3 Commits

Include renames

Author	SHA1	Message	Date
archipelagoandClaude Fable 5	56d6396142	feat(appgate): gate login gets the real dashboard badge + glass-button states ... - The badge is now the dashboard login's AnimatedLogo, square for square: inline SVG (20 white rects, 100ms stagger, 3s loop) inside the same gradient ring. The old <img> of favico-black-v2.svg baked a second ring into the ring and couldn't animate; the asset leaves the gate allowlist since nothing references it now. - The submit button is .glass-button longhand: hover lift + lightening + rim glow, active press, disabled dim — the flat darken-only hover read as broken next to /login. - Loading state: submitting flips the button to spinner + 'Signing in…'/ 'Verifying…' and disables it, via a single inline script admitted by CSP sha256 hash (not unsafe-inline; injected markup stays inert, and the page still works as a plain POST without JS). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-15 08:24:27 -04:00
archipelagoandClaude Fable 5	a80712963c	feat(appgate): proxied apps become embeddable — gate neutralizes frame blocking ... Apps that ship X-Frame-Options (Alby Hub: DENY) or a CSP frame-ancestors directive rendered as a dead grey pane in the dashboard's embedded app session; the historical fix was a bespoke per-app nginx strip proxy (gitea). The gate now removes X-Frame-Options and strips ONLY the frame-ancestors directive from proxied responses — the rest of the app's CSP passes through untouched. The clickjacking threat those headers address is handled the same way the gate's own pages handle it: every proxied request is authenticated first, and the gate already declares permissive frame-ancestors on its own responses. Unit-tested; verified live on archi-dev-box (Alby Hub embeds, CSP intact). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-12 13:05:25 -04:00
Archipelago	b67e1527a2	Archipelago — open-source initial import	2026-08-12 10:55:50 +00:00