logster 2.21.0 → 3.0.1

data/assets/logster-config.json

@@ -0,0 +1,18 @@
+{
+  "modulePrefix": "client-app",
+  "environment": "production",
+  "rootURL": "/logs",
+  "locationType": "history",
+  "EmberENV": {
+    "FEATURES": {},
+    "EXTEND_PROTOTYPES": {
+      "Date": false
+    },
+    "_APPLICATION_TEMPLATE_WRAPPER": false,
+    "_DEFAULT_ASYNC_OBSERVERS": true,
+    "_JQUERY_INTEGRATION": false,
+    "_TEMPLATE_ONLY_GLIMMER_COMPONENTS": true,
+    "_USE_EMBER_MODULES": true
+  },
+  "APP": {}
+}

data/assets/manifest.json

@@ -0,0 +1,23 @@
+{
+  "index.html": {
+    "file": "assets/main-C9t0S9He.js",
+    "name": "main",
+    "src": "index.html",
+    "isEntry": true,
+    "dynamicImports": [
+      "node_modules/.pnpm/@embroider+legacy-inspector-support@0.1.3/node_modules/@embroider/legacy-inspector-support/src/modules-4-12.js"
+    ],
+    "css": [
+      "assets/main-et5OPj6E.css"
+    ]
+  },
+  "node_modules/.pnpm/@embroider+legacy-inspector-support@0.1.3/node_modules/@embroider/legacy-inspector-support/src/modules-4-12.js": {
+    "file": "assets/modules-4-12-BnbZfQQN.js",
+    "name": "modules-4-12",
+    "src": "node_modules/.pnpm/@embroider+legacy-inspector-support@0.1.3/node_modules/@embroider/legacy-inspector-support/src/modules-4-12.js",
+    "isDynamicEntry": true,
+    "imports": [
+      "index.html"
+    ]
+  }
+}

data/assets/stylesheets/main-et5OPj6E.css

@@ -0,0 +1 @@
+:root,:host{--fa-font-solid:normal 900 1em/1 "Font Awesome 7 Free";--fa-font-regular:normal 400 1em/1 "Font Awesome 7 Free";--fa-font-light:normal 300 1em/1 "Font Awesome 7 Pro";--fa-font-thin:normal 100 1em/1 "Font Awesome 7 Pro";--fa-font-duotone:normal 900 1em/1 "Font Awesome 7 Duotone";--fa-font-duotone-regular:normal 400 1em/1 "Font Awesome 7 Duotone";--fa-font-duotone-light:normal 300 1em/1 "Font Awesome 7 Duotone";--fa-font-duotone-thin:normal 100 1em/1 "Font Awesome 7 Duotone";--fa-font-brands:normal 400 1em/1 "Font Awesome 7 Brands";--fa-font-sharp-solid:normal 900 1em/1 "Font Awesome 7 Sharp";--fa-font-sharp-regular:normal 400 1em/1 "Font Awesome 7 Sharp";--fa-font-sharp-light:normal 300 1em/1 "Font Awesome 7 Sharp";--fa-font-sharp-thin:normal 100 1em/1 "Font Awesome 7 Sharp";--fa-font-sharp-duotone-solid:normal 900 1em/1 "Font Awesome 7 Sharp Duotone";--fa-font-sharp-duotone-regular:normal 400 1em/1 "Font Awesome 7 Sharp Duotone";--fa-font-sharp-duotone-light:normal 300 1em/1 "Font Awesome 7 Sharp Duotone";--fa-font-sharp-duotone-thin:normal 100 1em/1 "Font Awesome 7 Sharp Duotone";--fa-font-slab-regular:normal 400 1em/1 "Font Awesome 7 Slab";--fa-font-slab-press-regular:normal 400 1em/1 "Font Awesome 7 Slab Press";--fa-font-slab-duo-regular:normal 400 1em/1 "Font Awesome 7 Slab Duo";--fa-font-slab-press-duo-regular:normal 400 1em/1 "Font Awesome 7 Slab Press Duo";--fa-font-pixel-regular:normal 400 1em/1 "Font Awesome 7 Pixel";--fa-font-mosaic-solid:normal 900 1em/1 "Font Awesome 7 Mosaic";--fa-font-vellum-solid:normal 900 1em/1 "Font Awesome 7 Vellum";--fa-font-whiteboard-semibold:normal 600 1em/1 "Font Awesome 7 Whiteboard";--fa-font-thumbprint-light:normal 300 1em/1 "Font Awesome 7 Thumbprint";--fa-font-notdog-solid:normal 900 1em/1 "Font Awesome 7 Notdog";--fa-font-notdog-duo-solid:normal 900 1em/1 "Font Awesome 7 Notdog Duo";--fa-font-etch-solid:normal 900 1em/1 "Font Awesome 7 Etch";--fa-font-graphite-thin:normal 100 1em/1 "Font Awesome 7 Graphite";--fa-font-jelly-regular:normal 400 1em/1 "Font Awesome 7 Jelly";--fa-font-jelly-fill-regular:normal 400 1em/1 "Font Awesome 7 Jelly Fill";--fa-font-jelly-duo-regular:normal 400 1em/1 "Font Awesome 7 Jelly Duo";--fa-font-chisel-regular:normal 400 1em/1 "Font Awesome 7 Chisel";--fa-font-utility-semibold:normal 600 1em/1 "Font Awesome 7 Utility";--fa-font-utility-duo-semibold:normal 600 1em/1 "Font Awesome 7 Utility Duo";--fa-font-utility-fill-semibold:normal 600 1em/1 "Font Awesome 7 Utility Fill"}.svg-inline--fa{box-sizing:content-box;display:var(--fa-display,inline-block);vertical-align:-.125em;height:1em;width:var(--fa-width,1.25em);overflow:visible}.svg-inline--fa.fa-2xs{vertical-align:.1em}.svg-inline--fa.fa-xs{vertical-align:0}.svg-inline--fa.fa-sm{vertical-align:-.0714286em}.svg-inline--fa.fa-lg{vertical-align:-.2em}.svg-inline--fa.fa-xl{vertical-align:-.25em}.svg-inline--fa.fa-2xl{vertical-align:-.3125em}.svg-inline--fa.fa-pull-left,.svg-inline--fa .fa-pull-start{float:inline-start;margin-inline-end:var(--fa-pull-margin,.3em)}.svg-inline--fa.fa-pull-right,.svg-inline--fa .fa-pull-end{float:inline-end;margin-inline-start:var(--fa-pull-margin,.3em)}.svg-inline--fa.fa-li{width:var(--fa-li-width,2em);inset-block-start:.25em;inset-inline-start:calc(-1 * var(--fa-li-width,2em))}.fa-layers-counter,.fa-layers-text{text-align:center;display:inline-block;position:absolute}.fa-layers{text-align:center;vertical-align:-.125em;height:1em;width:var(--fa-width,1.25em);display:inline-block;position:relative}.fa-layers .svg-inline--fa{transform-origin:50%;margin:auto;position:absolute;inset:0}.fa-layers-text{transform-origin:50%;top:50%;left:50%;transform:translate(-50%,-50%)}.fa-layers-counter{background-color:var(--fa-counter-background-color,#ff253a);border-radius:var(--fa-counter-border-radius,1em);box-sizing:border-box;color:var(--fa-inverse,#fff);line-height:var(--fa-counter-line-height,1);max-width:var(--fa-counter-max-width,5em);min-width:var(--fa-counter-min-width,1.5em);padding:var(--fa-counter-padding,.25em .5em);right:var(--fa-right,0);text-overflow:ellipsis;top:var(--fa-top,0);transform:scale(var(--fa-counter-scale,.25));transform-origin:100% 0;overflow:hidden}.fa-layers-bottom-right{bottom:var(--fa-bottom,0);right:var(--fa-right,0);transform:scale(var(--fa-layers-scale,.25));transform-origin:100% 100%;top:auto}.fa-layers-bottom-left{bottom:var(--fa-bottom,0);left:var(--fa-left,0);transform:scale(var(--fa-layers-scale,.25));transform-origin:0 100%;top:auto;right:auto}.fa-layers-top-right{top:var(--fa-top,0);right:var(--fa-right,0);transform:scale(var(--fa-layers-scale,.25));transform-origin:100% 0}.fa-layers-top-left{left:var(--fa-left,0);right:auto;top:var(--fa-top,0);transform:scale(var(--fa-layers-scale,.25));transform-origin:0 0}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{vertical-align:.225em;font-size:.625em;line-height:.1em}.fa-xs{vertical-align:.125em;font-size:.75em;line-height:.0833333em}.fa-sm{vertical-align:.0535715em;font-size:.875em;line-height:.0714286em}.fa-lg{vertical-align:-.075em;font-size:1.25em;line-height:.05em}.fa-xl{vertical-align:-.125em;font-size:1.5em;line-height:.0416667em}.fa-2xl{vertical-align:-.1875em;font-size:2em;line-height:.03125em}.fa-width-auto{--fa-width:auto}.fa-fw,.fa-width-fixed{--fa-width:1.25em}.fa-canvas-square{margin-block-end:-.125em;padding-block:.125em}.fa-canvas-roomy{box-sizing:content-box;margin-block-end:-.25em;padding-block:.25em;padding-inline:.125em}.fa-ul{margin-inline-start:var(--fa-li-margin,2.5em);padding-inline-start:0;list-style-type:none}.fa-ul>li{position:relative}.fa-li{text-align:center;width:var(--fa-li-width,2em);line-height:inherit;position:absolute;inset-inline-start:calc(-1 * var(--fa-li-width,2em))}.fa-border{border-color:var(--fa-border-color,#eee);border-radius:var(--fa-border-radius,.1em);border-style:var(--fa-border-style,solid);border-width:var(--fa-border-width,.0625em);box-sizing:var(--fa-border-box-sizing,content-box);padding:var(--fa-border-padding,.1875em .25em)}.fa-pull-left,.fa-pull-start{float:inline-start;margin-inline-end:var(--fa-pull-margin,.3em)}.fa-pull-right,.fa-pull-end{float:inline-end;margin-inline-start:var(--fa-pull-margin,.3em)}.fa-beat{animation-name:fa-beat;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-bounce{animation-name:fa-bounce;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,cubic-bezier(.28, .84, .42, 1))}.fa-fade{animation-name:fa-fade;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-beat-fade{animation-name:fa-beat-fade;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-flip{animation-name:fa-flip;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1.5s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-flip-360{animation-name:fa-flip-360;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-shake{animation-name:fa-shake;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,.75s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-spin{animation-name:fa-spin;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,2s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,linear)}.fa-spin-reverse{--fa-animation-direction:reverse}.fa-pulse,.fa-spin-pulse{animation-name:fa-spin;animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,steps(8))}.fa-spin-snap{animation-name:fa-spin-snap;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,3s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,linear)}.fa-spin-snap-4{animation-name:fa-spin-snap-4;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,2.4s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,linear)}.fa-spin-snap-8{animation-name:fa-spin-snap-8;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,4s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,linear)}.fa-buzz{animation-name:fa-buzz;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,.6s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,linear)}.fa-wag{animation-name:fa-wag;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,.9s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-out);transform-origin:bottom}.fa-float{animation-name:fa-float;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,3s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-in-out);will-change:transform}.fa-swing{animation-name:fa-swing;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,1.2s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-out);transform-origin:top}.fa-jello{animation-name:fa-jello;animation-delay:var(--fa-animation-delay,0s);animation-direction:var(--fa-animation-direction,normal);animation-duration:var(--fa-animation-duration,.9s);animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-timing-function:var(--fa-animation-timing,ease-out)}@media (prefers-reduced-motion:reduce){.fa-beat,.fa-bounce,.fa-fade,.fa-beat-fade,.fa-flip,.fa-flip-360,.fa-pulse,.fa-shake,.fa-spin,.fa-spin-pulse,.fa-buzz,.fa-float,.fa-jello,.fa-spin-snap,.fa-spin-snap-4,.fa-spin-snap-8,.fa-swing,.fa-wag{transition:none!important;animation:none!important}}@keyframes fa-beat{0%{transform:scale(1)}25%{transform:scale(calc(1.25 * var(--fa-beat-scale,1.25)))}45%{transform:scale(calc(1.22 * var(--fa-beat-scale,1.22)))}65%{transform:scale(calc(1.25 * var(--fa-beat-scale,1.25)))}90%{transform:scale(1)}}@keyframes fa-bounce{0%{animation-timing-function:var(--fa-animation-timing);transform:scale(1)translateY(0)}14%{transform:scale(var(--fa-bounce-start-scale-x,1.06), var(--fa-bounce-start-scale-y,.94)) translateY(var(--fa-bounce-anticipation,3px));animation-timing-function:cubic-bezier(.33,0,.66,.33)}32%{transform:scale(var(--fa-bounce-jump-scale-x,.94), var(--fa-bounce-jump-scale-y,1.12)) translateY(calc(-1 * var(--fa-bounce-height,.5em)));animation-timing-function:cubic-bezier(.33,.66,.66,1)}52%{transform:scale(1, 1) translateY(calc(-1 * var(--fa-bounce-height,.5em) * 1.1));animation-timing-function:cubic-bezier(.5,0,1,.5)}70%{transform:scale(var(--fa-bounce-land-scale-x,1.06), var(--fa-bounce-land-scale-y,.92)) translateY(0);animation-timing-function:cubic-bezier(.33,.33,.66,1)}85%{transform:scale(.98, 1.04) translateY(calc(-2px * var(--fa-bounce-rebound,1)));animation-timing-function:cubic-bezier(.33,0,.66,1)}to{transform:scale(1)translateY(0)}}@keyframes fa-fade{0%{opacity:1;animation-timing-function:cubic-bezier(.2,0,.4,1);transform:scale(1)}40%{opacity:var(--fa-fade-opacity,.4);animation-timing-function:cubic-bezier(.4,0,.6,1);transform:scale(.98)}to{opacity:1;transform:scale(1)}}@keyframes fa-beat-fade{0%{opacity:var(--fa-beat-fade-opacity,.4);animation-timing-function:cubic-bezier(.2,0,.4,1);transform:scale(1)}25%{opacity:calc(var(--fa-beat-fade-opacity,.4) + .4);transform:scale(var(--fa-beat-fade-scale,1.28));animation-timing-function:cubic-bezier(.4,0,.6,1)}45%{opacity:1;transform:scale(var(--fa-beat-fade-scale,1.25));animation-timing-function:cubic-bezier(.4,0,.2,1)}65%{opacity:calc(var(--fa-beat-fade-opacity,.4) + .4);transform:scale(var(--fa-beat-fade-scale,1.28));animation-timing-function:cubic-bezier(.4,0,.6,1)}to{opacity:var(--fa-beat-fade-opacity,.4);transform:scale(1)}}@keyframes fa-flip{0%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), 0deg);animation-timing-function:cubic-bezier(.2,0,.4,1)}8%{transform:perspective(2em) scale(var(--fa-flip-anticipation-scale,.95)) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), 0deg);animation-timing-function:cubic-bezier(.33,0,.66,.33)}35%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), calc(var(--fa-flip-angle,-360deg) * .6));animation-timing-function:linear}65%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), calc(var(--fa-flip-angle,-360deg) * .5));animation-timing-function:cubic-bezier(.33,.66,.66,1)}92%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), calc(var(--fa-flip-angle,-360deg) * var(--fa-flip-overshoot,1.04)));animation-timing-function:cubic-bezier(.33,0,.66,1)}to{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), var(--fa-flip-angle,-360deg))}}@keyframes fa-flip-360{0%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), 0deg);animation-timing-function:cubic-bezier(.2,0,.4,1)}8%{transform:perspective(2em) scale(var(--fa-flip-anticipation-scale,.95)) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), 0deg);animation-timing-function:cubic-bezier(.33,0,.66,.33)}50%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), calc(var(--fa-flip-angle,-360deg) * .6));animation-timing-function:cubic-bezier(.33,.66,.66,1)}80%{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), calc(var(--fa-flip-angle,-360deg) * var(--fa-flip-overshoot,1.04)));animation-timing-function:cubic-bezier(.33,0,.66,1)}to{transform:perspective(2em) scale(1) rotate3d(var(--fa-flip-x,0), var(--fa-flip-y,1), var(--fa-flip-z,0), var(--fa-flip-angle,-360deg))}}@keyframes fa-shake{0%{animation-timing-function:cubic-bezier(.2,0,.8,1);transform:rotate(0)}8%{animation-timing-function:cubic-bezier(.3,0,.7,1);transform:rotate(35deg)translate(1px)}20%{animation-timing-function:cubic-bezier(.3,0,.7,1);transform:rotate(-22deg)translate(-1px)}35%{animation-timing-function:cubic-bezier(.3,0,.7,1);transform:rotate(15deg)translate(1px)}50%{animation-timing-function:cubic-bezier(.4,0,.6,1);transform:rotate(-9deg)}65%{animation-timing-function:cubic-bezier(.4,0,.6,1);transform:rotate(5deg)}78%{animation-timing-function:cubic-bezier(.4,0,.6,1);transform:rotate(-3deg)}90%{animation-timing-function:cubic-bezier(.4,0,.2,1);transform:rotate(1deg)}to{transform:rotate(0)}}@keyframes fa-spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}@keyframes fa-spin-snap{0%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(0)}12%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(60deg)}16.67%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(60deg)}28.67%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(120deg)}33.33%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(120deg)}45.33%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(180deg)}50%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(180deg)}62%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(240deg)}66.67%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(240deg)}78.67%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(300deg)}83.33%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(300deg)}95.33%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(360deg)}to{transform:rotate(360deg)}}@keyframes fa-spin-snap-4{0%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(0)}15%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(90deg)}25%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(90deg)}40%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(180deg)}50%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(180deg)}65%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(270deg)}75%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(270deg)}90%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(360deg)}to{transform:rotate(360deg)}}@keyframes fa-spin-snap-8{0%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(0)}9%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(45deg)}12.5%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(45deg)}21.5%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(90deg)}25%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(90deg)}34%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(135deg)}37.5%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(135deg)}46.5%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(180deg)}50%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(180deg)}59%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(225deg)}62.5%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(225deg)}71.5%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(270deg)}75%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(270deg)}84%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(315deg)}87.5%{animation-timing-function:cubic-bezier(0,0,.2,1);transform:rotate(315deg)}96.5%{animation-timing-function:cubic-bezier(.8,0,1,1);transform:rotate(360deg)}to{transform:rotate(360deg)}}@keyframes fa-buzz{0%{animation-timing-function:cubic-bezier(.1,0,.9,1);transform:translate(0)rotate(0)}5%{transform:translateX(var(--fa-buzz-distance,4px)) rotate(.5deg)}10%{transform:translateX(calc(-1 * var(--fa-buzz-distance,4px))) rotate(-.5deg)}15%{transform:translateX(var(--fa-buzz-distance,4px)) rotate(.3deg)}20%{transform:translateX(calc(-1 * var(--fa-buzz-distance,4px))) rotate(-.3deg)}25%{transform:translateX(calc(var(--fa-buzz-distance,4px) * .7)) rotate(.2deg)}30%{transform:translateX(calc(-1 * var(--fa-buzz-distance,4px) * .7)) rotate(-.2deg)}35%{transform:translateX(calc(var(--fa-buzz-distance,4px) * .4)) rotate(.1deg)}40%{transform:translate(0)rotate(0)}to{transform:translate(0)rotate(0)}}@keyframes fa-wag{0%{animation-timing-function:cubic-bezier(.2,0,.6,1);transform:rotate(0)}12%{transform:rotate(var(--fa-wag-angle,12deg));animation-timing-function:cubic-bezier(.4,0,.2,1)}24%{animation-timing-function:cubic-bezier(.2,0,.6,1);transform:rotate(2deg)}36%{transform:rotate(calc(var(--fa-wag-angle,12deg) * .85));animation-timing-function:cubic-bezier(.4,0,.2,1)}48%{animation-timing-function:cubic-bezier(.2,0,.6,1);transform:rotate(1deg)}58%{transform:rotate(calc(var(--fa-wag-angle,12deg) * .6));animation-timing-function:cubic-bezier(.4,0,.2,1)}68%{transform:rotate(0)}to{transform:rotate(0)}}@keyframes fa-float{0%{transform:translateY(0) translateX(0) rotate(0deg) scale(var(--fa-float-squash-x,1.02), var(--fa-float-squash-y,.98));animation-timing-function:cubic-bezier(.33,0,.66,.33)}15%{transform:translateY(calc(-.4 * var(--fa-float-height,6px))) translateX(var(--fa-float-drift,1px)) rotate(var(--fa-float-tilt,1deg)) scale(1, 1);animation-timing-function:cubic-bezier(.33,.66,.66,1)}35%{transform:translateY(calc(-1 * var(--fa-float-height,6px))) translateX(0) rotate(0deg) scale(var(--fa-float-stretch-x,.98), var(--fa-float-stretch-y,1.03));animation-timing-function:cubic-bezier(.5,0,.5,0)}50%{transform:translateY(calc(-.92 * var(--fa-float-height,6px))) translateX(calc(-.5 * var(--fa-float-drift,1px))) rotate(calc(-.5 * var(--fa-float-tilt,1deg))) scale(.995, 1.01);animation-timing-function:cubic-bezier(.33,0,.66,.33)}70%{transform:translateY(calc(-.3 * var(--fa-float-height,6px))) translateX(calc(-1 * var(--fa-float-drift,1px))) rotate(calc(-1 * var(--fa-float-tilt,1deg))) scale(1, 1);animation-timing-function:cubic-bezier(.33,.66,.66,1)}90%{transform:translateY(calc(.05 * var(--fa-float-height,6px))) translateX(0) rotate(0deg) scale(var(--fa-float-squash-x,1.02), var(--fa-float-squash-y,.98));animation-timing-function:cubic-bezier(.33,0,.66,1)}to{transform:translateY(0) translateX(0) rotate(0deg) scale(var(--fa-float-squash-x,1.02), var(--fa-float-squash-y,.98))}}@keyframes fa-swing{0%{animation-timing-function:cubic-bezier(.2,0,.8,1);transform:rotate(0)}8%{transform:rotate(var(--fa-swing-angle,22deg));animation-timing-function:cubic-bezier(.3,0,.7,1)}18%{transform:rotate(calc(-1 * var(--fa-swing-angle,22deg) * .85));animation-timing-function:cubic-bezier(.3,0,.7,1)}28%{transform:rotate(calc(var(--fa-swing-angle,22deg) * .65));animation-timing-function:cubic-bezier(.35,0,.65,1)}38%{transform:rotate(calc(-1 * var(--fa-swing-angle,22deg) * .45));animation-timing-function:cubic-bezier(.4,0,.6,1)}48%{transform:rotate(calc(var(--fa-swing-angle,22deg) * .25));animation-timing-function:cubic-bezier(.4,0,.6,1)}56%{transform:rotate(calc(-1 * var(--fa-swing-angle,22deg) * .1));animation-timing-function:cubic-bezier(.4,0,.6,1)}64%{transform:rotate(0)}to{transform:rotate(0)}}@keyframes fa-jello{0%{animation-timing-function:cubic-bezier(.2,0,.8,1);transform:scale(1)}12%{transform:scale(var(--fa-jello-scale-x,1.15), calc(2 - var(--fa-jello-scale-x,1.15)));animation-timing-function:cubic-bezier(.3,0,.7,1)}24%{transform:scale(calc(2 - var(--fa-jello-scale-y,1.12)), var(--fa-jello-scale-y,1.12));animation-timing-function:cubic-bezier(.3,0,.7,1)}36%{transform:scale(calc(1 + (var(--fa-jello-scale-x,1.15) - 1) * .5), calc(2 - (1 + (var(--fa-jello-scale-x,1.15) - 1) * .5)));animation-timing-function:cubic-bezier(.4,0,.6,1)}48%{transform:scale(calc(2 - (1 + (var(--fa-jello-scale-y,1.12) - 1) * .3)), calc(1 + (var(--fa-jello-scale-y,1.12) - 1) * .3));animation-timing-function:cubic-bezier(.4,0,.6,1)}58%{animation-timing-function:cubic-bezier(.4,0,.2,1);transform:scale(1.02,.98)}68%{transform:scale(1)}to{transform:scale(1)}}.fa-rotate-90{transform:rotate(90deg)}.fa-rotate-180{transform:rotate(180deg)}.fa-rotate-270{transform:rotate(270deg)}.fa-flip-horizontal{transform:scaleX(-1)}.fa-flip-vertical{transform:scaleY(-1)}.fa-flip-both,.fa-flip-horizontal.fa-flip-vertical{transform:scale(-1)}.fa-rotate-by{transform:rotate(var(--fa-rotate-angle,0))}.svg-inline--fa .fa-primary{fill:var(--fa-primary-color,currentColor);opacity:var(--fa-primary-opacity,1)}.svg-inline--fa .fa-secondary{fill:var(--fa-secondary-color,currentColor);opacity:var(--fa-secondary-opacity,.4)}.svg-inline--fa.fa-swap-opacity .fa-primary{opacity:var(--fa-secondary-opacity,.4)}.svg-inline--fa.fa-swap-opacity .fa-secondary{opacity:var(--fa-primary-opacity,1)}.svg-inline--fa mask .fa-primary,.svg-inline--fa mask .fa-secondary{fill:#000}.svg-inline--fa.fa-inverse{fill:var(--fa-inverse,#fff)}.fa-stack{vertical-align:middle;width:2.5em;height:2em;line-height:2em;display:inline-block;position:relative}.fa-inverse{color:var(--fa-inverse,#fff)}.svg-inline--fa.fa-stack-1x{--fa-width:1.25em;height:1em;width:var(--fa-width)}.svg-inline--fa.fa-stack-2x{--fa-width:2.5em;height:2em;width:var(--fa-width)}.fa-stack-1x,.fa-stack-2x{z-index:var(--fa-stack-z-index,auto);margin:auto;position:absolute;inset:0}body{font-family:Arial,Liberation Sans,DejaVu Sans,sans-serif;font-size:12px}body.mobile,body.mobile .message{font-size:14px}pre{font-family:Consolas,Monaco,Ubuntu Mono,monospace}table.env-table tbody tr td{vertical-align:top;border-top:none;height:18px;line-height:18px}table.env-table,table.env-table table{border-spacing:0;border-collapse:collapse}table.env-table td{padding-right:5px}tbody tr{width:98%}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.loading{border:4px solid #f3f3f3;border-top-color:#3498db;border-radius:50%;width:30px;height:30px;margin:40dvh auto;animation:1s linear infinite spin}.message-row-wrapper{width:inherit;display:flex}.message-row-wrapper .grouping-checkbox{margin:0}.message-row{width:inherit;display:flex}.message-row .severity,.message-row .protected{text-align:center;flex-grow:0;flex-shrink:0;width:25px;font-size:12px}.message-row div{border-top:.5px solid #e9e9e9;padding-top:1px;padding-bottom:1px;line-height:25px}.message-row .count{box-sizing:border-box;flex-grow:0;flex-shrink:0;width:30px;padding-right:4px;font-size:11px;font-weight:700}.message-row .message-body{white-space:nowrap;text-overflow:ellipsis;flex-grow:1;flex-shrink:1;font-size:13px;overflow:hidden}.message-row .time{color:#999;vertical-align:top;flex-grow:0;flex-shrink:0;padding-right:8px;font-size:12px}.message-row .count{text-align:right}.message-row:hover{cursor:pointer;background-color:#f8f8f8}.message-row.selected{background-color:#dfdfdf}.svg-inline--fa.fatal{color:#e00}.svg-inline--fa.error{color:#900}.svg-inline--fa.warning{color:#feb800}.debug{color:#777}.action-panel .search{vertical-align:middle;box-sizing:border-box;border:1px solid #ddd;padding:3px}#log-table .show-more{text-align:center;cursor:pointer;background-color:#ddd;height:30px;margin-top:8px;line-height:30px;text-decoration:none}#bottom-panel{z-index:2;background-color:#f1f1f1;height:300px;padding:0 8px 8px;position:fixed;bottom:0;left:0;right:0}#bottom-panel.full{background-color:inherit;height:90%;position:static}#bottom-panel.full>div{padding-bottom:40px}#bottom-panel.full .tabs{display:none}#bottom-panel.full .message-info{position:static}#bottom-panel.full .message-info .content{display:block;position:static}#bottom-panel.full .save,#bottom-panel.full .share{bottom:10px}#bottom-panel.full button.delete{display:none}#bottom-panel.full .message-actions button{margin-top:8px}@media (width<=382px){#bottom-panel.full .message-actions{height:73px}}@media (width>=383px){#bottom-panel.full .message-actions{height:40px}}#bottom-panel.full .message-actions{background-color:#eee;border-top:1px solid #dfdfdf;width:100%;padding-left:10px;position:fixed;bottom:0;left:0}.message-actions{margin-right:10px;position:absolute;bottom:5px;right:0}.message-actions button{margin-left:5px}.message-actions button.copied{color:#176b3a;background:#d5f5e3}.message-actions button.copy-failed{color:#9b1c1c;background:#fde2e2}.divider{cursor:row-resize;background-color:#fafafa;border-top:1px solid #ddd;border-bottom:1px solid #ddd;height:15px;position:fixed;bottom:310px;left:0;right:0}.divider div{background-color:#ccc;width:24px;height:1px;margin:auto;position:relative}.divider .line-1{top:5px}.divider .line-2{top:6px}.divider .line-3{top:7px}#top-panel{position:fixed;inset:0 0 320px;overflow:auto}#top-panel.with-top-menu{top:35px}#top-menu{z-index:900;width:100%;position:fixed;top:0;left:0}#back-to-site-panel{background-color:#f1f1f1;height:15px;padding:10px}.message-info{border-bottom:1px solid #ddd;position:absolute;top:0;left:0;right:0}#bottom-panel.group-view .message-info{top:43px}.nav-controls.group-nav{border-bottom:1px solid #ddd;position:absolute;left:0;right:0}.action-panel{font-weight:700;position:absolute;bottom:0;left:0;right:0}.action-panel input{margin:0}.action-panel .svg-inline--fa,input,label span{vertical-align:middle}.severity-filters label{margin-right:10px}.search-clear-all .clear{float:right;vertical-align:middle}#log-table{width:99%;margin:auto}.btn span{display:inline}.hidden{display:none}.message-info pre,.message-info .env-table{margin:5px 10px 10px;position:relative}#overlay{z-index:99999;cursor:row-resize;opacity:0;position:fixed;inset:0}.message-info .content{display:none;position:absolute;inset:0 0 35px;overflow:auto}.message-info .content.active{display:block}.tabs{border-top:1px solid #ddd;margin:0 0 5px;padding:0 0 0 10px;list-style-type:none;position:absolute;bottom:13px;left:0;right:0}.tabs li{float:left;margin:0;padding-right:5px;position:relative}.tabs a{color:#333;background-color:#e1e1e1;border:1px solid #ddd;border-top:none;border-bottom-right-radius:5px;border-bottom-left-radius:5px;padding:6px;text-decoration:none;position:relative;top:6px}.tabs a.active{background-color:#f1f1f1;border-top:1px solid #f1f1f1}.btn{text-align:center;cursor:pointer;color:#333;background-color:#ddd;border:none;margin:0;padding:5px 8px;font-size:1em;font-weight:400;line-height:0;text-decoration:none;transition:all .25s;display:inline-block}.btn:hover{color:#000;background-color:#ccc}.btn .svg-inline--fa{margin-right:7px}.btn:active{text-shadow:none}.btn.danger:hover{color:#eee;background-color:#c63c1b}.btn.ok{color:#fff;background-color:#3781dc}.btn.ok:hover{color:#fff;background-color:#286dc2}.search-clear-all .search,.search-clear-all .btn.clear{height:100%}.search-clear-all .btn.clear span{vertical-align:middle}.severity-filters label,.search-clear-all .search,.search-clear-all .btn.clear{align-self:center}.search-clear-all .footer-btns .settings{box-sizing:border-box;align-items:center;height:100%;display:inline-flex}.search-clear-all{justify-content:space-between;display:flex}.search-clear-all .search{flex-shrink:2;min-width:0}.footer-btns{gap:.7em;display:flex}@media (width>=871px){.severity-filters,.search-clear-all{height:100%}.severity-filters,.more-wrapping{display:flex}.severity-filters{float:left}.action-panel{box-sizing:border-box;height:45px;padding:10px}.message-info{bottom:45px}}@media (width<=870px){.severity-filters{padding:10px}.search-clear-all{padding:0 10px 10px}.action-panel{height:69px}.message-info{bottom:69px}}@media (width<=430px){.severity-filters{white-space:nowrap;overflow:scroll hidden}.more-wrapping:before,.more-wrapping:after{content:"";height:18px;position:absolute}.more-wrapping:before{background:linear-gradient(90deg,#f1f1f1 0%,#f1f1f100 100%);width:15px;margin-left:-10px}.more-wrapping:after{background:linear-gradient(270deg,#f1f1f1 0%,#f1f1f100 100%);width:23px;right:0}}.btn.no-text .svg-inline--fa{margin:0}.btn[disabled]{opacity:.5}.actions-menu{z-index:3;background:#fafafa;flex-direction:column;width:115px;padding:5px 5px 0;display:inline-flex;position:absolute;bottom:27px;right:45px;box-shadow:0 4px 14px #00000026}.actions-menu button{height:27px;margin:0 0 5px}.nav-controls{padding:10px}#bottom-panel:not(.full) .nav-controls.env-nav{position:-moz-sticky;position:-ms-sticky;position:-o-sticky;z-index:1;background:#f1f1f1;border-bottom:1px solid #ddd;position:sticky;top:0}.current-number{margin:0 7px}.recent-link,.expand-list{color:#00f;cursor:pointer;text-decoration:underline}.settings-page{max-width:1110px;margin-left:auto;margin-right:auto;padding:0 10px 70px;font-size:15px}.settings-header{align-items:center;margin-bottom:5px;display:flex}.settings-header .header-title{flex-grow:1}.settings-header .header-logo{width:50px;height:50px}.settings-section{padding-top:15px}.settings-section .section-title{margin-top:0}.settings-section .subsection-title{margin-bottom:10px}.settings-section .tip{color:gray;font-size:13px;font-style:italic}.settings-section .pattern-wrapper{height:33px;margin-top:10px;font-size:16px;display:flex}.settings-section .api-error{color:red;margin-top:5px;font-family:Consolas,Monaco,Ubuntu Mono,monospace}.pattern-wrapper .pattern-input{width:600px;font-family:Consolas,Monaco,Ubuntu Mono,monospace;font-size:inherit;box-sizing:border-box;vertical-align:middle;flex-grow:1;flex-shrink:1;height:100%;padding:5px 8px}.retro-checkbox .checkbox{margin:0}.retro-checkbox{margin-top:7px}.btn.new-pattern{height:100%;line-height:18px}.pattern-wrapper .shrink{text-align:center;box-sizing:border-box;vertical-align:middle;flex-grow:0;flex-shrink:0;width:40px;height:100%;margin-left:10px}.svg-inline--fa{opacity:.7}.pattern-wrapper .shrink.reset{background:unset;width:unset;margin-left:8px;padding:0}.grouping-patterns button.new-pattern{margin-top:10px}.grouping-pattern-dialog-overlay{z-index:100000;background:#00000080;justify-content:center;align-items:center;display:flex;position:fixed;inset:0}.grouping-pattern-dialog{background:#fff;border-radius:4px;min-width:600px;padding:20px;box-shadow:0 4px 16px #0000004d}.grouping-pattern-dialog h3{margin:0 0 8px;font-size:1em;font-weight:700}.grouping-pattern-dialog p{color:#555;margin:0 0 10px;font-size:.9em}.grouping-pattern-input{box-sizing:border-box;border:1px solid #ccc;border-radius:3px;width:100%;margin-bottom:14px;padding:8px;font-family:monospace;font-size:1.1em}.grouping-pattern-dialog .api-error{color:#c62828;white-space:pre-wrap;margin:0 0 14px}.grouping-pattern-dialog-buttons{justify-content:flex-end;gap:8px;display:flex}.grouping-pattern-dialog .btn{padding:12px}.backtrace-line .line-link{color:#9e9e9e;white-space:normal;margin-left:3px;text-decoration:none}@media (prefers-color-scheme:dark){body{color:#cecece;background:#181818}#bottom-panel{background:#181818}.message-row div{border-top-color:#404040}.message-row:hover{background:#262626}.message-row.selected{background:#303030}#log-table .show-more,.divider{background:#262626}.divider div{background:#707070}.divider,.tabs{border-top-color:#555}#bottom-panel:not(.full) .nav-controls.env-nav,.divider,.message-info,.nav-controls.group-nav{border-bottom-color:#555}.action-panel .search{background:#262626;border-color:#404040}.btn,.tabs a{color:#cecece}.tabs a{background:#323232;border-color:#404040}.tabs a.active{color:#f4f4f4;background:#555;border-color:#707070}.btn{background:#323232}#bottom-panel.full .message-actions{background:#181818;border-color:#555}#bottom-panel:not(.full) .nav-controls.env-nav{background:#181818}.recent-link,.expand-list{color:#44f}#back-to-site-panel{background-color:#181818}.grouping-pattern-dialog{color:#cecece;background:#262626}.grouping-pattern-dialog p{color:#aaa}.grouping-pattern-input{color:#cecece;background:#181818;border-color:#555}}

data/lib/logster/configuration.rb

@@ -5,6 +5,7 @@ module Logster
     attr_accessor(
       :allow_grouping,
       :application_version,
+      :authorize_request,
       :current_context,
       :env_expandable_keys,
       :enable_custom_patterns_via_ui,

data/lib/logster/middleware/reporter.rb

@@ -5,6 +5,12 @@ module Logster
     class Reporter
       PATH_INFO = "PATH_INFO"
       SCRIPT_NAME = "SCRIPT_NAME"
+      REQUEST_METHOD = "REQUEST_METHOD"
+      SECURITY_HEADERS = {
+        "cache-control" => "no-store",
+        "referrer-policy" => "no-referrer",
+        "x-content-type-options" => "nosniff",
+      }.freeze
 
       def initialize(app, config = {})
         @app = app
@@ -20,7 +26,11 @@ module Logster
         path = script_name + path if script_name && script_name.length > 0
 
         if path == @error_path
-          return 403, {}, ["Access Denied"] if !Logster.config.enable_js_error_reporting
+          if env[REQUEST_METHOD] != "POST"
+            return response(405, "Method not allowed", "allow" => "POST")
+          end
+          return response(403, "CSRF validation failed") unless valid_csrf_request?(env)
+          return response(403, "Access Denied") if !Logster.config.enable_js_error_reporting
 
           Logster
             .config
@@ -29,12 +39,12 @@ module Logster
               if Logster.config.rate_limit_error_reporting
                 req = Rack::Request.new(env)
                 if Logster.store.rate_limited?(req.ip, perform: true)
-                  return 429, {}, ["Rate Limited"]
+                  return response(429, "Rate Limited")
                 end
               end
               report_js_error(env)
             end
-          return 200, {}, ["OK"]
+          return response(200, "OK")
         end
 
         @app.call(env)
@@ -42,6 +52,27 @@ module Logster
         Thread.current[Logster::Logger::LOGSTER_ENV] = nil
       end
 
+      def response(status, body, headers = {})
+        [
+          status,
+          SECURITY_HEADERS.merge("content-type" => "text/plain; charset=utf-8").merge(headers),
+          [body],
+        ]
+      end
+
+      def valid_csrf_request?(env)
+        fetch_site = env["HTTP_SEC_FETCH_SITE"]
+        return false if fetch_site && !%w[same-origin same-site none].include?(fetch_site)
+
+        same_origin_fetch = fetch_site == "same-origin"
+        ajax_request = env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest"
+        return false unless same_origin_fetch || ajax_request
+        return true if same_origin_fetch
+
+        origin = env["HTTP_ORIGIN"]
+        !origin || origin == Rack::Request.new(env).base_url
+      end
+
       def report_js_error(env)
         req = Rack::Request.new(env)
 

data/lib/logster/middleware/viewer.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module Logster
   module Middleware
@@ -8,6 +9,39 @@ module Logster
       PATH_INFO = "PATH_INFO".freeze
       SCRIPT_NAME = "SCRIPT_NAME".freeze
       REQUEST_METHOD = "REQUEST_METHOD".freeze
+      ASSET_NAME = /\A[a-zA-Z0-9._-]+\z/
+      LEGACY_SCRIPTS = %w[vendor.js].freeze
+      LOGSTER_RESPONSE = "logster.response".freeze
+      STATIC_RESPONSE = "logster.static_response".freeze
+      DYNAMIC_SECURITY_HEADERS = {
+        "cache-control" => "no-store",
+        "referrer-policy" => "no-referrer",
+        "x-content-type-options" => "nosniff",
+        "x-frame-options" => "DENY",
+      }.freeze
+      STATIC_SECURITY_HEADERS = {
+        "cache-control" => "public, max-age=0, must-revalidate",
+        "referrer-policy" => "no-referrer",
+        "x-content-type-options" => "nosniff",
+      }.freeze
+      MESSAGE_ROUTE = %r{\A/message/([0-9a-f]+)\z}
+      PROTECT_ROUTE = %r{\A/protect/([0-9a-f]+)\z}
+      UNPROTECT_ROUTE = %r{\A/unprotect/([0-9a-f]+)\z}
+      SOLVE_ROUTE = %r{\A/solve/([0-9a-f]+)\z}
+      CLEAR_ROUTE = %r{\A/clear\z}
+      PATTERNS_ROUTE = %r{\A/patterns/([a-zA-Z0-9_]+)\.json\z}
+      RESET_COUNT_ROUTE = %r{\A/reset-count\.json\z}
+      SOLVE_GROUP_ROUTE = %r{\A/solve-group\z}
+      MUTATING_ROUTES = [
+        [MESSAGE_ROUTE, %w[DELETE]],
+        [PROTECT_ROUTE, %w[PUT]],
+        [UNPROTECT_ROUTE, %w[DELETE]],
+        [SOLVE_ROUTE, %w[PUT]],
+        [CLEAR_ROUTE, %w[POST]],
+        [PATTERNS_ROUTE, %w[POST PUT DELETE]],
+        [RESET_COUNT_ROUTE, %w[PUT]],
+        [SOLVE_GROUP_ROUTE, %w[POST]],
+      ].freeze
 
       def initialize(app)
         @app = app
@@ -21,60 +55,86 @@ module Logster
       end
 
       def call(env)
+        env.delete(LOGSTER_RESPONSE)
+        env.delete(STATIC_RESPONSE)
+        response = dispatch(env)
+        return response unless env.delete(LOGSTER_RESPONSE)
+
+        status, headers, body = response
+        security_headers =
+          env.delete(STATIC_RESPONSE) ? STATIC_SECURITY_HEADERS : DYNAMIC_SECURITY_HEADERS
+        [status, security_headers.merge(headers), body]
+      end
+
+      def dispatch(env)
         path = env[PATH_INFO]
         script_name = env[SCRIPT_NAME]
 
         path = script_name + path if script_name && script_name.length > 0
 
         if resource = resolve_path(path)
-          if resource =~
-               /\.ico$|\.js$|\.png|\.handlebars$|\.css$|\.woff$|\.ttf$|\.woff2$|\.svg$|\.otf$|\.eot$/
+          env[LOGSTER_RESPONSE] = true
+
+          if (authorize_request = Logster.config.authorize_request) && !authorize_request.call(env)
+            return not_allowed("Not authorized")
+          end
+
+          return not_found if parent_directory_segment?(resource)
+
+          if allowed_methods = allowed_methods_for(resource)
+            if !allowed_methods.include?(env[REQUEST_METHOD])
+              return method_not_allowed(allowed_methods)
+            end
+            return not_allowed("CSRF validation failed") unless valid_csrf_request?(env)
+          end
+
+          if resource =~ %r{\A/(?:.*\.(?:ico|js|png|handlebars|css|woff|ttf|woff2|svg|otf|eot))\z}
             serve_file(env, resource)
-          elsif resource.start_with?("/messages.json") && env[REQUEST_METHOD] == "POST"
+          elsif resource == "/messages.json" && env[REQUEST_METHOD] == "POST"
             serve_messages(Rack::Request.new(env))
-          elsif resource =~ %r{/message/([0-9a-f]+)$}
+          elsif (route_match = MESSAGE_ROUTE.match(resource))
             return method_not_allowed("DELETE") if env[REQUEST_METHOD] != "DELETE"
 
-            key = $1
+            key = route_match[1]
             message = Logster.store.get(key)
             return 404, {}, ["Message not found"] unless message
 
             Logster.store.delete(message)
-            [301, { "Location" => "#{@logs_path}/" }, []]
-          elsif resource =~ %r{/(un)?protect/([0-9a-f]+)$}
-            off = $1 == "un"
-            key = $2
+            [303, { "location" => "#{@logs_path}/" }, []]
+          elsif (route_match = PROTECT_ROUTE.match(resource) || UNPROTECT_ROUTE.match(resource))
+            off = resource.start_with?("/unprotect/")
+            key = route_match[1]
 
             message = Logster.store.get(key)
             return 404, {}, ["Message not found"] unless message
 
             if off
               if Logster.store.unprotect(key)
-                [301, { "Location" => "#{@logs_path}/show/#{key}?protected=false" }, []]
+                [303, { "location" => "#{@logs_path}/show/#{key}?protected=false" }, []]
               else
                 [500, {}, ["Failed"]]
               end
             else
               if Logster.store.protect(key)
-                [301, { "Location" => "#{@logs_path}/show/#{key}?protected=true" }, []]
+                [303, { "location" => "#{@logs_path}/show/#{key}?protected=true" }, []]
               else
                 [500, {}, ["Failed"]]
               end
             end
-          elsif resource =~ %r{/solve/([0-9a-f]+)$}
-            key = $1
+          elsif (route_match = SOLVE_ROUTE.match(resource))
+            key = route_match[1]
 
             message = Logster.store.get(key)
             return 404, {}, ["Message not found"] unless message
 
             Logster.store.solve(key)
 
-            [301, { "Location" => "#{@logs_path}" }, []]
-          elsif resource =~ %r{/clear$}
+            [303, { "location" => "#{@logs_path}" }, []]
+          elsif CLEAR_ROUTE.match?(resource)
             return method_not_allowed("POST") if env[REQUEST_METHOD] != "POST"
             Logster.store.clear
             [200, {}, ["Messages cleared"]]
-          elsif resource =~ %r{/show/([0-9a-f]+)(\.json)?$}
+          elsif resource =~ %r{\A/show/([0-9a-f]+)(\.json)?\z}
             key = $1
             json = $2 == ".json"
 
@@ -87,7 +147,7 @@ module Logster
               preload = { "/show/#{key}" => message }
               js_app(preload)
             end
-          elsif resource =~ %r{/settings(\.json)?$}
+          elsif resource =~ %r{\A/settings(\.json)?\z}
             json = $1 == ".json"
             if json
               ignore_count = Logster.store.get_all_ignore_count
@@ -116,7 +176,7 @@ module Logster
             else
               js_app
             end
-          elsif resource =~ %r{/patterns/([a-zA-Z0-9_]+)\.json$}
+          elsif (route_match = PATTERNS_ROUTE.match(resource))
             unless Logster.config.enable_custom_patterns_via_ui
               return(
                 not_allowed(
@@ -125,12 +185,12 @@ module Logster
               )
             end
 
-            set_name = $1
+            set_name = route_match[1]
             req = Rack::Request.new(env)
             return method_not_allowed(%w[POST PUT DELETE]) if req.request_method == "GET"
 
             update_patterns(set_name, req)
-          elsif resource == "/reset-count.json"
+          elsif RESET_COUNT_ROUTE.match?(resource)
             req = Rack::Request.new(env)
             return method_not_allowed("PUT") if req.request_method != "PUT"
             pattern = nil
@@ -152,7 +212,7 @@ module Logster
             [200, {}, ["OK"]]
           elsif resource == "/"
             js_app
-          elsif resource =~ %r{/fetch-env/([0-9a-f]+)\.json$}
+          elsif resource =~ %r{\A/fetch-env/([0-9a-f]+)\.json\z}
             key = $1
             env = Logster.store.get_env(key)
             if env
@@ -160,7 +220,7 @@ module Logster
             else
               not_found
             end
-          elsif resource == "/solve-group"
+          elsif SOLVE_GROUP_ROUTE.match?(resource)
             return not_allowed unless Logster.config.enable_custom_patterns_via_ui
             req = Rack::Request.new(env)
             return method_not_allowed("POST") if req.request_method != "POST"
@@ -185,7 +245,30 @@ module Logster
 
       protected
 
+      def parent_directory_segment?(resource)
+        Rack::Utils.unescape_path(resource).split("/").include?("..")
+      rescue ArgumentError
+        true
+      end
+
+      def allowed_methods_for(resource)
+        route = MUTATING_ROUTES.find { |pattern, _| pattern.match?(resource) }
+        route&.last
+      end
+
+      def valid_csrf_request?(env)
+        return false unless env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest"
+
+        fetch_site = env["HTTP_SEC_FETCH_SITE"]
+        return false if fetch_site && !%w[same-origin same-site none].include?(fetch_site)
+        return true if fetch_site == "same-origin"
+
+        origin = env["HTTP_ORIGIN"]
+        !origin || origin == Rack::Request.new(env).base_url
+      end
+
       def serve_file(env, path)
+        env[STATIC_RESPONSE] = true
         env[PATH_INFO] = path
         # accl redirect is going to be trouble, ensure its bypassed
         env["sendfile.type"] = ""
@@ -307,6 +390,93 @@ module Logster
         "<script src='#{@logs_path}/javascript/#{name}' nonce='#{csp_nonce}'></script>"
       end
 
+      def module_script(name, csp_nonce)
+        "<script type='module' src='#{@logs_path}/javascript/#{name}' nonce='#{csp_nonce}'></script>"
+      end
+
+      def modulepreload(name, csp_nonce)
+        "<link rel='modulepreload' href='#{@logs_path}/javascript/#{name}' nonce='#{csp_nonce}'>"
+      end
+
+      # Vite's own build manifest, plus the application config the build emits
+      # alongside it.
+      def asset_manifest
+        @asset_manifest ||=
+          begin
+            vite = JSON.parse(read_asset("manifest.json"))
+            entry = vite.values.find { |chunk| chunk.is_a?(Hash) && chunk["isEntry"] }
+            raise KeyError, "the Vite build emitted no entry chunk" unless entry
+
+            validate_asset_manifest(
+              "scripts" => plain_scripts,
+              "module" => asset_basename(entry.fetch("file")),
+              "modulepreload" => preloaded_chunks(vite, entry),
+              "stylesheets" => Array(entry["css"]).map { |href| asset_basename(href) },
+              "config" => JSON.parse(read_asset("logster-config.json")),
+            )
+          rescue JSON::ParserError, KeyError, TypeError, Errno::ENOENT => error
+            raise RuntimeError, "Logster asset manifest is invalid: #{error.message}"
+          end
+      end
+
+      def read_asset(name)
+        path = File.join(@assets_path, name)
+        unless File.file?(path)
+          raise RuntimeError,
+                "Logster asset manifest is missing; rebuild the gem with ./build_client_app.sh"
+        end
+        File.read(path)
+      end
+
+      def asset_basename(path)
+        File.basename(path.to_s)
+      end
+
+      # classicEmberSupport emits this to set EmberENV before the deferred
+      # module entry runs. It is absent once the app no longer needs the shim.
+      def plain_scripts
+        LEGACY_SCRIPTS.select { |name| File.file?(File.join(@assets_path, "javascript", name)) }
+      end
+
+      # Every chunk the entry pulls in eagerly, once each, in discovery order.
+      def preloaded_chunks(vite, chunk, names = [], seen = {})
+        Array(chunk["imports"]).each do |key|
+          next if seen[key]
+          seen[key] = true
+
+          imported = vite[key]
+          raise KeyError, "the Vite manifest is missing chunk #{key}" unless imported
+
+          names << asset_basename(imported.fetch("file"))
+          preloaded_chunks(vite, imported, names, seen)
+        end
+        names
+      end
+
+      def validate_asset_manifest(manifest)
+        %w[modulepreload stylesheets].each do |type|
+          names = manifest.fetch(type)
+          unless names.is_a?(Array) && names.all? { |name| ASSET_NAME.match?(name.to_s) }
+            raise JSON::ParserError, "Invalid #{type} asset manifest"
+          end
+        end
+        unless ASSET_NAME.match?(manifest.fetch("module").to_s)
+          raise JSON::ParserError, "Invalid module asset manifest"
+        end
+        unless manifest["config"].is_a?(Hash)
+          raise JSON::ParserError, "Invalid client application config"
+        end
+
+        manifest
+      end
+
+      def encoded_client_app_config
+        config = JSON.parse(JSON.generate(asset_manifest.fetch("config")))
+        config["environment"] = "production"
+        config["rootURL"] = "#{@logs_path}/"
+        Rack::Utils.escape_html(URI.encode_uri_component(JSON.generate(config)))
+      end
+
       def to_json_and_escape(payload)
         Rack::Utils.escape_html(JSON.generate(payload))
       end
@@ -344,8 +514,14 @@ module Logster
       def js_app(preload = {})
         csp_nonce = SecureRandom.hex
         preload = preloaded_data.merge(preload)
-        root_url = @logs_path
-        root_url += "/" if root_url[-1] != "/"
+        manifest = asset_manifest
+        stylesheets = manifest.fetch("stylesheets").map { |name| css(name, csp_nonce) }.join("\n")
+        javascript = [
+          # The plain scripts set up EmberENV, so they run before the module entry.
+          *manifest.fetch("scripts").map { |name| script(name, csp_nonce) },
+          *manifest.fetch("modulepreload").map { |name| modulepreload(name, csp_nonce) },
+          module_script(manifest.fetch("module"), csp_nonce),
+        ].join("\n")
         body = <<~HTML
           <!doctype html>
           <html>
@@ -353,18 +529,14 @@ module Logster
               <link rel="shortcut icon" href="#{@logs_path}/images/icon_64x64.png">
               <link rel="apple-touch-icon" href="#{@logs_path}/images/icon_144x144.png" />
               <title>#{Logster.config.web_title || "Logs"}</title>
-              <link href='//fonts.googleapis.com/css?family=Roboto' rel='stylesheet' type='text/css' nonce='#{csp_nonce}'>
-              <link href='//fonts.googleapis.com/css?family=Roboto+Mono' rel='stylesheet' type='text/css' nonce='#{csp_nonce}'>
               <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=yes">
               <meta name="color-scheme" content="dark light">
-              #{css("vendor.css", csp_nonce)}
-              #{css("client-app.css", csp_nonce)}
-              #{script("vendor.js", csp_nonce)}
+              #{stylesheets}
               <meta id="preloaded-data" data-root-path="#{@logs_path}" data-preloaded="#{to_json_and_escape(preload)}">
-              <meta name="client-app/config/environment" content="%7B%22modulePrefix%22%3A%22client-app%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22#{root_url}%22%2C%22locationType%22%3A%22history%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_DEFAULT_ASYNC_OBSERVERS%22%3Atrue%2C%22_JQUERY_INTEGRATION%22%3Afalse%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22name%22%3A%22client-app%22%2C%22version%22%3A%220.0.0%2B7a424002%22%7D%2C%22exportApplicationGlobal%22%3Afalse%7D" />
+              <meta name="client-app/config/environment" content="#{encoded_client_app_config}" />
             </head>
             <body>
-              #{script("client-app.js", csp_nonce)}
+              #{javascript}
             </body>
           </html>
         HTML
@@ -374,7 +546,7 @@ module Logster
           {
             "content-type" => "text/html; charset=utf-8",
             "content-security-policy" =>
-              "script-src 'nonce-#{csp_nonce}'; style-src 'nonce-#{csp_nonce}'; object-src 'none'; base-uri 'none';",
+              "default-src 'none'; script-src 'nonce-#{csp_nonce}' 'strict-dynamic'; style-src 'self' 'nonce-#{csp_nonce}'; font-src 'self'; img-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self';",
           },
           [body],
         ]

data/lib/logster/rails/railtie.rb

@@ -25,13 +25,7 @@ module Logster::Rails
       logger.level = ::Rails.logger.level
 
       Logster.logger = config.logger = logger
-
-      if rails_71?
-        ::Rails.logger.broadcast_to(logger)
-      else
-        logger.chain(::Rails.logger)
-        ::Rails.logger = logger
-      end
+      ::Rails.logger.broadcast_to(logger)
     end
 
     def initialize!(app)
@@ -42,14 +36,9 @@ module Logster::Rails
         app.middleware.insert_before ActionDispatch::ShowExceptions, Logster::Middleware::Reporter
       end
 
-      if Rails::VERSION::MAJOR == 3
-        app.middleware.insert_before ActionDispatch::DebugExceptions,
-                                     Logster::Middleware::DebugExceptions
-      else
-        app.middleware.insert_before ActionDispatch::DebugExceptions,
-                                     Logster::Middleware::DebugExceptions,
-                                     Rails.application
-      end
+      app.middleware.insert_before ActionDispatch::DebugExceptions,
+                                   Logster::Middleware::DebugExceptions,
+                                   Rails.application
 
       app.middleware.delete ActionDispatch::DebugExceptions
       app.config.colorize_logging = false
@@ -63,13 +52,8 @@ module Logster::Rails
     private
 
     def logster_enabled?
-      return ::Rails.logger == Logster.logger unless rails_71?
       ::Rails.logger.broadcasts.include?(Logster.logger)
     end
-
-    def rails_71?
-      ::Rails.version >= "7.1"
-    end
   end
 
   class Railtie < ::Rails::Railtie

data/lib/logster/redis_store.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require "json"
-# Disable rubocop because the require is only redundant for Ruby 3.2+ but we still support Ruby 3.1
-require "set" # rubocop:disable Lint/RedundantRequireStatement
 require "logster/base_store"
 require "logster/redis_rate_limiter"
 

data/lib/logster/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Logster
-  VERSION = "2.21.0"
+  VERSION = "3.0.1"
 end

data/lib/logster.rb

@@ -57,4 +57,4 @@ end
 # check logster/configuration.rb for config options
 # Logster.config.environments << :staging
 
-require "logster/rails/railtie" if defined?(::Rails::VERSION) && ::Rails::VERSION::MAJOR.to_i >= 3
+require "logster/rails/railtie" if defined?(::Rails::VERSION)