benmichael/gods-eye-view
1
0 Fork 0
mirror of https://github.com/bilawalsidhu/gods-eye-view.git synced 2026-11-05 19:04:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,052 Commits 31 Branches 5 Tags
3acfcf94f55adf41b7a7607843eb4d56d589420b
Commit Graph
2052 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sameh Khamis 7be5937fc3 Merge pull request #1317 from bilawalsidhu/fix/provider-response-hardening 
Harden provider response handling and camera source validation
 2026-10-21 16:18:50 -07:00
Sameh Khamis 9f5acf14db Name the changelog fragment for #1317 2026-10-21 16:07:42 -07:00
Sameh Khamis b75db874c6 Read API paths and forwarded requests as the router does 
The router reads an absolute-form target's path without resolving dot
segments, so a target such as http://host/api/../x still reaches /api
middleware. Take that path the same way when deciding whether the API
response headers apply.

The Street View fallback now treats any forwarding header as forwarded, even
an empty one, before it spends the key.
 2026-10-21 15:43:29 -07:00
Sameh Khamis afe05454d9 Require a directory prefix for camera URL pins 
The URL parser already turns backslashes into separators, so only encoded
separators need refusing; a pin prefix without a trailing slash is treated as
a directory.
 2026-10-21 15:33:14 -07:00
Sameh Khamis b1ed77c26c Keep camera routes reachable behind a reverse proxy 
The CCTV routes now use the keyless cross-site checks, which refuse cross-site
browser requests but accept forwarding headers, so cameras work behind the
documented reverse proxy. The Street View fallback is the one step that spends
a key; a request with forwarding headers skips it and gets the placeholder
frame, as when no key is configured.
 2026-10-21 15:33:14 -07:00
Sameh Khamis d80162bea2 Match API paths the way the router does 
The router mounts /api without regard to letter case, accepts a '.' as well
as '/' after the prefix, and routes absolute-form request targets, so the
API response headers were missing on those spellings. Match the same way, on
both the raw and the parsed path. The test now runs real dev and preview
servers.
 2026-10-21 15:33:13 -07:00
Sameh Khamis 3e80afe713 Pin camera sources by parsed URL 
Camera catalog image URLs were pinned by string prefix, so a URL that only
began with the agency's directory before dot segments or an encoded separator
were resolved still counted as inside it. The pin now parses the URL and
requires the same scheme, the exact host, no credentials, the default port and
a normalized path inside the pinned directory. Redirects on a pinned host must
stay inside the same directory.

Document the response format checks and API response headers alongside the
existing server hardening notes.
 2026-10-21 15:07:40 -07:00
Sameh Khamis 0ad75095a7 Validate provider response formats 
CCTV frames and the Street View fallback accept only JPEG, PNG, GIF, WebP and
AVIF, parsed from the media type essence and sent under the canonical type;
any other type is cancelled and falls through to the next fallback as a
failed upstream does. Live media must match its feed kind (video/mp4,
video/webm, or multipart/x-mixed-replace with a boundary) before the camera
is reported healthy or any byte is relayed, and its redirects now stay on the
registered origin like frames. Every /api/cctv route uses the same-site gate.

The GBFS proxy relays only bodies that parse as JSON, re-serialized under a
fixed application/json type.
 2026-10-21 15:07:20 -07:00
Sameh Khamis 72e1469968 Apply consistent API response headers 
Every /api response, including errors, partial responses, Host refusals and
unknown routes, now carries a sandboxing Content-Security-Policy and
X-Content-Type-Options: nosniff on the dev and preview servers. Vite's server
and preview headers only reach the documents and assets it serves itself, so
a small plugin sets them ahead of the Host check. A route's own policy is sent
as an additional policy rather than replacing it.
 2026-10-21 15:07:00 -07:00
German Khokhlov 275513bf2c Merge pull request #1243 from bilawalsidhu/claude/hal-627-starfield-cb6fa2 
feat(sky): catalogue stars and a soft Milky Way instead of the blocky sky box
 2026-10-21 21:59:02 +04:00
German Khokhlov a1a9a36f54 Merge remote-tracking branch 'origin/main' into claude/hal-627-starfield-cb6fa2 2026-10-21 21:39:46 +04:00
Mazeyar Moeini Feizabadi e84e74ca3a Merge pull request #1309 from bilawalsidhu/codex/shared-control-css-ownership 
Clarify CSS ownership for shared native fields
 2026-10-21 18:52:01 +02:00
Mazeyar Moeini Feizabadi 4116082cb9 docs: add release note for field CSS ownership 2026-10-21 18:41:39 +02:00
Mazeyar Moeini Feizabadi 7103c29194 refactor(ui): clarify shared field CSS ownership 2026-10-21 18:41:17 +02:00
Said TurkseverandClaude Opus 5.5 82c722e6af chore(format): keep format-scope in step with main 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 17:40:49 +01:00
Said TurkseverandClaude Opus 5.5 eaf14e2937 Merge branch 'main' into codex/fix-docker-trusted-peers 
Resolve scripts/format-scope.json by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 17:39:47 +01:00
Mazeyar Moeini Feizabadi a20673e78d Merge pull request #1306 from bilawalsidhu/codex/shared-status-badges 
Unify read-only status badges in CCTV and Weather
 2026-10-21 18:18:47 +02:00
Mazeyar Moeini Feizabadi 83471ea6d7 docs: add release note for shared status badges 2026-10-21 18:10:46 +02:00
Mazeyar Moeini Feizabadi f70bc0cabb refactor(ui): share read-only status badges 2026-10-21 18:10:09 +02:00
Mazeyar Moeini Feizabadi 8ed1bbbd0f Merge pull request #1305 from bilawalsidhu/codex/shared-form-controls 
refactor(ui): share native dropdowns and numeric fields
 2026-10-21 17:31:57 +02:00
Mazeyar Moeini Feizabadi 3f903f0b18 Merge main and preserve shared control surfaces 
# Conflicts:
#	src/ui/templates/layer-panels.html
#	style.css
 2026-10-21 17:25:25 +02:00
Mazeyar Moeini Feizabadi 4deb32a9a3 Merge pull request #1302 from bilawalsidhu/codex/shared-action-buttons 
refactor(ui): share ordinary Scene and CCTV action buttons
 2026-10-21 17:25:05 +02:00
Mazeyar Moeini Feizabadi 49735d9307 Merge main for shared action button integration 2026-10-21 17:18:18 +02:00
Mazeyar Moeini Feizabadi b6623f65cd docs: add shared native fields changelog entry 2026-10-21 17:11:56 +02:00
quanticsoul4772andClaude Opus 5.5 80292fab72 docs(changelog): reword fragment for #1303 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 07:20:56 -07:00
Said Turksever f3bb697ed4 Merge pull request #1264 from bilawalsidhu/codex/fix-overpass-request-admission 
fix(overpass): bound request validation and reject cross-site POSTs
 2026-10-21 15:20:25 +01:00
quanticsoul4772andClaude Opus 5.5 6d3e7c6c67 docs(changelog): fragment for #1303 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 07:09:38 -07:00
Said TurkseverandClaude Opus 5.5 e925f75a4a Merge branch 'main' into codex/fix-hidden-tab-polling 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:54 +01:00
Said TurkseverandClaude Opus 5.5 b493418ed1 Merge branch 'main' into codex/fix-traffic-render-hold 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:52 +01:00
Said TurkseverandClaude Opus 5.5 a2968af45e Merge branch 'main' into codex/fix-launch-hover-throttle 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:48 +01:00
Said TurkseverandClaude Opus 5.5 635fb55514 Merge branch 'codex/fix-overpass-request-admission' into codex/fix-overpass-cache-singleflight 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:45 +01:00
Said TurkseverandClaude Opus 5.5 c192c3b8b5 Merge branch 'main' into codex/fix-terrain-request-bound 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:39 +01:00
Said TurkseverandClaude Opus 5.5 3d75e0a731 Merge branch 'main' into codex/fix-initial-forecast-supersession 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:36 +01:00
Said TurkseverandClaude Opus 5.5 2a0f78d169 Merge branch 'main' into codex/fix-kml-root-scanner 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:33 +01:00
Said TurkseverandClaude Opus 5.5 6477f9c910 Merge branch 'main' into codex/fix-military-history-failures 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:31 +01:00
Said TurkseverandClaude Opus 5.5 a451c1ba6f Merge branch 'main' into codex/fix-share-style-keys 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:26 +01:00
Said TurkseverandClaude Opus 5.5 76ee07ee6e Merge branch 'main' into codex/fix-space-provider-cooldowns 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:23 +01:00
Said TurkseverandClaude Opus 5.5 f07a52cb00 Merge branch 'main' into codex/fix-aircraft-refresh 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:21 +01:00
Said TurkseverandClaude Opus 5.5 023b6a1991 Merge branch 'main' into codex/fix-radio-tag-normalization 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:18 +01:00
Said TurkseverandClaude Opus 5.5 2cf36534d9 Merge branch 'main' into codex/fix-docker-trusted-peers 
Resolve docs/CURRENT-STATE.md (and scripts/format-scope.json) by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-21 15:04:15 +01:00
Said Turksever 54e7dc7c30 Merge branch 'main' into codex/fix-overpass-request-admission 2026-10-21 15:00:44 +01:00
Said Turksever ee1e91781a Merge branch 'main' into claude/hal-627-starfield-cb6fa2 2026-10-21 14:54:23 +01:00
Said Turksever 2da8ced642 Merge pull request #1286 from asturksever/fix/since-note-inline 
fix(street-level): SINCE note on the value's line: ANY DATE (by upload date)
 2026-10-21 14:50:45 +01:00
Said Turksever a397c94892 Merge branch 'main' into fix/since-note-inline 2026-10-21 14:36:24 +01:00
Mazeyar Moeini Feizabadi 7932259dc4 refactor(ui): share native dropdown and numeric field surfaces 2026-10-21 15:35:49 +02:00
Mazeyar Moeini Feizabadi 5a11bd9515 docs: add shared action buttons changelog entry 2026-10-21 15:22:21 +02:00
Mazeyar Moeini Feizabadi 538f2f1bc0 refactor(ui): share Scene and CCTV action buttons 2026-10-21 15:22:00 +02:00
Mazeyar Moeini Feizabadi 5a1598fd9e Merge pull request #1287 from bilawalsidhu/codex/shared-sliders 
refactor(ui): unify ordinary slider components and styling
 2026-10-21 14:19:55 +02:00
Mazeyar Moeini Feizabadi bf0e1d7c79 Merge current main into shared sliders 2026-10-21 14:10:40 +02:00
Mazeyar Moeini Feizabadi 415edbcfdf Merge pull request #1301 from bilawalsidhu/codex/shared-segmented-selectors 
Unify segmented selectors and fix compact control spacing
 2026-10-21 13:27:12 +02:00