timothy
fba5233caf
PR Gates / CI image pin matches docker/ci (pull_request) Successful in 11s
PR Gates / Docs update reminder (pull_request) Successful in 16s
PR Gates / decisions lifecycle (pull_request) Failing after 23s
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 1m17s
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 1m29s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 8m5s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 16m5s
Build ErsatzTV Image / Functional E2E (curl + UI contracts) (pull_request) Successful in 17m6s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
168 records -> docs/decisions/records/<area>/<topic>.md (163 active, 23 dirs) and docs/decisions/archive/<area>/<topic>.md (5 archived). The filename IS the key, so one-active-record-per-key becomes a filesystem property rather than a validator check, and supersession becomes a `git mv`. WHY: the monolith was a concurrency problem before an aesthetic one. A 3,900-line append target made parallel sessions collide -- PR #605 and PR #614 both hit append-vs-append conflicts during routine rebases, and hand-resolving those inside the corpus is exactly the operation the rationale-rewrite guard exists to police. HOW IT IS VERIFIED: a ~170-file diff cannot be meaningfully read, so correctness does not rest on reading it. The parser was taught BOTH formats first, so the body-diff guard parses the old form at the merge-base and the new form at head -- the migration validates itself, no bypass. The proof is a field-level equivalence harness: 168 records before and after, zero lost, zero gained, zero field mismatches, zero rationale bodies differing. Reviewers should scrutinise the harness; it is the actual evidence. What measuring caught that reading would not have: - ~500 lines sit OUTSIDE any record -- decisions.md's lifecycle schema and each topic file's preamble, mostly the only copy. Source files are kept and stripped, never deleted. They also cannot be filed per-area: topic files hold several areas and 4 of 23 areas span several files. - Archive discovery was a non-recursive glob; after the split it found ZERO archived records, surfacing as four bogus "supersedes points to unknown key" errors rather than an obvious failure. - ~32 live docs point into the corpus BY DATE, which the split dangles. Each stripped file now ends with a generated "Records formerly in this file" index, which also rescues the identical breadcrumbs in old issue comments. - decisions.md's "In this file:" list was 97 same-file anchor bullets that the split makes WRONG, not merely stale. Dropped; the generated index replaces them with links that resolve. The equivalence harness now runs against a checked-in FIXTURE, not the live corpus. The earlier version migrated the real tree, which made it a one-shot: the moment the migration landed there was nothing left to move and the tests failed for reasons unrelated to the code. A fixture keeps them testing the SCRIPT rather than the repo's current state. Keys preserved verbatim, warts included: `sched` (12) and `scheduling` (1) remain two directories for one concept. Renaming a key is not a move -- it changes identity, breaks the equivalence proof, and invalidates MemPalace's per-key drawers. Taxonomy normalisation is separate work. refs #610
3.5 KiB
3.5 KiB
key, title, status, since, supersedes, superseded-by, rule, signals, mechanics
| key | title | status | since | supersedes | superseded-by | rule | signals | mechanics |
|---|---|---|---|---|---|---|---|---|
| security.csp-permissions-policy | 2026-07-12 — Enforcing CSP + Permissions-Policy on the host (#319, ZAP baseline) | active | 2026-07-12 | none | none | `SecurityHeadersMiddleware` sends an enforcing (not report-only) `Content-Security-Policy` (no `unsafe-inline`/`unsafe-eval`; the one inline theme-bootstrap script allow-listed by hash) and a deny-all `Permissions-Policy` on the SPA/`/api`/`/artwork`/`/iptv`; `/docs` and `/openapi` keep only the baseline headers, excluded from CSP because Scalar needs inline bootstrap. | enforcing CSP, script-src hash allowlist, Permissions-Policy · paths: `ErsatzTV/Middleware/SecurityHeadersMiddleware`, `SecurityHeadersMiddlewareTests` · issues: #319, #314, #197, #279 | `SecurityHeadersMiddlewareTests.Csp_Script_Hash_Should_Match_The_Spa_Index` |
Completes the CSP that the #279 baseline-headers entry deferred ("CSP must be validated against the ChicoryTV
SPA's inline assets"). Surfaced by the #314 out-of-ecosystem ZAP baseline (missing CSP/Permissions-Policy WARNs);
a #197 exit item. SecurityHeadersMiddleware now also sets Permissions-Policy (deny-all for
camera/microphone/geolocation/payment/usb) and an enforcing Content-Security-Policy.
- Enforce, not report-only. Report-only was the issue's acceptable fallback, but the SPA's asset graph is
small and fully knowable, so we ship an enforcing policy (report-only leaves the ZAP WARN and provides no real
protection). The policy:
default-src 'self';script-src 'self' '<sha256 of the inline theme-bootstrap script>'(no'unsafe-inline'/'unsafe-eval'— the real XSS win);style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: blob:;font-src 'self' data: https://fonts.gstatic.com;connect-src 'self';object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self'. - Why each relaxation. The SPA is a static file, so a per-response nonce is impossible → the one inline
theme-bootstrap
<script>is allow-listed by hash;SecurityHeadersMiddlewareTests.Csp_Script_Hash_Should_ Match_The_Spa_Indexhashes the builtwwwroot/app/index.htmlwhen present (else the committedweb/index.htmlsource, since the built artifact is gitignored/absent in CI — Vite copies the inline script verbatim) and fails if it drifts from the middleware constant.style-src 'unsafe-inline'covers React's inlinestyle=""attributes (no CSS-in-JS lib to hash). The Google Fonts hosts are required — the SPA CSS@imports the Geist web font (caught by live-E2E, which the static grep missed); self-hosting the font to drop the Google dependency is a follow-on hardening, not this issue.img-src data: blob:covers favicon/generated-image data URIs and object-URL upload previews. - Scoped:
/docs(Scalar) and/openapiare excluded. The Scalar API-reference UI relies on inline bootstrap scripts/styles a strict CSP would break; it keeps the baseline headers (nosniff/frame/referrer) but no CSP. Hardening that admin surface (self-hosted Scalar or a Scalar-tuned CSP) is a #197 follow-up. Everything else — SPA,/api,/artwork,/iptv— gets the CSP (non-HTML responses simply never exercise the script/style directives). Verified by live-E2E (SPA renders clean, zero CSP violations) + curl (CSP present on/app//api, absent on/docs//openapi). HSTS remains out (proxy/TLS decision). Refs #319 #314 #197.