Sameh KhamisandClaude Opus 5.5 0646630dec fix(server): let the CSP load the Nepal event's embedded media ...

The Content-Security-Policy blocked the YouTube player API, the Facebook
video SDK and X's post widget that src/data/bhoteKoshiEmbeddedMedia.js
loads, along with their players and posts in frames. script-src now allows
exactly those three script origins and a new frame-src allows YouTube,
youtube-nocookie, Facebook and X embeds. A test ties the policy to the
frames the media module builds and pins the allowed script origins.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-02 20:21:23 -07:00

..

allowedHosts.js

fix(server): apply the Host check before the app's own routes

2026-10-02 20:15:54 -07:00

application-html.js

refactor(app): share application components and request services

2026-09-13 22:41:11 -07:00

embed-framing.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

panel.js

Run the worker prelude ahead of Cesium's own workers script

2026-10-02 18:29:42 -07:00

vite.js

fix(server): let the CSP load the Nepal event's embedded media

2026-10-02 20:21:23 -07:00