9 Commits

Include renames

Author	SHA1	Message	Date
clawbot	b4e5300feb	feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91) ... SecurityHeaders() now also sets Strict-Transport-Security (one year, includeSubDomains), a Content-Security-Policy (default-src self, frame-ancestors none) and a Permissions-Policy denying the browser features pixa does not use. X-Frame-Options stays as the legacy fallback. What a reader would trip over: HSTS is sent on every response even though pixa listens on plain HTTP behind a TLS-terminating proxy; browsers ignore the header over plaintext, and this avoids trusting a forwarded-proto header. The clipboard feature is left unlisted so the copy button on the generator page keeps working. Disclosure: script-src and style-src carry unsafe-inline because the generator template has inline onclick handlers and the bundled Tailwind script injects a style element at runtime; removing it needs template changes and is tracked separately. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 20:43:13 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00
sneak	9bfae69ccf	Fix logging: add response_bytes to middleware, cache_key to handler ... - Middleware now tracks and logs bytes written via response_bytes - Handler logs cache_key for cache hit debugging - Changed "served encrypted image" to "image served" (only URL is encrypted)	2026-01-08 13:05:10 -08:00
sneak	2e349a8b83	Implement security headers middleware ... Adds X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection headers to all responses.	2026-01-08 10:02:17 -08:00
sneak	5de7a26735	Add failing tests for security headers middleware ... Tests for X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection headers on responses.	2026-01-08 10:01:36 -08:00
sneak	29adb6ee47	Rename unused parameters to _ to satisfy linter	2026-01-08 02:27:45 -08:00
sneak	3f6328766c	Rename MiddlewareParams to Params to avoid stuttering	2026-01-08 02:25:42 -08:00
sneak	115f92660d	Define CORSMaxAgeSeconds constant	2026-01-08 02:21:30 -08:00
sneak	516853626d	Add basic webserver skeleton with healthcheck	2026-01-08 02:20:23 -08:00