tillandClaude Opus 5
0798eb7438
CI / check (push) Has been cancelled
The critical advisory in the dependency tree (GHSA-26w7-cxv4-gfx2, remote code execution through AVIF image optimisation) has no fix inside Astro 5, so this moves to Astro 7.3.2 with @astrojs/node 11 and current sharp. `npm audit` now reports nothing. The only code the jump needed: `csp` graduated out of `experimental`, and sharp's `Sharp` type is a named export now. Also fixed, both found by testing with every module switched on rather than only the print-only default: - `src/pages/index.astro` passed `dict` to the studio island without ever defining it, so the studio page returned 500 on any instance with the AI module on. The print-only default redirects away from that page, which is why the earlier run never hit it. - The print studio fetched `/api/delivery-targets` even with the delivery module off. The route answered 404 exactly as designed, but it left a red line in the console of every print-only instance, which reads like a fault. It now asks only when there is a module to ask, and hides the card otherwise. Plus: the first-run box sizes itself to its content instead of miscounting padding, and the README's counts are recounted rather than remembered. Verified against a live instance on a fresh database, in both module sets: sign-in, module gating, the German interface, an eight-up passport sheet and its PDF. 124 tests, type check, build and secret scan all clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
38 lines
1.3 KiB
JavaScript
38 lines
1.3 KiB
JavaScript
import { defineConfig } from 'astro/config';
|
|
import node from '@astrojs/node';
|
|
import react from '@astrojs/react';
|
|
|
|
// Klarbild runs as a Node server (SSR) with an in-process queue.
|
|
export default defineConfig({
|
|
output: 'server',
|
|
adapter: node({ mode: 'standalone' }),
|
|
integrations: [react()],
|
|
// CSRF: handled by our own SameSite=Lax session cookie. Astro's checkOrigin
|
|
// breaks multipart uploads behind a reverse proxy, because the proxy speaks
|
|
// http to the app while the browser spoke https and the origins no longer match.
|
|
security: { checkOrigin: false },
|
|
// Content-Security-Policy with hashes instead of 'unsafe-inline': Astro computes
|
|
// the hash of every inline script and style it emits, at build time. The remaining
|
|
// directives are set by the middleware (src/middleware.ts).
|
|
// Graduated out of `experimental` in Astro 7.
|
|
csp: {
|
|
directives: [
|
|
"default-src 'self'",
|
|
"img-src 'self' data: blob:",
|
|
"font-src 'self'",
|
|
"connect-src 'self'",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
],
|
|
},
|
|
server: { host: true, port: Number(process.env.PORT) || 4321 },
|
|
vite: {
|
|
ssr: {
|
|
// Do not bundle native modules
|
|
external: ['sharp', 'argon2', 'pg', 'pg-boss', 'ssh2-sftp-client', 'basic-ftp', 'heic-convert'],
|
|
},
|
|
},
|
|
});
|