tina4-nodejs 3.13.142 → 3.13.144
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +28 -2
- package/package.json +1 -1
- package/packages/cli/dist/bin.js +379 -85
- package/packages/cli/src/commands/generate.ts +7 -2
- package/packages/cli/src/commands/init.ts +18 -8
- package/packages/core/dist/index.js +377 -78
- package/packages/core/gallery/auth/src/routes/gallery/auth/get.ts +27 -11
- package/packages/core/gallery/queue/src/routes/gallery/queue/get.ts +20 -7
- package/packages/core/gallery/templates/src/templates/gallery_page.twig +34 -15
- package/packages/core/src/csp.ts +138 -0
- package/packages/core/src/errorOverlay.ts +80 -37
- package/packages/core/src/index.ts +10 -0
- package/packages/core/src/middleware.ts +20 -6
- package/packages/core/src/response.ts +14 -3
- package/packages/core/src/server.ts +52 -15
- package/packages/core/src/session.ts +154 -7
- package/packages/core/src/sso.ts +1 -1
- package/packages/core/src/types.ts +8 -0
- package/packages/core/templates/errors/302.twig +1 -1
- package/packages/core/templates/errors/401.twig +2 -2
- package/packages/core/templates/errors/403.twig +1 -1
- package/packages/core/templates/errors/404.twig +1 -1
- package/packages/core/templates/errors/500.twig +1 -1
- package/packages/core/templates/errors/502.twig +2 -2
- package/packages/core/templates/errors/503.twig +2 -2
- package/packages/core/templates/errors/base.twig +4 -1
- package/packages/frond/dist/index.js +2 -0
- package/packages/frond/src/engine.ts +23 -0
- package/packages/orm/dist/index.js +378 -87
- package/packages/swagger/dist/index.js +4 -4
- package/packages/swagger/src/ui.ts +7 -4
- package/types/core/src/csp.d.ts +42 -0
- package/types/core/src/index.d.ts +1 -0
- package/types/core/src/middleware.d.ts +6 -0
- package/types/core/src/session.d.ts +62 -2
- package/types/core/src/types.d.ts +8 -0
- package/types/frond/src/engine.d.ts +7 -0
|
@@ -1850,7 +1850,11 @@ export default async function (req: Tina4Request, res: Tina4Response) {
|
|
|
1850
1850
|
`{% extends "base.twig" %}
|
|
1851
1851
|
{% block title %}Login{% endblock %}
|
|
1852
1852
|
{% block content %}
|
|
1853
|
-
|
|
1853
|
+
{# No inline style attribute: a nonce lets this <style> block run under the
|
|
1854
|
+
strict default Content-Security-Policy. csp_nonce() is a built-in Frond global
|
|
1855
|
+
that returns this response's nonce (ADR-0088). #}
|
|
1856
|
+
<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
|
|
1857
|
+
<div class="container mt-4 auth-form">
|
|
1854
1858
|
<h1>Login</h1>
|
|
1855
1859
|
<form method="post" action="/api/auth/login">
|
|
1856
1860
|
{{ form_token() }}
|
|
@@ -1876,7 +1880,8 @@ export default async function (req: Tina4Request, res: Tina4Response) {
|
|
|
1876
1880
|
`{% extends "base.twig" %}
|
|
1877
1881
|
{% block title %}Register{% endblock %}
|
|
1878
1882
|
{% block content %}
|
|
1879
|
-
<
|
|
1883
|
+
<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
|
|
1884
|
+
<div class="container mt-4 auth-form">
|
|
1880
1885
|
<h1>Register</h1>
|
|
1881
1886
|
<form method="post" action="/api/auth/register">
|
|
1882
1887
|
{{ form_token() }}
|
|
@@ -211,20 +211,30 @@ export default async function (req: Tina4Request, res: Tina4Response): Promise<v
|
|
|
211
211
|
`
|
|
212
212
|
);
|
|
213
213
|
|
|
214
|
-
// Static index
|
|
214
|
+
// Static index stylesheet. A static file cannot carry a per-response CSP
|
|
215
|
+
// nonce (ADR-0088), so its styles live in an external same-origin stylesheet
|
|
216
|
+
// the strict default policy ('self') already allows — not an inline <style>,
|
|
217
|
+
// which the browser would refuse, leaving a fresh project unstyled.
|
|
218
|
+
writeFileSync(
|
|
219
|
+
join(targetDir, "public/style.css"),
|
|
220
|
+
`body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
|
|
221
|
+
h1 { font-size: 2.5em; margin-bottom: 0.2em; }
|
|
222
|
+
p { color: #666; font-size: 1.1em; }
|
|
223
|
+
code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
|
|
224
|
+
a { color: #2563eb; }
|
|
225
|
+
`
|
|
226
|
+
);
|
|
227
|
+
|
|
228
|
+
// Static index page. CSP-clean: an external stylesheet, no inline <style>.
|
|
229
|
+
// For a page that needs an inline block, render it through a Frond template
|
|
230
|
+
// and stamp the nonce: <style nonce="{{ csp_nonce() }}">...</style>.
|
|
215
231
|
writeFileSync(
|
|
216
232
|
join(targetDir, "public/index.html"),
|
|
217
233
|
`<!DOCTYPE html>
|
|
218
234
|
<html>
|
|
219
235
|
<head>
|
|
220
236
|
<title>Tina4</title>
|
|
221
|
-
<style>
|
|
222
|
-
body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
|
|
223
|
-
h1 { font-size: 2.5em; margin-bottom: 0.2em; }
|
|
224
|
-
p { color: #666; font-size: 1.1em; }
|
|
225
|
-
code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
|
|
226
|
-
a { color: #2563eb; }
|
|
227
|
-
</style>
|
|
237
|
+
<link rel="stylesheet" href="/style.css">
|
|
228
238
|
</head>
|
|
229
239
|
<body>
|
|
230
240
|
<h1>tina4</h1>
|