sneak 3b1029f65c Drop 'unsafe-inline' from the Content-Security-Policy (closes #530) ...

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

2026-10-15 09:46:04 +00:00

..

archive_expiry_test.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

archive_expiry.go

Rotate a database target's archive monthly, daily or hourly (closes #379)

2026-10-03 04:18:37 +02:00

archive_rotation_test.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

archive_rotation.go

Rotate a database target's archive monthly, daily or hourly (closes #379)

2026-10-03 04:18:37 +02:00

auth_test.go

Write a form-error page's status only after it renders (closes #128)

2026-10-02 15:34:01 +02:00

auth.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

delivery_attempts_test.go

Escape the database path in the SQLite connection string (closes #518)

2026-10-13 09:30:24 +02:00

delivery_replay_test.go

Build every database's schema from embedded SQL files (closes #56)

2026-10-13 06:34:05 +02:00

delivery_replay.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

delivery_result_view_test.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:46:04 +00:00

delivery_result_view.go

Describe code in its own terms, not by an earlier build's data (closes #522)

2026-10-13 09:57:24 +02:00

entrypoint_toggle_test.go

Let an entrypoint's description be edited in place (closes #392)

2026-10-02 21:32:43 +02:00

entrypoint_view_test.go

Show each entrypoint's last event and event count on the webhook page (closes #393)

2026-10-02 23:16:07 +02:00

entrypoint_view.go

Show each entrypoint's last event and event count on the webhook page (closes #393)

2026-10-02 23:16:07 +02:00

entrypoint.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

error_page_test.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

event_body_test.go

Name the reaper's hard delete in the event body comments (closes #455)

2026-10-02 19:36:30 +02:00

event_body_view_test.go

Give each event its own page and show bodies the same everywhere (closes #369)

2026-10-02 22:00:42 +02:00

event_body_view.go

Give each event its own page and show bodies the same everywhere (closes #369)

2026-10-02 22:00:42 +02:00

event_body.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:46:04 +00:00

event_detail_test.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:46:04 +00:00

event_detail.go

Show an event's entrypoint and request headers in the event log and on its page (closes #389)

2026-10-03 05:22:14 +02:00

event_log_times_test.go

Event log: show attempt and delivery times, label replays, zone event times (closes #386)

2026-10-03 04:12:27 +02:00

event_log_view_test.go

Event log: only the newest event expanded, and only the 50 most recent (closes #349)

2026-10-03 03:43:27 +02:00

event_log_view.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

event_log.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

event_request_test.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

event_resubmit_test.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

event_resubmit.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

export_test.go

Event log: show only the events with a failed or a pending delivery (closes #390)

2026-10-03 05:40:34 +02:00

footer_version_test.go

Stamp the build version into the binary (closes #253)

2026-08-24 03:15:20 +02:00

gormlogbound_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

handlers_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

handlers.go

Show an event's entrypoint and request headers in the event log and on its page (closes #389)

2026-10-03 05:22:14 +02:00

healthcheck.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00

index.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

logbound_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

metrics.go

Serve /metrics from a registry of its own (closes #227)

2026-10-02 09:06:20 +02:00

notice.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

page_title_test.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

profile_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

profile.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

recent_events_test.go

Give each event its own page and show bodies the same everywhere (closes #369)

2026-10-02 22:00:42 +02:00

recent_events.go

Give each event its own page and show bodies the same everywhere (closes #369)

2026-10-02 22:00:42 +02:00

settings_test.go

Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

2026-10-13 03:27:24 +02:00

settings.go

Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

2026-10-13 03:27:24 +02:00

shared.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

source_create_targets_test.go

Rotate a database target's archive monthly, daily or hourly (closes #379)

2026-10-03 04:18:37 +02:00

source_delete_test.go

Let an entrypoint's description be edited in place (closes #392)

2026-10-02 21:32:43 +02:00

source_detail_baseurl_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

source_detail_test.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:46:04 +00:00

source_list_test.go

Show each webhook's activity in the webhook list (closes #394)

2026-10-02 13:57:43 +02:00

source_logs_deleted_target_test.go

Offer no Replay for a delivery to a deleted target (closes #387)

2026-10-03 02:13:17 +02:00

source_logs_test.go

Event log: show only the events with a failed or a pending delivery (closes #390)

2026-10-03 05:40:34 +02:00

source_management_test.go

Keep what was typed when a target or webhook edit is refused (closes #381)

2026-10-03 00:51:56 +02:00

target_create_query_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

target_create_test.go

Targets section: one Add, then a target type and Next, then that type's fields (closes #370)

2026-10-02 22:24:38 +02:00

target_create.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

target_delete.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

target_download_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

target_download.go

Rotate a database target's archive monthly, daily or hourly (closes #379)

2026-10-03 04:18:37 +02:00

target_edit_test.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

target_edit.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00

target_list_test.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

target_list.go

Rotate a database target's archive monthly, daily or hourly (closes #379)

2026-10-03 04:18:37 +02:00

target_paused_test.go

Event log: show only the events with a failed or a pending delivery (closes #390)

2026-10-03 05:40:34 +02:00

target_private_refusal_test.go

Keep what was typed when a target or webhook edit is refused (closes #381)

2026-10-03 00:51:56 +02:00

target_retries_test.go

Event log: only the newest event expanded, and only the 50 most recent (closes #349)

2026-10-03 03:43:27 +02:00

target_retries.go

Describe code in its own terms, not by an earlier build's data (closes #522)

2026-10-13 09:57:24 +02:00

target_toggle_test.go

Toggle only a target's active state, so it cannot undo an edit (closes #431)

2026-10-02 14:43:00 +02:00

target_toggle.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

ui_copy_test.go

Use one name for each thing the UI shows (closes #399)

2026-10-03 05:07:41 +02:00

webhook_create.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

webhook_delete.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

webhook_detail.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

webhook_edit.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

webhook_list.go

Split source_management.go along its CRUD seams (closes #274)

2026-10-03 06:19:46 +02:00

webhook_stats_test.go

Add a statistics pane to the webhook page (closes #368)

2026-10-02 06:41:00 +02:00

webhook_stats.go

Add a statistics pane to the webhook page (closes #368)

2026-10-02 06:41:00 +02:00

webhook_test.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

webhook.go

Store and show an event's query string, and pass it on to an HTTP target when set (closes #312)

2026-10-04 03:00:34 +02:00