6 Commits

Author	SHA1	Message	Date
Jakub Zych	2343788624	fix(boardwalk): add form-action and frame-src to the admin CSP ... - form-action 'self': injected markup cannot post a native form off-origin - frame-src 'none': no framed content; a sandboxed srcdoc preview is not fetched and still renders - header tests, README and admin-spa docs name the directives	2026-10-12 20:41:21 +02:00
Jakub Zych	602e0412f3	docs: add a Role in the framework section to every module README ... Each module README now says where the module sits in the dependency graph, why it is its own module, and lists use cases for application developers.	2026-10-11 00:58:17 +02:00
Jakub Zych	ca1443e9c8	docs: add a name mnemonic to every module README and the root modules table	2026-10-11 00:26:20 +02:00
Jakub Zych	8b1cb244de	feat(10.1-01): serve controller JS/CSS and run registered toolbar actions ... - boardwalk exports ContentType and SetSecurityHeaders - pact.AdminClientAssets files are read and hashed at boot and served by exact key under {prefix}/assets/{vendor}/{plugin}/ with nosniff, CSP, CORP, no-cache and an ETag; a miss falls through to the SPA - list and form schemas carry assets URLs with a ?v= hash - toolbar.buttons resolves create, delete and registered actions after decode; toolbarActions is permission-filtered per admin - POST .../toolbar/{action} behind requireAjax and action permissions	2026-09-28 23:41:17 +02:00
Jakub Zych	3142aebc75	docs(modules): rewrite lagoon, tide, pact, party, boardwalk, fetchguard READMEs	2026-09-28 15:46:08 +02:00
Jakub Zych	680a61cde2	docs(10.2-02): document framework modules ... - Add concise code-derived onboarding for all nested modules\n- Name a real entry point and current consumers per package	2026-09-28 13:07:52 +02:00