From 48e264285ad1cf574f0163e5515f8ebc72c8e851 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Fri, 16 Oct 2026 13:40:30 +0200 Subject: [PATCH] fix(scripts): allow the admin theme and locale cache in check-phase10 hygiene (T-261016-0fm-08) usePreferences.ts (quick 261016-0fm) caches the theme and locale codes in localStorage, an accepted threat of that task; the hygiene allow-list was not updated, so check-phase18.1.sh docs failed. Tokens stay forbidden. --- scripts/check-phase10.sh | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/scripts/check-phase10.sh b/scripts/check-phase10.sh index 6259690..19a9dd0 100755 --- a/scripts/check-phase10.sh +++ b/scripts/check-phase10.sh @@ -425,11 +425,12 @@ hygiene_checks() { [[ -z "$hits" ]] || fail "admin/src/api/types.ts declares a shape instead of aliasing the generated schema: $hits" hits="$(cd "$tree" && grep -nE '^export type [A-Za-z]+ = ' admin/src/api/types.ts | grep -vE "= (Schemas\['cabana\.[A-Za-z_-]+'\]|NonNullable<[A-Za-z]+Path\['get'\]\['parameters'\]\['query'\]>|[A-Za-z]+Path\['get'\]\['parameters'\]\['path'\])\$" || true)" [[ -z "$hits" ]] || fail "admin/src/api/types.ts alias not onto the generated schema: $hits" - # Browser storage holds only the sidebar flag (T-10-22) and the per-list - # query parameters (T-16.1-03), never a token. + # Browser storage holds only the sidebar flag (T-10-22), the per-list + # query parameters (T-16.1-03) and the theme and locale codes + # (T-261016-0fm-08), never a token. hits="$(cd "$tree" && grep -rnE 'localStorage|sessionStorage|indexedDB|document\.cookie' admin/src 2>/dev/null | - grep -v -e '^admin/src/state/useSidebar.ts:' -e '^admin/src/state/listState.ts:' || true)" - [[ -z "$hits" ]] || fail "browser storage outside admin/src/state/useSidebar.ts and admin/src/state/listState.ts: $hits" + grep -v -e '^admin/src/state/useSidebar.ts:' -e '^admin/src/state/listState.ts:' -e '^admin/src/state/usePreferences.ts:' || true)" + [[ -z "$hits" ]] || fail "browser storage outside admin/src/state/useSidebar.ts, admin/src/state/listState.ts and admin/src/state/usePreferences.ts: $hits" # The embedded build loads nothing from another origin. Allowed literals are # never requested: https://prosemirror.net is ProseMirror error text and # https://admin.invalid the reserved-TLD parse base in isAllowedLink.