a084ba86c5
Two items surfaced by the branch re-review: CSP regression (blocking): script-src 'self' blocked the template-authored anti-FOUC theme script in app.html — SvelteKit's mode:'auto' only hashes scripts it injects. Added nonce="%sveltekit.nonce%" so it's substituted per request and included in the CSP (survives future edits, unlike a pinned hash). Verified: emitted CSP nonce matches the script tag; no violation, no flash. feed_delta silent truncation: the LIMIT 200 (added earlier to kill the stale-`since` DoS) returned only the newest slice with no signal, so a client that missed 200+ uploads during a reconnect could not tell it should full- refresh — the older missed uploads were dropped and unrecoverable (the next delta advances `since` past them). DeltaResponse now carries `truncated`; the feed's feed-delta handler calls loadFeed(true) to resync from page 1 instead of merging a partial slice. Verified: cargo check clean, svelte-check 0 errors, production build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
2.0 KiB
HTML
43 lines
2.0 KiB
HTML
<!doctype html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<!-- viewport-fit=cover activates the env(safe-area-inset-*) padding used by the
|
|
bottom nav, sheets, toasts and FAB on notched / home-indicator devices. -->
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
|
|
<meta name="text-scale" content="scale" />
|
|
<!-- Light/dark theme-color so the browser chrome matches the active theme. -->
|
|
<meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
|
|
<meta name="theme-color" content="#030712" media="(prefers-color-scheme: dark)" />
|
|
<!-- Installable PWA keepsake: manifest + Apple home-screen metadata. -->
|
|
<link rel="manifest" href="%sveltekit.assets%/manifest.webmanifest" />
|
|
<link rel="icon" href="%sveltekit.assets%/icon.svg" type="image/svg+xml" />
|
|
<link rel="apple-touch-icon" href="%sveltekit.assets%/icon.svg" />
|
|
<meta name="apple-mobile-web-app-capable" content="yes" />
|
|
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
|
|
<meta name="apple-mobile-web-app-title" content="EventSnap" />
|
|
<!--
|
|
FOUC guard: apply the dark class *before* paint, so reloads of pages with
|
|
theme=dark don't flash a white screen. Mirrors the logic in
|
|
`src/lib/theme-store.ts`; kept in sync by hand (it's 6 lines).
|
|
-->
|
|
<!-- nonce is required: our CSP sets script-src 'self', and SvelteKit's
|
|
mode:'auto' only hashes scripts *it* injects, not this template-authored
|
|
one. %sveltekit.nonce% is substituted per request and added to the CSP. -->
|
|
<script nonce="%sveltekit.nonce%">
|
|
(function () {
|
|
try {
|
|
var pref = localStorage.getItem('eventsnap_theme') || 'system';
|
|
var dark = pref === 'dark' ||
|
|
(pref === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches);
|
|
if (dark) document.documentElement.classList.add('dark');
|
|
} catch (_) {}
|
|
})();
|
|
</script>
|
|
%sveltekit.head%
|
|
</head>
|
|
<body data-sveltekit-preload-data="hover">
|
|
<div style="display: contents">%sveltekit.body%</div>
|
|
</body>
|
|
</html>
|