golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(scripts): allow the admin theme and locale cache in check-phase10 hygiene (T-261016-0fm-08)

Browse Source 
usePreferences.ts (quick 261016-0fm) caches the theme and locale codes in
localStorage, an accepted threat of that task; the hygiene allow-list was
not updated, so check-phase18.1.sh docs failed. Tokens stay forbidden.
This commit is contained in:
Jakub Zych
2026-10-16 13:40:30 +02:00
parent 3cb22523e2
commit 48e264285a
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
scripts/check-phase10.sh
View File

@@ -425,11 +425,12 @@ hygiene_checks() {
[[ -z "$hits" ]] || fail "admin/src/api/types.ts declares a shape instead of aliasing the generated schema: $hits"
hits="$(cd "$tree" && grep -nE '^export type [A-Za-z]+ = ' admin/src/api/types.ts | grep -vE "= (Schemas\['cabana\.[A-Za-z_-]+'\]|NonNullable<[A-Za-z]+Path\['get'\]\['parameters'\]\['query'\]>|[A-Za-z]+Path\['get'\]\['parameters'\]\['path'\])\$" || true)"
[[ -z "$hits" ]] || fail "admin/src/api/types.ts alias not onto the generated schema: $hits"
# Browser storage holds only the sidebar flag (T-10-22) and the per-list
# query parameters (T-16.1-03), never a token.
# Browser storage holds only the sidebar flag (T-10-22), the per-list
# query parameters (T-16.1-03) and the theme and locale codes
# (T-261016-0fm-08), never a token.
hits="$(cd "$tree" && grep -rnE 'localStorage|sessionStorage|indexedDB|document\.cookie' admin/src 2>/dev/null |
grep -v -e '^admin/src/state/useSidebar.ts:' -e '^admin/src/state/listState.ts:' || true)"
[[ -z "$hits" ]] || fail "browser storage outside admin/src/state/useSidebar.ts and admin/src/state/listState.ts: $hits"
grep -v -e '^admin/src/state/useSidebar.ts:' -e '^admin/src/state/listState.ts:' -e '^admin/src/state/usePreferences.ts:' || true)"
[[ -z "$hits" ]] || fail "browser storage outside admin/src/state/useSidebar.ts, admin/src/state/listState.ts and admin/src/state/usePreferences.ts: $hits"
# The embedded build loads nothing from another origin. Allowed literals are
# never requested: https://prosemirror.net is ProseMirror error text and
# https://admin.invalid the reserved-TLD parse base in isAllowedLink.