2 Commits

Author	SHA1	Message	Date
Jakub Zych	f705343904	fix(19.3-06): api-docs CSP allows only nonce-carrying scripts (WR-06) ... - the two pinned jsDelivr scripts carry the per-request nonce next to their SRI hash; script-src holds only the nonce, no host source	2026-10-15 22:28:34 +02:00
Jakub Zych	20bc1a0795	feat(19.3-02): opt-in /api-docs Swagger UI page with a pinned, SRI-checked swagger-ui-dist ... - surf: APIDocsProvider (one plugin) supplies a YAML or JSON OpenAPI document, converted once at boot to compact JSON in source key order; zero or several providers or a spec that does not convert fail boot - http.api_docs.enabled/path/title mount GET /api-docs and /api-docs.json (summercms.apidocs, public, refusing to replace a plugin route) - the page loads swagger-ui-dist 5.33.1 from jsDelivr with sha384 SRI and crossorigin on all three assets, a per-request CSP nonce for its inline script, nosniff and no-referrer - docs: API documentation page section, README rows, ExampleAPIDocsProvider	2026-10-15 17:59:54 +02:00