 Z User
|
9bf94ee79a
|
feat: CSP + security headers (PRD §5.6)
next.config.ts headers():
- Content-Security-Policy: default-src 'self', frame-ancestors 'none', form-action 'self'
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY (clickjacking prevention)
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera/microphone/geolocation/payment disabled
- Strict-Transport-Security: HSTS 2 years + preload
- API routes: Cache-Control no-store (PRD: 'no-store on private files')
Verified: all 7 security headers present on every page + API response.
|
2026-10-27 22:20:26 +00:00 |
|
|
Z User
|
fa8dd46571
|
refactor: professional code quality audit
- Fix all TypeScript compilation errors (0 errors in src/)
- Add try/catch error handling to ALL API routes (38 handlers)
- Fix empty catch blocks (api-auth.ts now logs warnings)
- Add aria-labels to all icon-only buttons (WCAG 2.1 AA)
- Fix Prisma type mismatches (OR filter, Person.companyId, Estimate.projectId, Ticket.createdAt)
- Fix webhook PATCH route (moved to [id]/route.ts)
- Fix mobile-bottom-nav type safety
- Fix KB route where-clause type
- Fix test-mail banner null vs undefined
- Fix task comment fetch: add cancellation + error toast
- ESLint: 0 errors, 0 warnings
- 175 files, 24.741 lines of code
|
2026-10-27 12:23:32 +00:00 |
|