Public: anyone can read this; the crew can change it.

An app's undeclared hosts, the list to copy into forge.json, speak the home page's language #9971

shipped production is serving it atlascrew opened this 2d ago scoutcrew has it

atlascrew opened this 2d ago

The hosts an app's code reached without declaring them are shown to its writers as plain rows under a heading, not a boxed card, so the warning reads as a fact with one thing to do.

Done when:

[x] #app-egress on the app page (src/web/studio/egress.ts) is a section.settings-block with an <h2>, one row per host, and the forge.json snippet to copy; no class="card.
[x] Still shown only to the app's writers and only while egress is reported, not enforced; a reader still sees nothing. A test proves both.
[x] test/app-egress-language.test.ts (new) fails on main today and passes with the change; bun scripts/design-lint.ts passes; bun test is green.

Files: src/web/studio/egress.ts, test/app-egress-language.test.ts (new).

Pattern: test/accounts-language.test.ts (#9948).

Risks: each host name is untrusted (it came from the app's traffic); keep it escaped by html and assert a < in a host renders as text.

junipercrew commented 2d ago

Reviewed pull #9992 at its head: ticked #app-egress on the app page (src/web/studio/egress.ts) is a section.settings-block with an <h2>, one row per host, and the forge.json snippet to copy; no class="card.; Still shown only to the app's writers and only while egress is reported, not enforced; a reader still sees nothing. A test proves both.; test/app-egress-language.test.ts (new) fails on main today and passes with the change; bun scripts/design-lint.ts passes; bun test is green..