TRX/Checkmate
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,584 Commits 70 Branches 35 Tags
bd13e9d9c801965a7d5c057cb6f34dfc2c117994
Commit Graph
14 Commits
Author SHA1 Message Date
Alexander Holliday 552b7a037d Merge pull request #3743 from bluewave-labs/feat/helm 
feat: Update helm charts
 2026-07-02 10:13:28 -07:00
Alex Holliday c0e33eb4fa skip general rate limiter on dev mode 2026-06-30 09:08:20 -07:00
Arnaud GRIMBERT 969d24e369 Merge branch 'develop' into feat/customcss-status-page 2026-06-24 20:27:57 +02:00
Buco7854 a4cc322a55 feat: apply status page CSP to custom domains 
Detect custom domains by comparing the request host to the app host and apply
the tightened CSP there too, not just on the public path. Run the middleware
before express.static so static-served root documents get the header, and keep
helmet after static so its default-src does not block custom domain API calls.
 2026-06-24 18:21:16 +00:00
Alex Holliday 74783fd738 clean up logger 2026-06-24 10:53:03 -07:00
Buco7854 ffbf223288 feat: tighten CSP on the public status page document 
Layer a stricter Content-Security-Policy on the /status/public document so
custom CSS cannot load external images, fonts, or stylesheets. Browsers
enforce the intersection of all CSP headers, so this only narrows the public
status page and never loosens the global policy, while keeping the app's
Google Fonts. Browser-enforced backstop behind the validator.
 2026-06-23 19:25:40 +00:00
Ian Troisi 517139cbf4 fix: cache negative custom domain CORS lookups 
Use a shorter TTL for rejected origins so unknown domains do not hit
the database on every cross-origin request.
 2026-06-11 14:48:31 -04:00
Ian Troisi ef049b6521 fix: resolve CORS TypeScript error and format server files 
Type defaultCorsOptions as CorsOptions so allowedHeaders is compatible
with the cors middleware. Format files from develop merge for CI.
 2026-06-11 13:55:10 -04:00
Ian Troisi 33f8641f3a Merge branch 'develop' into feat/status-page-custom-domain 2026-06-11 13:54:27 -04:00
Alex Holliday 091c36cbf3 create upload middleware 2026-06-11 10:40:59 -07:00
Ian Troisi 120708ed47 perf: cache custom domain CORS origin lookups 
Avoid hitting the database on every cross-origin request by caching
published custom domain checks for five minutes.
 2026-06-11 13:15:02 -04:00
Ian Troisi 6a1ab622b3 fix: scope custom domain CORS to public status page routes 
Only allow registered custom domain origins on public GET/OPTIONS status
page API routes instead of the entire application API surface.
 2026-06-11 13:15:02 -04:00
Ian Troisi a37bc63f31 Merge branch 'develop' into feat/status-page-custom-domain 
Resolve conflicts from server reorganization while preserving custom
domain support for published status pages.
 2026-06-10 10:55:59 -04:00
Alex Holliday d022f7d849 reorg to domain and api 2026-06-09 12:34:15 -07:00