bert.hausmans
28727f246b
Remove apps/admin/ entirely — platform admin functionality now lives in apps/app/ under /platform/* routes for super_admin users. Production URL scheme changed: - Organizer app: crewli.app (was app.crewli.app) - Portal: portal.crewli.app (unchanged) - API: api.crewli.app (unchanged) - admin.crewli.app and app.crewli.app retired Backend: - Removed FRONTEND_ADMIN_URL config and admin cookie (crewli_admin_token) from SetAuthCookie, CookieBearerToken, cors.php, app.php - Updated .env and .env.example (two origins, no port 5173) - Updated cookie test: admin origin test → unknown origin fallback test Infrastructure: - Makefile: removed admin target - deploy/nginx: updated CSP comment, removed admin vhost - Updated README.md, CLAUDE.md, and all dev-docs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
16 lines
1.2 KiB
Plaintext
16 lines
1.2 KiB
Plaintext
# CSP for crewli.app (organizer SPA)
|
|
# Vite bundles all JS/CSS into same-origin files.
|
|
# 'unsafe-inline' for style-src is required by Vuetify (inline styles for theming).
|
|
# img-src https: allows organisation logos loaded from external URLs.
|
|
# connect-src must include the API domain for XHR/fetch calls.
|
|
#
|
|
# IMPORTANT: Start with Content-Security-Policy-Report-Only to catch
|
|
# false positives. Switch to Content-Security-Policy after 1-2 weeks
|
|
# of clean logs.
|
|
|
|
# Report-only mode (start with this):
|
|
# add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.crewli.app; frame-ancestors 'none'; form-action 'self'; base-uri 'self'" always;
|
|
|
|
# Enforce mode (switch to this after testing):
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.crewli.app; frame-ancestors 'none'; form-action 'self'; base-uri 'self'" always;
|