[E30-S03] oEmbed resolution, snapshot cache, click-to-load island #118

New Issue

2026-08-27T00:03:27Z

kpcto commented

2026-08-27 00:03:27 +00:00

Parent epic: [E30] Embeds (#56)

Intent

Resolve, snapshot-cache and click-to-load embeds so no reader request reaches a third party before explicit interaction.

Acceptance criteria

Resolve the provider by exact host and surface unknown hosts as author-visible validation errors
Fetch oEmbed through the hardened fetch service where the provider offers it
Sanitise responses down to an iframe with an allowlisted src and dimensions, stripping everything else
Download and re-host the thumbnail locally so no hotlink leaks reader IPs
Refresh embeds on a 30-day cycle and record failures without breaking the page
Render live iframes click-to-load with sandbox, no-referrer, lazy loading and a required title
Make no third-party request before explicit reader interaction

Explicitly out of scope

The hardened fetch service itself is E30-S01 and the provider allowlist is E30-S02
CSP frame-src generation is covered by E30-S04

Test plan

Save content with an allowlisted embed and assert a local thumbnail and sanitised iframe
Assert no third-party request occurs before the reader clicks to load

Rollback note

Delete cached snapshots and re-resolve; no schema migration

Owning stream

platform

Risk quadrant

agent-full

> Parent epic: [E30] Embeds (#56) ## Intent Resolve, snapshot-cache and click-to-load embeds so no reader request reaches a third party before explicit interaction. ## Acceptance criteria - Resolve the provider by exact host and surface unknown hosts as author-visible validation errors - Fetch oEmbed through the hardened fetch service where the provider offers it - Sanitise responses down to an iframe with an allowlisted `src` and dimensions, stripping everything else - Download and re-host the thumbnail locally so no hotlink leaks reader IPs - Refresh embeds on a 30-day cycle and record failures without breaking the page - Render live iframes click-to-load with `sandbox`, no-referrer, lazy loading and a required title - Make no third-party request before explicit reader interaction ## Explicitly out of scope - The hardened fetch service itself is E30-S01 and the provider allowlist is E30-S02 - CSP `frame-src` generation is covered by E30-S04 ## Test plan - Save content with an allowlisted embed and assert a local thumbnail and sanitised iframe - Assert no third-party request occurs before the reader clicks to load ## Rollback note - Delete cached snapshots and re-resolve; no schema migration ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 00:03:27 +00:00

kpcto added the

labels 2026-08-27 00:03:27 +00:00

kpcto referenced this issue

2026-08-27 08:05:18 +00:00

[E30-S03-T01] oEmbed resolution, snapshot cache, click-to-load #313

Sign in to join this conversation.