8 Commits

Include renames

Author	SHA1	Message	Date
implementer	32c81d8b91	test: add 3xx-redirect failure and no-credential-header/URL checks ... Extends the newsletter suite with two boundary cases: redirects (301/302/307/ 308) must be treated as failures with the user-safe error, and the POST must carry no credential of any kind — no api-key/auth-token/cookie headers, and no token/secret in the body or URL.	2026-08-26 11:31:54 +00:00
implementer	86aa3afbbf	refactor: newsletter signup posts no credential (SEC-14-R1 option a) ... Rework PR #15 per security review SEC-14-R1: the client no longer carries an API token. js/newsletter-config.js ships only the non-secret endpoint, enforced https-only at config load time via validateEndpoint() (mirroring the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs email-only with no Authorization header. Failure paths keep the single user-safe message that never leaks token, endpoint, status, or raw body; success still shows the confirmation. CI gains a gitleaks step that fails on any secret hit; README documents the server-side token, the residual signup-abuse risk, and the authoritative server-side validation follow-up.	2026-08-26 11:27:11 +00:00
bot-implementer	49690a7934	test: component + unit tests for the newsletter signup ... Covers the issue test plan: form renders and posts to the endpoint; token is read from config, never hardcoded in source; a failed-token response shows a user-safe error without leaking the secret; confirmation on success.	2026-08-25 19:15:56 +00:00
bot-implementer	fb62194d40	feat: harden external reading links with rel="noopener noreferrer" ... All reading list links point at external http(s) URLs, so each rendered anchor now carries rel="noopener noreferrer" as a hardening best practice. Renderer test updated for the new attribute and asserts every rendered link carries it.	2026-08-25 15:15:31 +00:00
bot-implementer	f278df1214	test: component + unit tests for the reading list page ... Covers: page wiring and nav reachability, data-file integrity, grouped rendering, valid hrefs, optional notes, HTML escaping, invalid-entry skipping, data-only extensibility, and a 500-entry fixture (counts, grouping, and a generous render-time bound).	2026-08-25 12:30:10 +00:00
bot-implementer	d94e769806	test: component + unit tests for the contact page	2026-08-25 10:45:36 +00:00
bot-implementer	2f5c522cc3	test: unit tests for the mailto URL builder	2026-08-25 10:45:28 +00:00
bot-implementer	f77720c10b	chore: add scaffold smoke test	2026-08-25 10:44:19 +00:00