Archive/screentinker
1
0
Fork 0
mirror of https://github.com/screentinker/screentinker.git synced 2026-08-13 22:03:13 -06:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity
screentinker/server
History
Fabian Mendoza 90b8cbb1e6
Some checks are pending
CI / Unit tests (node --test) (push) Waiting to run
Details
CI / OpenAPI spec lint (push) Waiting to run
Details
CI / Android unit tests (Kotlin schedule evaluator vectors) (push) Waiting to run
Details
CI / Boot smoke + version check (push) Waiting to run
Details
fix(preview): server-side preview sessions to bypass CSP (#151) 
* fix(preview): replace srcdoc with server-side preview sessions to bypass CSP

Widget previews (clock, weather, etc.) were rendered via iframe.srcdoc,
which inherits the dashboard CSP script-src 'self'. This blocked the inline
scripts widgets need (setInterval for clock, fetch for weather), causing
previews to show blank/static content.

Replace srcdoc with ephemeral server-side preview sessions:
- POST /api/widgets/preview-session — stores rendered HTML (Map, 5min TTL)
- GET  /api/widgets/preview-session/:id — serves the HTML via iframe src,
  bypassing CSP like the device render endpoint already does

The old /api/widgets/preview endpoint is unchanged for backward compat.

* fix(preview): add rate limiter for /preview-session route

---------

Co-authored-by: BlazzzPlay <fabianma7@gmail.com>
2026-07-09 15:39:07 -05:00
..
config PiP overlay MVP: push image/web overlays to a device or group (#109) (#127) 2026-06-18 14:54:44 -05:00
db feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player 2026-07-08 15:32:40 -05:00
lib fix(ota): treat legacy -patchN as a released version so the old fleet is offered updates 2026-07-08 23:21:26 -05:00
middleware feat(#146): billing:read scoped token — dual-path auth for the Usage Report (Option C) 2026-07-01 21:16:21 -05:00
player feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player 2026-07-08 15:32:40 -05:00
routes fix(preview): server-side preview sessions to bypass CSP (#151) 2026-07-09 15:39:07 -05:00
scripts feat(scheduling): per-item schedule blocks (#74 dayparting, #75 auto-expire) 2026-06-11 15:46:41 -05:00
services feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player 2026-07-08 15:32:40 -05:00
test fix(ota): treat legacy -patchN as a released version so the old fleet is offered updates 2026-07-08 23:21:26 -05:00
ws feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player 2026-07-08 15:32:40 -05:00
.gitignore feat(email): Microsoft Graph send + alert spam protection + preferences UI 2026-05-12 18:16:40 -05:00
config.js fix(db): WAL checkpointer worker-death handling (respawn + inline-autocheckpoint fallback) 2026-07-06 23:50:18 -05:00
package-lock.json chore(release): v1.9.3 2026-07-08 17:23:08 -05:00
package.json chore(release): v1.9.3 2026-07-08 17:23:08 -05:00
server.js fix(preview): server-side preview sessions to bypass CSP (#151) 2026-07-09 15:39:07 -05:00
version.js chore(version): single-source VERSION, env-configurable data paths, bump tooling 2026-06-10 12:56:03 -05:00