Merge pull request #120 from pitzzahh/patch/csp

patch: improve csp

Author: pitzzahh

.env.example

@@ -14,4 +14,4 @@ GITHUB_CLIENT_SECRET=your-github-client-secret
 # Email Configuration
 PLUNK_BASE_URL="https://next-api.useplunk.com"
 PLUNK_SECRET_KEY=your-plunk-secret-key
-EMAIL_VERIFICATION_TIMEOUT_MINUTES=email-timeout-in-minutes
+PUBLIC_EMAIL_VERIFICATION_TIMEOUT_MINUTES=email-timeout-in-minutes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "powertrackr",
-  "version": "1.0.1",
+  "version": "1.6.1",
   "private": true,
   "type": "module",
   "scripts": {

src/app.html

@@ -5,11 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="theme-color" content="#000000" />
     <link rel="manifest" href="/manifest.json" />
-    <link
-      rel="preload"
-      href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@300..700&display=swap"
-      as="style"
-    />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
       href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@300..700&display=swap"
       rel="stylesheet"

src/lib/api/auth.remote.ts

@@ -26,7 +26,7 @@ import {
   getPasswordResetSessionBy,
   updatePasswordResetSessionBy,
 } from "$/server/crud/password-reset-session-crud";
-import { createAndSendPasswordReset } from "$/server/email";
+import { createPasswordReset } from "$lib/server/email";
 
 import {
   encrypt,
@@ -359,7 +359,7 @@ export const forgotPassword = form(forgotPasswordSchema, async (user) => {
   }
 
   // Create password reset session and send email
-  await createAndSendPasswordReset(userResult.id!, email);
+  await createPasswordReset(userResult.id!, email);
 
   return { success: true };
 });

src/lib/api/email.remote.ts

@@ -9,7 +9,7 @@
 
 import { command, getRequestEvent } from "$app/server";
 import { error } from "@sveltejs/kit";
-import { createAndSendEmailVerification } from "$/server/email";
+import { createEmailVerification } from "$lib/server/email";
 
 export const resendVerification = command(async () => {
   const event = getRequestEvent();
@@ -32,15 +32,14 @@ export const resendVerification = command(async () => {
   }
 
   try {
-    const verification = await createAndSendEmailVerification(userId, email);
-
-    if (!verification) {
+    const verification = await createEmailVerification(userId, email);
+    if (verification) {
+      return { success: true, sent: true, requestId: verification.id ?? null };
+    } else {
       // Best-effort: the helper logs warnings on failure; surface a non-fatal response
-      console.warn("createAndSendEmailVerification did not create a verification for user", userId);
+      console.warn("Failed to create and send verification for user", userId);
       return { success: false, sent: false };
     }
-
-    return { success: true, sent: true, requestId: verification.id ?? null };
   } catch (e) {
     console.error("Failed to resend verification email for user", userId, e);
     error(500, "Failed to send verification email");

src/lib/components/ui/dropdown-menu/dropdown-menu-radio-item.svelte

@@ -22,7 +22,7 @@
   {...restProps}
 >
   {#snippet children({ checked })}
-    <span class="pointer-events-none absolute start-2 flex size-3.5 items-center justify-center">
+    <span class="pointer-events-none absolute inset-s-2 flex size-3.5 items-center justify-center">
       {#if checked}
         <CircleIcon class="size-2 fill-current" />
       {/if}