Fabrika/PersonalBlog
8
0
Fork 1
Code Issues 305 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

[Story] Newsletter signup (serverless) #15

Merged
kpcto merged 5 commits from feature/14 into main 2026-08-26 11:44:11 +00:00
Conversation 1 Commits 5 Files Changed 10
+664 -1
5 Commits
Author SHA1 Message Date
implementer 32c81d8b91 test: add 3xx-redirect failure and no-credential-header/URL checks
CI / Run tests (pull_request) Successful in 16s
Details
CI / Secret scan (gitleaks) (pull_request) Failing after 13s
Details 
Extends the newsletter suite with two boundary cases: redirects (301/302/307/
308) must be treated as failures with the user-safe error, and the POST must
carry no credential of any kind — no api-key/auth-token/cookie headers, and no
token/secret in the body or URL.
 2026-08-26 11:31:54 +00:00
implementer 86aa3afbbf refactor: newsletter signup posts no credential (SEC-14-R1 option a)
CI / Secret scan (gitleaks) (pull_request) Failing after 12s
Details
CI / Run tests (pull_request) Successful in 15s
Details 
Rework PR #15 per security review SEC-14-R1: the client no longer carries
an API token. js/newsletter-config.js ships only the non-secret endpoint,
enforced https-only at config load time via validateEndpoint() (mirroring
the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs
email-only with no Authorization header. Failure paths keep the single
user-safe message that never leaks token, endpoint, status, or raw body;
success still shows the confirmation. CI gains a gitleaks step that fails
on any secret hit; README documents the server-side token, the residual
signup-abuse risk, and the authoritative server-side validation follow-up.
 2026-08-26 11:27:11 +00:00
bot-implementer cb9cf703a8 docs: document the newsletter page and its config in the README
CI / Run tests (pull_request) Successful in 16s
Details
2026-08-25 19:15:56 +00:00
bot-implementer 49690a7934 test: component + unit tests for the newsletter signup 
Covers the issue test plan: form renders and posts to the endpoint; token is
read from config, never hardcoded in source; a failed-token response shows a
user-safe error without leaking the secret; confirmation on success.
 2026-08-25 19:15:56 +00:00
bot-implementer 24db5b8a50 feat: add serverless newsletter signup page 
Adds newsletter.html with an email signup form that POSTs to a configured
serverless endpoint. The endpoint and API token live in
js/newsletter-config.js (token defaults to an empty deploy-time placeholder,
never hardcoded in page logic). Missing/invalid tokens and network failures
surface a fixed user-safe error; successful signups show a confirmation.
Links the page from the site navigation on all pages.
 2026-08-25 19:15:56 +00:00