dev_agentandClaude Opus 5.5 5519676c79 Restrict apiFetch to same-origin /api/v1/ and lint colours in the build ...

apiFetch now refuses any path that does not resolve to a same-origin URL
under /api/v1/ before attaching X-MealQuest-CSRF or calling fetch, so the
cached CSRF token cannot be sent to another origin or another path.
npm run build runs lint:colors first, so a hex literal outside tokens.css
fails the production build.

Maestro task: f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-04 08:52:44 -04:00

..

scripts

Feature 05 task 1: Design tokens and self-hosted fonts (#32)

2026-10-03 16:16:25 -04:00

src

Restrict apiFetch to same-origin /api/v1/ and lint colours in the build

2026-10-04 08:52:44 -04:00

index.html

Feature 01 task 2: Vite React TypeScript web skeleton (#3)

2026-10-02 22:26:34 -04:00

package-lock.json

Photo and Icon components (#37)

2026-10-03 18:29:16 -04:00

package.json

Restrict apiFetch to same-origin /api/v1/ and lint colours in the build

2026-10-04 08:52:44 -04:00

tsconfig.json

Feature 01 task 2: Vite React TypeScript web skeleton (#3)

2026-10-02 22:26:34 -04:00

vite.config.ts

Feature 05 task 2: Core UI primitives (#34)

2026-10-03 16:34:59 -04:00