shad/canvas-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: rebuild Process Studio into multi-phase Process Creation Wizard\n\n- Replace toy Studio.tsx with proper Wizard.tsx canvas\n- Build 6-step flow: Intake -> Analyze -> Generate -> Validate -> Draft saved -> Publish\n- Implement incremental EA2 writes via wizardApi.ts (flow, batch apply)\n- Use localStorage for draft recovery across reloads\n- Apply industrial-blueprint UI styling matching core doctrine\n- Add Vitest tests for Wizard components and API wrappers

Browse Source
This commit is contained in:
shad
2026-06-14 03:47:26 +04:00
parent b2c1e57c86
commit 4bc7ae228a
27 changed files with 2274 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx.conf
+31 -7
View File
@@ -1,31 +1,55 @@
map $sent_http_content_type $csp_header {
default "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self' https://demo.flow-master.ai https://canvas.flow-master.ai wss://canvas.flow-master.ai; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'";
}
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
index index.html;
# Reverse-proxy /api to the demo backend so live mode works
# same-origin without CORS gymnastics. Backend is reached via the
# cluster-internal service rewritten by the ingress to demo.flow-master.ai.
# Hardening — every response carries these.
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(self), geolocation=(self), payment=()" always;
add_header Content-Security-Policy $csp_header always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header X-Robots-Tag "noindex, nofollow" always;
# Reverse-proxy /api to the demo backend so live mode is same-origin.
location /api/ {
proxy_pass https://demo.flow-master.ai;
proxy_set_header Host demo.flow-master.ai;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_ssl_server_name on;
proxy_http_version 1.1;
proxy_read_timeout 30s;
proxy_buffering off;
}
# SPA: everything else falls back to index.html.
# SPA fallback to index.html for client-side routing.
location / {
try_files $uri $uri/ /index.html;
add_header Cache-Control "no-cache";
add_header Cache-Control "no-cache" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(self), geolocation=(self), payment=()" always;
add_header Content-Security-Policy $csp_header always;
}
# Static assets with content hashes in their filenames cache forever.
# Hashed static assets cache forever.
location /assets/ {
try_files $uri =404;
add_header Cache-Control "public, max-age=31536000, immutable";
add_header Cache-Control "public, max-age=31536000, immutable" always;
}
# Hide nginx version on errors.
server_tokens off;
}