5 Commits

Author	SHA1	Message	Date
Mark	d0a550fee6	feat(comments): v2 — HTMX, Turnstile, reactions, design refresh ... - Extract comment templates into reusable partials (_comment.html, _comment_form.html, _comment_list.html, _reply_form.html, etc.) - Add HTMX progressive enhancement: inline form submission with partial responses, delta polling for live updates, form reset on success, success/moderation toast feedback - Integrate Cloudflare Turnstile for invisible bot protection: server-side token validation with hostname check, fail-closed on errors/timeouts, feature-flagged via TURNSTILE_SECRET_KEY env var - Auto-approve comments that pass Turnstile; keep manual approval as fallback when Turnstile is disabled (model default stays False) - Add CommentReaction model with UniqueConstraint for session-based anonymous reactions (heart/thumbs-up), toggle support, separate rate-limit bucket (20/min) - Add comment poll endpoint (GET /comments/poll/<id>/?after_id=N) for HTMX delta polling without duplicates - Update CSP middleware to allow challenges.cloudflare.com in script-src, connect-src, and frame-src - Self-host htmx.min.js (v2.0.4) to minimize CSP surface area - Add django-htmx middleware and requests to dependencies - Add Unapprove bulk action to Wagtail admin for moderation - Extend PII purge command to anonymize reaction session_key - Design refresh: neon glow avatars, solid hover shadows, gradient section header, cyan reply borders, grid-pattern empty state, neon-pink focus glow on form inputs - Add turnstile_site_key to template context via context processor - 18 new tests covering HTMX contracts, Turnstile success/failure/ timeout/hostname-mismatch, polling deltas, reaction toggle/dedup/ rate-limit, CSP headers, and PII purge extension Closes #43 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-03 22:52:59 +00:00
Mark	43594777e0	fix(csp): skip restrictive CSP on Wagtail/Django admin paths ... The SecurityHeadersMiddleware applied a strict style-src policy to all responses, blocking inline styles that Wagtail admin relies on for layout. Skip the custom CSP for /cms/ and /django-admin/ paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-02 15:34:09 +00:00
codex_a	78c4313874	fix: allow Google Fonts in CSP ... style-src and font-src were 'self' only, blocking fonts.googleapis.com stylesheet and fonts.gstatic.com font files. Add both origins so Space Grotesk, Inter and Fira Code load correctly in production. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-01 11:31:41 +00:00
Codex_B	6fc28f9d9a	Implement newsletter double opt-in email flow and CSP nonce headers	2026-02-28 12:37:32 +00:00
Codex_B	b5f0f40c4c	Scaffold containerized Django/Wagtail app with core features	2026-02-28 11:52:59 +00:00