tillandClaude Opus 5
6ae6e0348c
Five things off the open list in the wiki. CSP with real hashes for every inline script (Astro's experimental.csp), so no 'unsafe-inline' for scripts. style-src is deliberately reopened in middleware: React sets styles as attributes and attributes cannot be hashed -- measured, the hash-only policy blocks them and the print preview loses its layout. Plus nosniff, referrer-policy, X-Frame-Options and a permissions-policy. Verified across all pages: zero violations. mem_limit 3g in compose. sharp can spike; without a limit an outlier takes the whole container down instead of just the process, and the healthcheck can't help. AI results now carry IPTC DigitalSourceType (trainedAlgorithmicMedia, or compositeWithTrainedAlgorithmicMedia for edited photos) plus the model, embedded as XMP -- written by hand into PNG iTXt and JPEG APP1 rather than pulling in a sharp upgrade with a native postinstall. exiftool reads it back from both formats; pixels, dimensions and dpi are provably untouched. Crop maths lived twice, in the browser preview and the server renderer, with nothing holding them together. Now one dependency-free module, and 60000 randomised cases assert both entry points agree. That test immediately found a real bug: the zoom limits (0.02 / 8x) also clamped the *initial* crop, so an extreme format silently broke the aspect ratio -- "Rand lassen" would have cropped after all. Limits are now widened to whatever the format needs. Also: the colour flag sat exactly on the selection circle in the library and covered it. Moved to the bottom left. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BNhLunz586g6DeYMa7Qsd1
38 lines
1.3 KiB
JavaScript
38 lines
1.3 KiB
JavaScript
import { defineConfig } from 'astro/config';
|
|
import node from '@astrojs/node';
|
|
import react from '@astrojs/react';
|
|
|
|
// Klarbild läuft als Node-Server (SSR) mit In-Process-Warteschlange.
|
|
export default defineConfig({
|
|
output: 'server',
|
|
adapter: node({ mode: 'standalone' }),
|
|
integrations: [react()],
|
|
// CSRF: eigener Schutz über SameSite=Lax-Session-Cookie. Astros checkOrigin
|
|
// bricht multipart-Uploads hinter dem Reverse-Proxy (http↔https-Mismatch).
|
|
security: { checkOrigin: false },
|
|
// Content-Security-Policy mit Hashes statt 'unsafe-inline': Astro rechnet die
|
|
// Hashes seiner eigenen inline-Skripte und -Styles beim Bauen aus. Die übrigen
|
|
// Direktiven setzt die Middleware (src/middleware.ts).
|
|
experimental: {
|
|
csp: {
|
|
directives: [
|
|
"default-src 'self'",
|
|
"img-src 'self' data: blob:",
|
|
"font-src 'self'",
|
|
"connect-src 'self'",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
],
|
|
},
|
|
},
|
|
server: { host: true, port: Number(process.env.PORT) || 4321 },
|
|
vite: {
|
|
ssr: {
|
|
// Native Module nicht bündeln
|
|
external: ['sharp', 'argon2', 'pg', 'pg-boss', 'ssh2-sftp-client', 'basic-ftp', 'heic-convert'],
|
|
},
|
|
},
|
|
});
|