sneak 9778ad7130 Drop 'unsafe-inline' from the Content-Security-Policy (closes #530) ...

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

2026-10-15 09:26:11 +00:00

..

middlewaretest

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

accesslog_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

clientip_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

csrf_test.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

csrf.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

export_test.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

logbound_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

loginguard_test.go

Re-vendor the shared files from sneak/prompts at dd4027b (closes #504)

2026-10-06 06:05:42 +02:00

loginguard.go

Log the client address next to the peer address (closes #270)

2026-10-02 16:50:22 +02:00

metrics_method_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

metrics_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

metrics.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

middleware_test.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:26:11 +00:00

middleware.go

Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

2026-10-15 09:26:11 +00:00

ratelimit_test.go

Keep test helpers out of the shipped binary (closes #506)

2026-10-06 14:29:47 +02:00

ratelimit.go

Pin the rate-limit key for an empty RemoteAddr (closes #168)

2026-10-02 17:09:23 +02:00

recoverer_test.go

Let a handler flush or set a write deadline through the access log and metrics (closes #191)

2026-10-02 13:08:54 +02:00

recoverer.go

Render admin page errors in the normal layout (closes #382)

2026-10-02 08:15:12 +02:00

timeout_test.go

Add a Download button that exports a database target's archive as gzipped JSON (closes #374)

2026-10-02 20:32:09 +02:00

timeout.go

Add a Download button that exports a database target's archive as gzipped JSON (closes #374)

2026-10-02 20:32:09 +02:00