 Juan Denis
|
ad96423966
|
feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)
- Validate preview swatches as colors server-side (closes url() smuggling
via POST /import); import tolerates unknown metadata (license, image, modes)
- theme_registry_service: negative caching on fetch failure (TTL-stamped
last-good + 60s failure backoff — no more 15s gallery stalls offline);
drop dead base_url cache key; refresh stale comment
- .env.example: document SERVERKIT_THEMES_REGISTRY_URL/_TTL
- SCSS: route $success/$warning/$danger/$info through --green/--amber/
--red/--cyan (raw twins for color-function call sites), $font-main/$font-mono
through --sans/--mono, scrollbar track through --scrollbar-track
- Fix 5 undefined CSS var consumers (--radius-md/--card-bg/--danger/
--accent-subtle/--accent-soft -> existing tokens)
- Nits: drop dead ThemeStudioTrigger export, dedupe lucide import,
run check-theme-tokens in pre-commit hook
- docs/plans/61_THEMES_HARDENING_PLAN.md
23 backend theme tests pass; check-theme-tokens, lint (0 errors), build green
|
2026-07-23 09:25:01 -04:00 |
|
|
Juan DenisandClaude Opus 4.8
|
c20a9f14f2
|
feat(themes): backend model, API, and registry pipeline (plan 60 Phase 2-3)
Themes are data, not code — so the backend is a simple validated-JSON store,
no zips/checksums/permissions.
- Theme model + migration 078_themes
- theme_tokens.py: server-side mirror of the token whitelist + validators
(the gate: a malicious/malformed theme never reaches the DB)
- theme_service: bundled-seed loading, import/list/delete, panel default,
pre-auth public/active
- /api/v1/themes: /installed, /import (admin), DELETE (admin), /default
get+set (admin), unauthenticated /public/active for login/setup, plus
/registry + /registry/<slug>/install
- theme_registry_service: offline-tolerant registry fetch (TTL + last-good +
bundled fallback), mirrors the extension registry pattern
- bundled seed themes synced to app/data/themes + themes_index.json
- 18 proving tests (server-side validation sanitizes url()/;/} smuggling,
admin gate, panel-default → public/active, offline fallback, install flow)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-07-23 00:24:00 -04:00 |
|