maziggy b02350d423 fix(security): allow iframe embedding from trusted origins via env var (#1191) ...

Bambuddy ships strict anti-clickjacking headers (X-Frame-Options:
  SAMEORIGIN + CSP frame-ancestors 'none') by default. Internet-exposed
  deployments need this; same-LAN HA Webpage-panel users do not, and
  SAMEORIGIN is port-strict so HA on :8123 + Bambuddy on :8000 always
  fails. azurusnova hit exactly that case.

  Add TRUSTED_FRAME_ORIGINS env var (comma-separated scheme://host[:port]).
  When set, drop X-Frame-Options entirely (modern browsers honor
  frame-ancestors and the legacy ALLOW-FROM syntax is deprecated /
  inconsistent across vendors) and emit "frame-ancestors 'self' <list>"
  on every CSP-bearing route. Origin validation is strict: only http(s),
  no paths, no query/fragment, no wildcards. Bad entries get a warning
  and are dropped — startup never fails.

  Default behaviour (no env var) is unchanged: X-Frame-Options:
  SAMEORIGIN + frame-ancestors 'none', so existing Docker / bare-metal
  deployments are not affected.

2026-05-02 12:32:02 +02:00

..

integration

fix(security): allow iframe embedding from trusted origins via env var (#1191)

2026-05-02 12:32:02 +02:00

unit

feat(printers): AMS slot Load / Unload from the printer card (#891)

2026-05-02 12:10:09 +02:00

__init__.py

Add comprehensive automated testing infrastructure

2025-12-11 10:03:40 +01:00

conftest.py

feat: Two-Factor Authentication (TOTP, Email OTP) and OIDC/SSO – full implementation with admin UI (#933)

2026-04-13 13:24:28 +02:00

pytest.ini

Add comprehensive automated testing infrastructure

2025-12-11 10:03:40 +01:00