SnapOtter e358634f8b fix: production CSP blocking PostHog/Sentry/Scalar and silent failure hardening ...

The production CSP had connect-src/script-src/font-src set to 'self' only,
silently blocking all analytics and error reporting in production while
working fine in dev (where CSP is not applied).

CSP fixes:
- Add PostHog ingest + assets origins to connect-src and script-src
- Add Sentry ingest origin to connect-src
- Add Scalar fonts origin to font-src for API docs pages
- Extract CSP construction into testable buildCsp() function

Silent failure hardening:
- Settings/features stores now set loadError flag and allow retry on
  subsequent fetch() calls instead of permanently caching failed state
- Analytics init no longer sets initialized=true before the try block,
  allowing retry on failure
- Settings dialog Tools section disables save button when settings
  failed to load, preventing accidental config wipe
- Branding logo storage moved from process.cwd() to FILES_STORAGE_PATH
  so logos persist across Docker container recreation

Test coverage:
- 16 CSP directive tests covering all external service domains
- Store retry-on-error behavior tests for settings and features stores
- Analytics init retry-after-failure test

2026-05-05 17:16:19 +08:00

..

drizzle

fix: add statement-breakpoint separators to analytics migration

2026-04-22 19:15:38 +08:00

src

fix: production CSP blocking PostHog/Sentry/Scalar and silent failure hardening

2026-05-05 17:16:19 +08:00

drizzle.config.ts

chore: deploy to Cloudflare Pages and update branding

2026-04-24 18:06:29 +08:00

package.json

chore: deploy to Cloudflare Pages and update branding

2026-04-24 18:06:29 +08:00

tsconfig.json

feat: add Fastify API server with health check and env config

2026-03-22 02:46:34 +08:00