecurityHeaders() now also sets Strict-Transport-Security, Content-Security-Policy, and Permissions-Policy. HSTS is emitted unconditionally: browsers ignore it over plaintext (RFC 6797 section 8.1), so it never lies about the connection and no forwarded-proto header need be trusted. The CSP baseline is default-src 'self' with frame-ancestors 'none' as the primary clickjacking control. script-src and style-src carry 'unsafe-inline' because the generator template has inline onclick handlers and the bundled Tailwind asset injects a runtime <style> element; removing that need is a template change beyond this issue. Permissions-Policy denies browser features pixa does not use. Model: opus-4-8	2026-09-21 18:16:20 +00:00
sneak	73fc21b6a8	test: assert HSTS, CSP, and Permissions-Policy headers ... Failing test for the three security headers required before 1.0 (issue #91). Implementation follows in the next commit. Model: opus-4-8	2026-09-21 18:16:20 +00:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00
sneak	9bfae69ccf	Fix logging: add response_bytes to middleware, cache_key to handler ... - Middleware now tracks and logs bytes written via response_bytes - Handler logs cache_key for cache hit debugging - Changed "served encrypted image" to "image served" (only URL is encrypted)	2026-01-08 13:05:10 -08:00
sneak	2e349a8b83	Implement security headers middleware ... Adds X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection headers to all responses.	2026-01-08 10:02:17 -08:00
sneak	5de7a26735	Add failing tests for security headers middleware ... Tests for X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection headers on responses.	2026-01-08 10:01:36 -08:00
sneak	29adb6ee47	Rename unused parameters to _ to satisfy linter	2026-01-08 02:27:45 -08:00
sneak	3f6328766c	Rename MiddlewareParams to Params to avoid stuttering	2026-01-08 02:25:42 -08:00
sneak	115f92660d	Define CORSMaxAgeSeconds constant	2026-01-08 02:21:30 -08:00
sneak	516853626d	Add basic webserver skeleton with healthcheck	2026-01-08 02:20:23 -08:00