[E30-S02-T01] Provider allowlist and admin page #312

New Issue

2026-08-27T08:05:17Z

kpcto commented

2026-08-27 08:05:17 +00:00

Parent story: [E30-S02] Provider allowlist and admin page (#117)

Intent

Implement the provider allowlist table and its audited admin page.

Acceptance criteria

Store allowlisted providers as exact hostnames with no wildcards in eppp_embed_providers
Seed Observable, Datawrapper, CodePen, youtube-nocookie.com, player.vimeo.com and archive.org
Provide an admin-editable page with every change audited

Explicitly out of scope

CSP frame-src generation is covered by E30-S04

Test plan

Edit the allowlist via the admin page and assert the audit record

Rollback note

Roll back the admin page; provider rows are additive

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E30-S02] Provider allowlist and admin page (#117) ## Intent Implement the provider allowlist table and its audited admin page. ## Acceptance criteria - Store allowlisted providers as exact hostnames with no wildcards in `eppp_embed_providers` - Seed Observable, Datawrapper, CodePen, `youtube-nocookie.com`, `player.vimeo.com` and `archive.org` - Provide an admin-editable page with every change audited ## Explicitly out of scope - CSP `frame-src` generation is covered by E30-S04 ## Test plan - Edit the allowlist via the admin page and assert the audit record ## Rollback note - Roll back the admin page; provider rows are additive ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 08:05:17 +00:00

kpcto added the

labels 2026-08-27 08:05:17 +00:00

Sign in to join this conversation.