[E30-S02] Provider allowlist and admin page #117

New Issue

2026-08-27T00:03:26Z

kpcto commented

2026-08-27 00:03:26 +00:00

Parent epic: [E30] Embeds (#56)

Intent

Persist and administer the exact-hostname embed provider allowlist, seeded with the approved providers and audited on every change.

Acceptance criteria

Store allowlisted embed providers in eppp_embed_providers with exact hostnames only and no wildcards
Seed the list with Observable, Datawrapper, CodePen, youtube-nocookie.com, player.vimeo.com and archive.org
Support a configurable self-hosted Grafana host in the allowlist
Provide an admin-editable page with every change audited

Explicitly out of scope

CSP frame-src generation from the table is covered by E30-S04
oEmbed fetch and snapshot caching is covered by E30-S03

Test plan

Add, edit and remove a provider via the admin page and assert the audit record
Assert a wildcard hostname is rejected by the allowlist

Rollback note

Roll back the admin page; the provider table is additive and can be emptied

Owning stream

platform

Risk quadrant

agent-full

> Parent epic: [E30] Embeds (#56) ## Intent Persist and administer the exact-hostname embed provider allowlist, seeded with the approved providers and audited on every change. ## Acceptance criteria - Store allowlisted embed providers in `eppp_embed_providers` with exact hostnames only and no wildcards - Seed the list with Observable, Datawrapper, CodePen, `youtube-nocookie.com`, `player.vimeo.com` and `archive.org` - Support a configurable self-hosted Grafana host in the allowlist - Provide an admin-editable page with every change audited ## Explicitly out of scope - CSP `frame-src` generation from the table is covered by E30-S04 - oEmbed fetch and snapshot caching is covered by E30-S03 ## Test plan - Add, edit and remove a provider via the admin page and assert the audit record - Assert a wildcard hostname is rejected by the allowlist ## Rollback note - Roll back the admin page; the provider table is additive and can be emptied ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 00:03:26 +00:00

kpcto added the

labels 2026-08-27 00:03:26 +00:00

kpcto referenced this issue

2026-08-27 08:05:17 +00:00

[E30-S02-T01] Provider allowlist and admin page #312

Sign in to join this conversation.