tanshu
af083415a7
Every mutating form now carries the CSRF token as a hidden field, and the upload route accepts it as a multipart field as well as a header. Driving the real UI in Firefox found what the header-only tests could not: Create Draft, Save, Publish, Delete and the up/down buttons all posted without a token and were rejected. Adds npm run check-site, which verifies a running Site from the outside and exits non-zero so it can gate a cutover.
32 lines
785 B
JSON
32 lines
785 B
JSON
{
|
|
"name": "menu-admin",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">=24"
|
|
},
|
|
"scripts": {
|
|
"start": "node src/server.ts",
|
|
"dev": "SECURE_COOKIES=false node --watch src/server.ts",
|
|
"seed": "node scripts/seed-dev.ts",
|
|
"check-site": "node scripts/check-site.ts",
|
|
"verify": "node src/cli/verify.ts",
|
|
"repair": "node src/cli/repair.ts",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "node --test test/*.test.ts"
|
|
},
|
|
"dependencies": {
|
|
"@fastify/cookie": "^11.1.2",
|
|
"@fastify/formbody": "^9.0.0",
|
|
"@fastify/multipart": "^10.1.2",
|
|
"@fastify/static": "^10.1.4",
|
|
"fastify": "^5.12.5",
|
|
"sharp": "^0.35.4"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^26.6.2",
|
|
"typescript": "^7.0.2"
|
|
}
|
|
}
|