Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
43 Commits 201 Branches 0 Tags
cf598a84054fa0c0f4f5805f74f4f36628b92780
Commit Graph
10 Commits
Author SHA1 Message Date
dev_agentandClaude Opus 5.5 cf598a8405 Validate API paths against the page origin, not a placeholder
Independent review Codex gpt-6-sol high: APPROVED (0 findings)
Details
CI / ci (push) Successful in 1m33s
Details
CI / ci (pull_request) Successful in 1m33s
Details 
The guard resolved paths against a fixed placeholder origin, so
//same-origin.invalid/api/v1/me passed and fetch sent the CSRF token to
that host. apiFetch now resolves against location.origin, refuses
anything off that origin or outside /api/v1/, and fetches the validated
path-absolute URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-04 08:59:51 -04:00
dev_agentandClaude Opus 5.5 5519676c79 Restrict apiFetch to same-origin /api/v1/ and lint colours in the build
CI / ci (push) Successful in 1m33s
Details
CI / ci (pull_request) Successful in 1m33s
Details 
apiFetch now refuses any path that does not resolve to a same-origin URL
under /api/v1/ before attaching X-MealQuest-CSRF or calling fetch, so the
cached CSRF token cannot be sent to another origin or another path.
npm run build runs lint:colors first, so a hex literal outside tokens.css
fails the production build.

Maestro task: f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-04 08:52:44 -04:00
dev_agent 048d5dd71a API client, auth bootstrap and job polling (#42)
CI / ci (push) Successful in 1m32s
Details
CI / ci (pull_request) Successful in 1m33s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-04 08:46:40 -04:00
dev_agent c899f07b1f Nav pill slide animation (#39)
CI / ci (push) Successful in 1m29s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 18:52:57 -04:00
dev_agent 998658b42c Responsive app shell, routes and navigation (#38)
CI / ci (push) Successful in 1m30s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 18:40:34 -04:00
dev_agent a453a84231 Photo and Icon components (#37)
CI / ci (push) Successful in 1m30s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 18:29:16 -04:00
dev_agent 732aa92a8c Sheet, ErrorBanner, Skeleton and EmptyState (#36)
CI / ci (push) Successful in 1m30s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 18:22:59 -04:00
dev_agent 02f1dd6491 Feature 05 task 2: Core UI primitives (#34)
CI / ci (push) Successful in 1m31s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 16:34:59 -04:00
dev_agent 496f2e5375 Feature 05 task 1: Design tokens and self-hosted fonts (#32)
CI / ci (push) Successful in 1m29s
Details 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-03 16:16:25 -04:00
dev_agent f0b2696059 Feature 01 task 2: Vite React TypeScript web skeleton (#3) 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
 2026-10-02 22:26:34 -04:00