Improvements v0.0.5 #4

Merged

rdenadai merged 2 commits from improvements-v0.0.5 into main

2026-08-20 14:42:59 +00:00

rdenadai commented

2026-08-20 14:38:37 +00:00

Owner

Improvements v0.0.5

Favorites, ops hardening, security, and deployment polish for the 0.0.5 release.

Frontend

Favorites: client-only localStorage saved articles with full digest-card parity (page, header trigger, remove dialog, topic-color parity).
Brand image fixed to square 180x180; CSS sizing matches.
Service worker cache bumped to tilens-static-v2.
MathJax 4 fully self-hosted (TeX extensions, NewCM fonts, WOFF2, CHTML dynamic) under /static/vendor/mathjax/.
MathJax and GA scripts protected by per-request CSP nonce.

Security

CSP composed with each directive emitted exactly once; GA/MathJax origins merged into existing script-src, connect-src, img-src so duplicate-directive browsers stop dropping GA.
deploy/Caddyfile no longer sets a static CSP that would compete with the per-response app policy.
Strict regex validation for TILENS_GA_MEASUREMENT_ID (GA4 G-XXXX / Ads AW-XXXX); GTM rejected.
Trusted-proxy CIDRs must be host-only (/32 or /128); broad subnets rejected at startup; blank value falls back to loopback.

Worker / Healthcheck

Supervisor continues across ingestion failures; cycle-body exceptions isolated.
Heartbeat refreshed only after a successful cycle, so persistent ingestion failures eventually mark the container unhealthy.
DB-init failure skips the heartbeat entirely.
Compose healthcheck default aligned to 21600s and uses TILENS_DB_PATH fallback so containers without .env still start.

Deployment / Docs

.env.example expanded with worker pacing, web defaults, trusted proxy, rate-limit zones, public URL (https://tilens.rdenadai.dev/), analytics, debug, and feature flags.
docker-compose uses env_file: required: false; fresh checkouts no longer require .env before compose up.
scripts/ci.sh builds frontend assets before pytest, discovers web port dynamically, and uses mktemp for smoke temp files.
docs/RULES.md and docs/operations.md updated for CSP, GA, trusted proxy, and healthcheck window.

## Improvements v0.0.5 Favorites, ops hardening, security, and deployment polish for the 0.0.5 release. ### Frontend - Favorites: client-only `localStorage` saved articles with full digest-card parity (page, header trigger, remove dialog, topic-color parity). - Brand image fixed to square 180x180; CSS sizing matches. - Service worker cache bumped to `tilens-static-v2`. - MathJax 4 fully self-hosted (TeX extensions, NewCM fonts, WOFF2, CHTML dynamic) under `/static/vendor/mathjax/`. - MathJax and GA scripts protected by per-request CSP nonce. ### Security - CSP composed with each directive emitted exactly once; GA/MathJax origins merged into existing `script-src`, `connect-src`, `img-src` so duplicate-directive browsers stop dropping GA. - `deploy/Caddyfile` no longer sets a static CSP that would compete with the per-response app policy. - Strict regex validation for `TILENS_GA_MEASUREMENT_ID` (GA4 `G-XXXX` / Ads `AW-XXXX`); GTM rejected. - Trusted-proxy CIDRs must be host-only (`/32` or `/128`); broad subnets rejected at startup; blank value falls back to loopback. ### Worker / Healthcheck - Supervisor continues across ingestion failures; cycle-body exceptions isolated. - Heartbeat refreshed only after a successful cycle, so persistent ingestion failures eventually mark the container unhealthy. - DB-init failure skips the heartbeat entirely. - Compose healthcheck default aligned to `21600s` and uses `TILENS_DB_PATH` fallback so containers without `.env` still start. ### Deployment / Docs - `.env.example` expanded with worker pacing, web defaults, trusted proxy, rate-limit zones, public URL (`https://tilens.rdenadai.dev/`), analytics, debug, and feature flags. - `docker-compose` uses `env_file: required: false`; fresh checkouts no longer require `.env` before `compose up`. - `scripts/ci.sh` builds frontend assets before pytest, discovers web port dynamically, and uses `mktemp` for smoke temp files. - `docs/RULES.md` and `docs/operations.md` updated for CSP, GA, trusted proxy, and healthcheck window.

rdenadai added 1 commit

2026-08-20 14:38:37 +00:00

feat(release): improvements v0.0.5 af2ed24c80

Favorites, ops, security, and deployment hardening.

Frontend
- Favorites: client-only localStorage saved articles with full
  digest-card parity (page, trigger, remove dialog, header link,
  topic color parity, removing-state race guard).
- Brand image fixed intrinsic 180x180 dimensions and CSS sizing.
- Service worker cache bumped to tilens-static-v2.
- MathJax 4 self-hosted bundle (TeX extensions, NewCM fonts,
  WOFF2 fonts, CHTML dynamic assets) under /static/vendor/mathjax.
- MathJax/GA scripts rendered under per-request CSP nonce.

Security
- CSP composed with each directive emitted exactly once
  (parse + dedup); MathJax and GA origins merged into existing
  script-src/connect-src/img-src so duplicate-directive browsers
  no longer drop GA allowances.
- Caddyfile no longer sets a static Content-Security-Policy header
  that would compete with the per-request app policy.
- Strict regex validation for TILENS_GA_MEASUREMENT_ID (GA4
  G-XXXX / Ads AW-XXXX); GTM containers rejected.
- Trusted proxy CIDRs enforce host-only /32 or /128; broad
  subnets and malformed values rejected at startup; blank value
  falls back to loopback default.

Worker
- Supervisor continues across ingestion failures; cycle-body
  exception isolated.
- Heartbeat refreshed only after a successful cycle so persistent
  ingestion failures eventually mark the container unhealthy.
- DB-init failure skips the heartbeat entirely so the container
  reports unhealthy immediately.
- compose healthcheck default aligned to 21600s and uses TILENS_DB_PATH
  fallback so containers without .env still start.

Deployment / Docs
- .env.example expanded with worker pacing, web defaults, trusted
  proxy guidance, rate-limit zones, public URL default
  https://tilens.rdenadai.dev/, analytics, debug, and feature flags.
- docker-compose uses env_file: required: false so a fresh
  checkout no longer requires copying .env before compose up.
- scripts/ci.sh builds frontend assets before pytest, discovers
  web port dynamically, and uses mktemp for smoke temp files.
- docs/RULES.md and docs/operations.md updated for CSP, GA,
  trusted proxy, and healthcheck window.

Tests
- CSP uniqueness (one directive per name) for MathJax and GA.
- Heartbeat final-touch skipped on persistent ingestion failure.
- Broad CIDR rejection and blank CIDR fallback.
- CI script asset build precedes pytest.
- Existing rate-limit, shell, worker, and deployment tests
  expanded and pinned to documented defaults.

rdenadai added 1 commit

2026-08-20 14:39:45 +00:00

chore(release): bump version to 0.0.5 0c19540353

rdenadai changed title from ~~feat(release): improvements v0.0.5~~ to Improvements v0.0.5

2026-08-20 14:42:52 +00:00

rdenadai merged commit 3c201881cf into main

2026-08-20 14:42:59 +00:00

rdenadai referenced this pull request from a commit

2026-08-20 14:43:00 +00:00

Merge pull request 'Improvements v0.0.5' (#4) from improvements-v0.0.5 into main