3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	742db9ceb1	Logging out ends every login session (closes #256) ... A login session was a cookie with nothing kept on the server, so logging out removed it from one browser and a copy kept working for 30 days. The session manager now keeps a random value in the database, made when it has none and replaced by each logout; a session carries the value current at its login and is refused once it has changed. The logout check compares no time, so the host's clock cannot block a login, and losing the state directory ends every login session. Logging out is now a POST with the CSRF token, sent by a form on the generator page. Model: opus-5-5	2026-10-15 20:44:44 +02:00
clawbot	842372250f	Remove unsafe-inline from the Content-Security-Policy (closes #125) ... script-src and style-src now allow only 'self'. The generator page's two inline onclick handlers, which selected the generated URL and copied it, move into internal/static/generator.js and are attached with addEventListener. The bundled Tailwind script, which built styles in the browser and injected them at runtime, is replaced by a small hand-written internal/static/style.css holding only the rules the login and generator pages use; the templates carry a few plain class names in place of Tailwind's. No build step. The pages keep their layout, not every pixel of it. Model: opus-5-5	2026-10-04 18:58:40 +02:00
sneak	aad5e59d23	Add static files and HTML templates for web UI ... Embedded Tailwind CSS and login/generator templates. Self-contained with no external dependencies.	2026-01-08 07:38:09 -08:00