mirror of
https://github.com/luxfi/kms.git
synced 2026-07-27 03:38:31 +00:00
zeekay
50ad9fbd51
frontend CSP no longer needs to allow *.stripe.com (Infisical-era billing UI we don't use). Drop all stripe.com sources + the stripe-only child-src. Rename the Stripe-flavored example secret in zapserver/envelope tests to a neutral api-key/secret-value fixture. No Go code paths change.
41 lines
1.5 KiB
HTML
41 lines
1.5 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<link rel="icon" href="/favicon.ico" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<meta
|
|
http-equiv="Content-Security-Policy"
|
|
content="
|
|
default-src 'self';
|
|
connect-src 'self' http://127.0.0.1:* https://api.pwnedpasswords.com https://hcaptcha.com https://*.hcaptcha.com;
|
|
script-src 'self' https://hcaptcha.com https://*.hcaptcha.com 'unsafe-inline' 'unsafe-eval';
|
|
style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;
|
|
frame-src https://hcaptcha.com https://*.hcaptcha.com;
|
|
img-src 'self' data:;
|
|
media-src 'self';
|
|
font-src 'self' https://fonts.gstatic.com;
|
|
"
|
|
/>
|
|
<title>KMS</title>
|
|
<script>
|
|
// White-label by hostname. Brand mapping comes from runtime-ui-env.js
|
|
// (window.__BRAND_DOMAINS__) loaded next; default to Lux. Never bake
|
|
// tenant-specific domains into source.
|
|
(function () {
|
|
var h = (location.hostname || "").toLowerCase();
|
|
var b = { name: "Lux", title: "Lux KMS" };
|
|
if (/(^|\.)hanzo\.ai$/.test(h)) b = { name: "Hanzo", title: "Hanzo KMS" };
|
|
else if (/(^|\.)zoo\.(ngo|network)$/.test(h)) b = { name: "Zoo", title: "Zoo KMS" };
|
|
document.title = b.title;
|
|
window.__BRAND__ = b;
|
|
})();
|
|
</script>
|
|
<script src="/runtime-ui-env.js"></script>
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
<script type="module" src="/src/main.tsx"></script>
|
|
</body>
|
|
</html>
|