fix: use config service for head.html, rewrite its CSP - #276

Merged

benpeter merged 80 commits into

mainfrom

Aug 26, 2026

Commits on Aug 11, 2026

test: a missing site is the 404, and an upstream that cannot answer is the 503
benpeter
committed
c31263d
fix: ask the config service what exists, and stop guessing what silence means
benpeter
committed
4686062
chore: point at the config service, and deploy with the wrangler the repo pins
benpeter
committed
b33f8cc
ci: bump wrangler-action to v4, which knows the required-secrets declaration
benpeter
committed
e5a14ce

Commits on Aug 12, 2026

Commits on Aug 13, 2026

test: the store comes from the config service content source, not /ping
benpeter
committed
b490ca3

Commits on Aug 14, 2026

Commits on Aug 17, 2026

chore: clarify naming

benpeter
and
tripodsan
authored
c2268bc
fix: keep latin-1 characters in x-error instead of blanking them

benpeter
and
tripodsan
authored
52637bd
fix: finish the withUpstream rename in da-admin, the branch did not load
benpeter
committed
c2364ea
test: causeOf keeps latin-1 and blanks the controls
benpeter
committed
6f2363f
fix: blank the c1 controls, invisible in x-error
benpeter
committed
be3a7bb
Merge remote-tracking branch 'origin/main' into headhtml
benpeter
committed
8a315e8

Commits on Aug 18, 2026

Commits on Aug 19, 2026

fix: trust experience-stage.adobe.com, for a first-class stage UE entry
benpeter
committed
0a3da6c

Commits on Aug 20, 2026

test: cover composed CSP nonce forwarding
benpeter
committed
e218828
fix: apply composed CSP nonces
benpeter
committed
03b2ad7
test: require one composed head source
benpeter
committed
ef872c8
fix: use the config-service head
benpeter
committed
aa1dd76
test: cover local UE host detection
benpeter
committed
2d096ed
fix: detect the local UE host
benpeter
committed
3466393
test: keep CSP nonces out of author content
benpeter
committed
c141198
fix: scope composed CSP handling to head
benpeter
committed
9f77783

Commits on Aug 21, 2026

test: pin the composed read and the write guards
benpeter
committed
fc12c04
fix: name the upstream the composed read failed on
benpeter
committed
53e0128
test: pin the route's CSP nonce ordering
benpeter
committed
6375ea3
test: separate a missing config service token from an outage
benpeter
committed
48fcfcd
fix: say when the config service token is the cause
benpeter
committed
5de6215
test: pin the CSP meta that stays in the document
benpeter
committed
4e2d4fb
chore: record why the CSP meta stays in the document
benpeter
committed
439ad03
fix: make the local stand-in exercise the composed page
benpeter
committed
15466d5
test: pin a throw from composing as the worker's own bug
benpeter
committed
7400ab3
fix: name the preview host on the read, not on composing
benpeter
committed
5dba1a8
chore: record the head source decision without commit shas
benpeter
committed
6c91218
test: pin the proxy read to the same upstream taxonomy
benpeter
committed
3c4e76d
fix: refuse a resource read the preview host could not answer
benpeter
committed
af14e2e
test: separate a refused site token exchange from a public site
benpeter
committed
d50e1e9
fix: say which status refused the site token exchange
benpeter
committed
d7da233
Merge remote-tracking branch 'origin/main' into headue
benpeter
committed
e109a73

Commits on Aug 25, 2026

refactor: fold resource503 into empty503, one body-less 503 helper

benpeter
and
Copilot
committed
730a9b2