Keep the CSRF token on same-origin API calls and lint colours in the build #45

2026-10-04T08:54:59-04:00

dev_agent commented

2026-10-04 08:54:59 -04:00

Task f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5. Integration fix for Feature 05 review of PR #43. apiFetch rejects non-GET URLs that are not same-origin /api/v1/ before attaching the CSRF header. npm run build runs lint:colors. Head 5519676c79.

Task f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5. Integration fix for Feature 05 review of PR #43. apiFetch rejects non-GET URLs that are not same-origin /api/v1/ before attaching the CSRF header. npm run build runs lint:colors. Head 5519676c792acaba2b3bcca1e520389705a0f932.

dev_agent added 1 commit 2026-10-04 08:55:00 -04:00

Restrict apiFetch to same-origin /api/v1/ and lint colours in the build

CI / ci (push) Successful in 1m33s

Details

CI / ci (pull_request) Successful in 1m33s

Details

5519676c79

apiFetch now refuses any path that does not resolve to a same-origin URL
under /api/v1/ before attaching X-MealQuest-CSRF or calling fetch, so the
cached CSRF token cannot be sent to another origin or another path.
npm run build runs lint:colors first, so a hex literal outside tokens.css
fails the production build.

Maestro task: f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev_agent added 1 commit 2026-10-04 09:02:25 -04:00

Validate API paths against the page origin, not a placeholder

Independent review Codex gpt-6-sol high: APPROVED (0 findings)

Details

CI / ci (push) Successful in 1m33s

Details

CI / ci (pull_request) Successful in 1m33s

Details

cf598a8405

The guard resolved paths against a fixed placeholder origin, so
//same-origin.invalid/api/v1/me passed and fetch sent the CSRF token to
that host. apiFetch now resolves against location.origin, refuses
anything off that origin or outside /api/v1/, and fetches the validated
path-absolute URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-04 09:05:11 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: cf598a84054fa0c0f4f5805f74f4f36628b92780

{
  "verdict": "APPROVED",
  "reviewed_sha": "cf598a84054fa0c0f4f5805f74f4f36628b92780",
  "summary": "The client rejects external URLs and paths that escape /api/v1/ before calling fetch, while relative API paths and header-free GET requests remain covered by tests. The build script invokes lint:colors, and lint:colors passed. Typecheck, tests, and build could not be run because web/node_modules is absent.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `cf598a84054fa0c0f4f5805f74f4f36628b92780` ```json { "verdict": "APPROVED", "reviewed_sha": "cf598a84054fa0c0f4f5805f74f4f36628b92780", "summary": "The client rejects external URLs and paths that escape /api/v1/ before calling fetch, while relative API paths and header-free GET requests remain covered by tests. The build script invokes lint:colors, and lint:colors passed. Typecheck, tests, and build could not be run because web/node_modules is absent.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit 5758f198e4 into feature/64e5bb19-c9a2-4c6a-8f0c-aceae43fb732-frontend-foundation

2026-10-04 09:08:44 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#45

Keep the CSRF token on same-origin API calls and lint colours in the build #45

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high