cesnimda
38a58871ac
Implements AUDIT_REPORT.md M-2 and M-5: - M-2: CSP (script-src 'self'; frame-ancestors 'none'; object-src 'none'; ...), nosniff, X-Frame-Options DENY, Referrer-Policy on the SPA nginx, plus gzip for the bundle. The inline theme bootstrap moved to /theme-init.js so script-src 'self' holds with no inline scripts. - M-5: vite 5 -> 8 (+ plugin-react 6) — clears the dev-only esbuild advisories; npm audit now reports 0 vulnerabilities including dev deps. Build verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
10 lines
407 B
JavaScript
10 lines
407 B
JavaScript
// Applied before first paint to avoid a flash of the wrong theme. Lives in a file (not
|
|
// inline) so the SPA can ship a CSP with script-src 'self' (AUDIT M-2).
|
|
(function () {
|
|
try {
|
|
// Dark-first: default new users to dark unless they've chosen light.
|
|
var t = localStorage.getItem('ii:theme') || 'dark';
|
|
if (t === 'dark') document.documentElement.classList.add('dark');
|
|
} catch (e) {}
|
|
})();
|