Marc-André Bombeck 4543fa7192 Let the app CSP frame and render its own blob previews ...

Since the record fence, vault previews load through object URLs: the
detail sheet frames a decrypted PDF from a blob: URL and thumbnails
render from blob: images. The app CSP carried no frame-src, so the PDF
iframe fell through to default-src 'self' and was blocked outright,
while img-src 'self' data: silently degraded every thumbnail to its
fallback icon.

Add frame-src 'self' blob: and extend img-src with blob: in both the
dev and prod policies. This admits exactly the app's own documents: a
blob: URL is mintable only by same-origin script, script execution
stays nonce-bound in production, and object-src 'none', frame-ancestors
'none' and default-src 'self' are untouched. The vault serve route
keeps its stricter document CSP. A unit test pins the directives so a
future CSP edit cannot silently regress the previews.

Refs #787

2026-08-13 12:08:59 +02:00

..

api

feat(analytics): replace health score with reference composite

2026-07-28 21:10:15 +02:00

helpers

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

account-payload-consumer-guard.test.ts

fix(ui): close the holes the audit found in this work's own guards

2026-08-07 23:20:39 +02:00

acting-account-boundary-guard.test.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

admin-data-wipe-completeness.test.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

ai-consent-enforcement-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

ai-gateway-csp-unchanged.test.ts

test(ai): pin the gateway provider's isolation and host policy

2026-07-26 22:27:48 +02:00

backup-plan-classification.test.ts

fix(02-11): protect guardian egress data lifecycle

2026-08-06 14:05:59 +02:00

bearer-scope-enforcement-guard.test.ts

Scope the idempotency replay cell to the record a request claims

2026-08-03 10:18:27 +02:00

coach-stream-lifecycle-guard.test.ts

coach: reopen an interrupted conversation with a visible retry

2026-08-13 06:16:45 +02:00

copy-matches-behaviour-guard.test.ts

feat(mood): show the day's own rating beside what the account's days imply

2026-08-08 11:43:58 +02:00

customize-shortcut-guard.test.ts

Close the delegated-access gaps the release audit left open

2026-08-04 14:55:32 +02:00

cycle-verdict-guard-defeat.test.ts

Prove the verdict reaches a client and that nothing recomputes it

2026-08-01 10:45:24 +02:00

cycle-verdict-single-decider-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

daily-reads-refetch-guard.test.ts

Refetch the inactive daily reads after a quick-add intake

2026-08-13 09:14:55 +02:00

data-wipe-completeness.test.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

derived-response-consumer-guard.test.ts

test(api): guard response field consumers

2026-07-28 21:05:42 +02:00

destructive-control-guard.test.ts

settings: move the About-me note and free-text allergies into the Anamnese

2026-08-13 06:16:45 +02:00

display-transform-rounding-guard.test.ts

fix: complete dashboard hydration

2026-08-05 23:03:17 +02:00

doctor-report-control-gating-guard.test.ts

feat(doctor-report): put emergency data on page one

2026-08-10 05:32:59 +02:00

dynamic-key-exhaustiveness.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

e2e-measurement-gating-guard.test.ts

test(e2e): gate every measurement on its element, and keep it that way

2026-07-26 22:04:58 +02:00

e2e-route-cleanup-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

e2e-shared-session-guard.test.ts

test(e2e): give the account-switching journey its own session

2026-08-02 16:49:47 +02:00

encounter-reminder-exclusion.test.ts

feat(vaccinations): add the immunization record and its document link

2026-08-08 13:35:03 +02:00

external-id-stability-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

guardian-notification-payloads.test.ts

feat(02-11): secure guardian notification delivery

2026-08-06 05:44:41 +02:00

guardian-notification-policy.test.ts

feat: add guardian notification fanout

2026-08-06 05:23:38 +02:00

i18n-call-site-coverage.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-drift-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-english-leak-guard.test.ts

feat(vaccinations): name the catalogue in six locales

2026-08-08 21:24:00 +02:00

i18n-reference-matcher.test.ts

fix(i18n): stop one key template from whitelisting a whole namespace

2026-07-25 16:23:58 +02:00

i18n-reverse-coverage.test.ts

feat(mood): capture the five values without lengthening the quick check-in

2026-08-08 01:24:04 +02:00

insights-unit-literal-guard.test.ts

fix(quality): close backup and localization guard gaps

2026-07-28 12:03:02 +02:00

intake-toast-single-decision.test.ts

Close the delegated-access gaps the release audit left open

2026-08-04 14:55:32 +02:00

integration-failure-response-consumer-guard.test.ts

test(api): guard response field consumers

2026-07-28 21:05:42 +02:00

inventory-write-isolation.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

manage-activity-inventory.test.ts

fix: close two gaps the last audit round left open

2026-08-07 02:26:29 +02:00

managed-profile-contract.test.ts

docs: publish the last-Guardian refusal where it is actually raised

2026-08-07 05:43:06 +02:00

managed-record-navigation.test.tsx

fix: close four small gaps around the record surface

2026-08-07 01:00:02 +02:00

measurement-backup-completeness.test.ts

fix(insights): scope generation guard to prompt fields, clear cache on restore

2026-07-28 21:11:43 +02:00

measurement-write-plausibility-guard.test.ts

fix(sync): enforce the plausibility domain on every provider write path

2026-08-07 22:19:43 +02:00

medications-efficacy-verb-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

migration-number-uniqueness.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

mood-backup-completeness.test.ts

feat(backup): carry the mood day context through export and restore

2026-08-08 07:14:04 +02:00

mood-prediction-write-surface-guard.test.ts

docs(mood): state the validation's real leak boundary, drop the unused weekday floor, correct two comments

2026-08-08 15:30:38 +02:00

moodlog-removal-guard.test.ts

feat(integrations): remove the moodLog integration

2026-07-25 11:36:18 +02:00

narrated-locale-guard-defeat.test.ts

Close four ways around the locale guard

2026-07-31 11:08:06 +02:00

narrated-locale-required-guard.test.ts

Pin the Coach read strip's language, and keep the default out

2026-07-31 09:07:50 +02:00

notification-delivery-identity.test.ts

fix(02-11): release guardian lock before provider egress

2026-08-06 13:46:42 +02:00

openapi-account-sharing-components.test.ts

docs(api): publish the sharing request bodies as named schemas

2026-08-07 08:10:48 +02:00

openapi-sharing-denial.test.ts

docs: publish the last-Guardian refusal where it is actually raised

2026-08-07 05:43:06 +02:00

prefetch-page-caching-guard.test.ts

Close the delegated-access gaps the release audit left open

2026-08-04 14:55:32 +02:00

prisma-enum-mapping-guard.test.ts

fix(environment): name the enum type the database actually has

2026-07-26 14:37:57 +02:00

proxy-csp-blob-preview.test.ts

Let the app CSP frame and render its own blob previews

2026-08-13 12:08:59 +02:00

proxy-csp-hsts-hardening.test.ts

chore: scrub instance details and personal data from committed artefacts

2026-06-10 11:00:26 +02:00

proxy-demo-mode-allowlist.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

proxy-document-serve-framing.test.ts

feat(share-links): attach documents and serve them through the share token

2026-07-07 18:43:13 +02:00

proxy-early-exit-headers.test.ts

fix(nutrients): bound the manual water writes and put nutrient totals in the backup

2026-07-19 13:40:03 +02:00

proxy-invite-public.test.ts

Harden invite token-in-path against cache and index leaks

2026-06-14 19:34:14 +02:00

proxy-onboarding-redirect.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

proxy-page-no-store.test.ts

fix(proxy): pin no-store on every session-gated page

2026-07-19 10:59:40 +02:00

proxy-privacy-public.test.ts

chore(release): v1.4.26 — privacy policy for App Store submission

2026-05-15 07:35:05 +02:00

proxy-well-known-public.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

proxy-worker-health.test.ts

fix(runtime): harden process startup and health

2026-07-21 00:05:03 +02:00

published-env-reaches-the-container.test.ts

fix: close two gaps the last audit round left open

2026-08-07 02:26:29 +02:00

record-fence-headerless-transport-guard.test.ts

test(02-12.1): name the transport guard's blind spots, match one more

2026-08-06 23:04:29 +02:00

record-session-fence-acceptance-map.test.ts

test(02-12.1): prove Vary on the serving path, not only the contents

2026-08-06 23:04:29 +02:00

record-session-fence-compat.test.ts

feat(02-12.1): carry and verify the record context from the browser

2026-08-06 19:10:02 +02:00

record-session-fence-guard.test.ts

docs(02-12.1): narrow two overstated claims

2026-08-06 20:48:50 +02:00

record-settings-configuration.test.ts

fix: complete managed record settings

2026-08-06 03:40:13 +02:00

record-settings-contract.test.ts

fix: close four small gaps around the record surface

2026-08-07 01:00:02 +02:00

record-settings-route-guard.test.ts

fix: complete managed record settings

2026-08-06 03:40:13 +02:00

record-settings-ui.test.tsx

fix: complete managed record settings

2026-08-06 03:40:13 +02:00

report-selection-egress-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

service-worker-version-anchor.test.ts

fix(sw): re-anchor the fallback cache version and gate it against the release

2026-07-30 11:55:16 +02:00

service-worker.test.ts

test(01-02): add red PWA cache isolation contracts

2026-07-29 13:37:20 +02:00

session-surface-guard.test.ts

Stop a prefetching page from seeding the wrong person's record

2026-08-03 13:49:19 +02:00

shared-record-navigation.test.tsx

feat(vaccinations): add the immunization log route, nav entry and shared-record family

2026-08-08 20:24:42 +02:00

sharing-accessibility-states.test.tsx

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-boundary-copy.test.ts

docs: state the sharing boundary that is actually enforced

2026-08-07 00:52:25 +02:00

sharing-legacy-client-contract.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-native-client-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-record-fence-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-recoverable-errors.test.tsx

test(sharing): follow the invite form's new scope default and one-line copy

2026-08-08 21:20:57 +02:00

sharing-scope-contract.test.ts

feat: define scoped sharing levels

2026-08-05 23:58:18 +02:00

sharing-surface-guard.test.ts

test(vaccinations): reconcile the structural guards with the new surfaces

2026-08-08 21:43:28 +02:00

step-up-elevation-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

success-affordance-guard.test.ts

settings: move the About-me note and free-text allergies into the Anamnese

2026-08-13 06:16:45 +02:00

sw-security-hardening.test.ts

test(01-02): add red PWA cache isolation contracts

2026-07-29 13:37:20 +02:00

timezone-explicit-formatter-guard.test.ts

fix(tz): close the hole that let a display option pass for a timezone

2026-07-27 16:10:30 +02:00

unit-preference-display-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

v137-wave-zero-fixtures.test.ts

test(vaccinations): reconcile the structural guards with the new surfaces

2026-08-08 21:43:28 +02:00

v1341-locale-parity.test.ts

Rebuild the Insights health score as one pinned card

2026-07-30 23:20:02 +02:00

vorsorge-due-bucket-single-home-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

workout-canonical-identity-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

workout-sport-provenance-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

written-outcome-response-consumer-guard.test.ts

feat(labs): keep the reference range a report prints beside a value

2026-08-07 21:40:41 +02:00