maziggy 30cf384b5a fix: render Swagger UI at /docs with a docs-scoped CSP ...

The global CSP set script-src 'self', so FastAPI's /docs page rendered
  blank: the inline boot <script> and the cdn.jsdelivr.net swagger-ui
  bundle/CSS were both blocked. /redoc and /docs/oauth2-redirect had the
  same problem.

  Branch the security_headers_middleware to emit a docs-scoped CSP for
  those three paths that allows cdn.jsdelivr.net (scripts + styles), the
  FastAPI/Redoc favicon hosts (images), and 'unsafe-inline' for the
  inline boot script. Every other route keeps the stricter SPA policy
  unchanged.

2026-04-25 11:29:16 +02:00

..

app

fix: render Swagger UI at /docs with a docs-scoped CSP

2026-04-25 11:29:16 +02:00

tests

Revert "feat(oidc): Azure Entra ID support — configurable email claim & verification + Remember Me persistent login (#1118)"

2026-04-25 11:05:32 +02:00

__init__.py

…