phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report: **Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)** - Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired. - No defects found; zero changes made — working tree left exactly as the task executors left it. - Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation. - Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings. - Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules. - Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted. - Next pending phase: **none** — 91 is the last phase in `todo/`.
2026-09-09 17:22:24 -04:00
parent 3095c4c577
commit d22d260b8b
74 changed files with 4448 additions and 675 deletions
@@ -149,6 +149,32 @@ def test_404_shaped_response_carries_all_three_headers() -> None:
    assert body_msg["body"] == b"not found"


+def test_pre_existing_csp_from_an_inner_layer_is_preserved() -> None:
+    """Phase 91 (task 05): the caching middleware publishes, on themed
+    HTML pages only, the A1 string EXTENDED with a ``style-src`` sha256
+    hash for the inline theme tag (the A1 policy would block the tag in
+    every real browser). A CSP an inner layer has already set is that
+    layer's deliberate one and must survive the outer middleware —
+    while the other two headers are still added."""
+    themed = (
+        "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; "
+        "style-src 'self' 'sha256-2rm3wPcQfXmE8q1s9vBzK7hN4tY5uJ6gW3oR0cAeDfH='"
+    )
+    wrapped = SecurityHeadersMiddleware(
+        _plain_app(
+            200,
+            b"<html></html>",
+            headers=[[b"content-security-policy", themed.encode("ascii")]],
+        )
+    )
+    sent = _drive(wrapped, _http_scope())
+
+    start = sent[0]
+    assert _header(start, "content-security-policy") == themed  # not clobbered
+    assert _header(start, "x-frame-options") == "DENY"
+    assert _header(start, "x-content-type-options") == "nosniff"
+
+
 # ---------------------------------------------------------------------------
 # The SSE streaming passthrough pin
 # ---------------------------------------------------------------------------