cloud/music_library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,499 Commits 1 Branch 0 Tags
46da8eea384a0c72c20135301f775f9ef6b77456
Commit Graph

2499 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Claudio Ortolina 46da8eea38 EXP: fix CSP issues for /dev routes 2026-03-07 21:07:24 +00:00
Claudio Ortolina 41480316c2 Fix CSP settings 
⏺ Here's a breakdown of each directive:

  ┌─────────────────┬────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  │    Directive    │                     Value                      │                                                         Purpose                                                         │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ default-src     │ 'self'                                         │ Fallback for any resource type not explicitly listed — only allow from the app's own origin                             │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ script-src      │ 'self'                                         │ JavaScript can only be loaded from the app's origin (no external scripts, no inline)                                    │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ style-src       │ 'self' 'unsafe-inline' https://rsms.me         │ Stylesheets from the app's origin, inline styles (needed by LiveView), and the https://rsms.me/inter/ hosted on rsms.me │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ font-src        │ 'self' https://rsms.me                         │ Font files from the app's origin and rsms.me (Inter font)                                                               │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ img-src         │ 'self' data: https://lastfm.freetls.fastly.net │ Images from the app's origin, data: URIs (inline base64 images), and Last.fm's CDN for album/artist artwork             │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ connect-src     │ 'self'                                         │ XHR/fetch/WebSocket connections only to the app's origin (covers LiveView's WebSocket)                                  │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ frame-ancestors │ 'self'                                         │ The app can only be embedded in iframes by itself (clickjacking protection)                                             │
  ├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ base-uri        │ 'self'                                         │ Restricts <base> tag to the app's origin (prevents base tag injection attacks)                                          │
  └─────────────────┴────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

  Notable things not allowed by this policy:
  - No inline <script> tags or eval()
  - No external JavaScript from CDNs
  - No embedding in third-party iframes
  - No connections to external APIs from the browser (all external API calls go through the server)
 2026-03-07 19:13:48 +00:00
Claudio Ortolina 3938cbaf54 Run sobelow on CI 2026-03-07 19:09:02 +00:00
Claudio Ortolina 52815bde2f When doing markdown to HTML, sanitize HTML 
Closes #101
Closes #102
 2026-03-07 19:05:37 +00:00
Claudio Ortolina 84ffcc720b Run sobelow in skip mode 2026-03-07 18:57:18 +00:00
Claudio Ortolina 4a25e5742b Try and get Claude to skip the Co-Authored-By mention 2026-03-07 18:55:05 +00:00
Claudio Ortolina 3812b6c402 Add Content-Security-Policy header 
Closes #100
 2026-03-07 18:53:52 +00:00
Claudio Ortolina d3e1ecd10b Remove Sobelow TODOs 2026-03-07 18:39:38 +00:00
Claudio Ortolina 2e3732e38b Apply all necessary exclusions to sobelow findings 2026-03-07 18:37:24 +00:00
Claudio Ortolina c87f946479 Skip Sobelow Traversal.SendDownload warning for archive controller 2026-03-07 18:21:57 +00:00
Claudio Ortolina 2b09611fe9 Mark TODOs to change secrets in base configuration 2026-03-07 18:17:27 +00:00
Claudio Ortolina 27e5f68fbb Skip Sobelow XSS.ContentType warning for asset controller 2026-03-07 18:16:50 +00:00
Claudio Ortolina 72ab206135 Start configuring sobelow 2026-03-07 18:15:57 +00:00
Claudio Ortolina 041455bf9d Update dependencies 
telemetry 1.3.0 => 1.4.0
 2026-03-07 17:53:45 +00:00
Claudio Ortolina 1d6e51f89f Add sobelow 2026-03-07 10:13:17 +00:00
Claudio Ortolina 4ddcb3ec5c Add benchmark for rendering record set list 2026-03-07 10:00:37 +00:00
Claudio Ortolina b917585231 Tweak instructions on generated commit messages 2026-03-07 09:23:08 +00:00
Claudio Ortolina f75485e5db Small optimizations to speed up the test suite 
Shaves off 1 second on M1
 2026-03-07 09:13:02 +00:00
Claudio Ortolina 6a89d31d4c Don't extract dominant colors if provided in params 
This as the side effect of massively speeding up the test suite: on M1,
it goes from 24 seconds to 14.
 2026-03-07 09:05:44 +00:00
Claudio Ortolina bc3c933b28 Update dependencies 
sourceror 1.11.0 => 1.12.0
 2026-03-07 08:30:51 +00:00
Claudio Ortolina 5a86989df1 Add '/blog/wp-includes/wlwmanifest.xml' to blocked paths 2026-03-07 07:13:57 +00:00
Claudio Ortolina 97f4267c5e Add telemetry for Markdown rendering 2026-03-06 20:27:58 +00:00
Claudio Ortolina effcc3966c Fix id in record set show page 2026-03-06 20:20:48 +00:00
Claudio Ortolina c9ee94bd4a Key record set item ids during rendering 
Makes live render faster by 20%
 2026-03-06 20:02:58 +00:00
Claudio Ortolina baf10fda0d Update dependencies 
rewrite 1.2.0 => 1.3.0
 2026-03-06 17:03:22 +00:00
Claudio Ortolina 436274a8ef Extract internal record set card component 2026-03-06 17:02:19 +00:00
Claudio Ortolina 518a4e9623 Remove finch req duration by normalized path metric 
Too noisy
 2026-03-06 15:27:13 +00:00
Claudio Ortolina 1063c43a65 Revert "Remove finch req duration by path metric" 
This reverts commit c1e4024095.
 2026-03-06 15:26:36 +00:00
Claudio Ortolina 0d7ed39b4c Extend tracked metrics 2026-03-06 15:19:47 +00:00
Claudio Ortolina c1e4024095 Remove finch req duration by path metric 
Paths are too many and too long
 2026-03-06 15:06:39 +00:00
Claudio Ortolina 63e44518a3 Order blocked paths alphabetically 2026-03-06 15:01:53 +00:00
Claudio Ortolina 34717a618a Add two more blocked routes 2026-03-06 15:00:29 +00:00
Claudio Ortolina e6b1e89067 Update architecture docs 2026-03-06 13:22:59 +00:00
Claudio Ortolina 05afcc7732 Make sure tags are part of the telemetry storage key 2026-03-06 12:40:22 +00:00
Claudio Ortolina a23f772c04 Re-enable Credo CyclomaticComplexity check 2026-03-06 10:08:25 +00:00
Claudio Ortolina d3ae3a7381 Fix ScrobbleRule timestamps to use utc_datetime 2026-03-06 09:58:40 +00:00
Claudio Ortolina 54f19cd9a2 Fix ArtistInfo.country/1 crash when area is missing 2026-03-06 09:51:56 +00:00
Claudio Ortolina 6c2036ff7d Make excluded genres configurable 2026-03-06 09:45:42 +00:00
Claudio Ortolina f9b381570f Extract artist infos fixtures 2026-03-06 08:58:59 +00:00
Claudio Ortolina 3819afca4d Extract fixture 2026-03-06 08:53:25 +00:00
Claudio Ortolina 7cf9b4e7f8 First pass at uniformed types, specs and docs 
- spec public functions (skipping controllers, views, live views and
components)
- use types instead of explanations in docs
- remove redundant docs
- fix typos
 2026-03-06 08:33:11 +00:00
Claudio Ortolina 99e30d5fdf Send the records on this day email at 7am 2026-03-06 08:05:36 +00:00
Claudio Ortolina c3cb510892 Convert phoenix_test assertions to simplified syntax 2026-03-06 06:41:06 +00:00
Claudio Ortolina 348d062822 Update dependencies 
fluxon 2.3.3 => 2.3.4
phoenix_test 0.9.1 => 0.10.0 (minor)
spitfire 0.3.9 => 0.3.10
 2026-03-06 06:33:41 +00:00
Claudio Ortolina 06aaa35628 Increase buffer size for Telemetry Storage 2026-03-05 22:55:09 +00:00
Claudio Ortolina a3ccc06d14 Extract shared SQL builder for scrobble rules 2026-03-05 20:52:25 +00:00
Claudio Ortolina d738032f8a Add string length validations to user-input schemas 2026-03-05 20:42:44 +00:00
Claudio Ortolina 70392857fa Add project convention around co-authoring in commit messages 2026-03-05 20:33:54 +00:00
Claudio Ortolina 08f7565d44 Replace inspect(reason) with friendly error messages 
Closes #81
 2026-03-05 20:25:13 +00:00
Claudio Ortolina e8f393c5a0 Guard against nil medium in scrobble_medium 
Closes #76
 2026-03-05 19:54:32 +00:00