Repository navigation

Audit 2026-11-12: UI and accessibility fixes - #13

Merged

Blackwellcode merged 31 commits into

masterfrom

audit/ui-fixes

Nov 12, 2026

Merged

Audit 2026-11-12: UI and accessibility fixes#13
Blackwellcode merged 31 commits into
masterfrom
audit/ui-fixes

Commits on Nov 12, 2026
- feat(webui): enforce CSP with per-request script nonces
  
  Blackwellcode
  and
  claude
  committed
  e9f5e3e
- refactor(templates): bind events without inline handlers; harden chat and banner output
  
  Blackwellcode
  and
  claude
  committed
  283ed99
- perf(css): load stylesheets as parallel <link>s instead of an @import chain
  
  Blackwellcode
  and
  claude
  committed
  ba3b3e2
- fix(a11y): skip link, labelled search, <dialog> password modal, AA tokens
  
  Blackwellcode
  and
  claude
  committed
  f54919c
- feat(ux): confirmation dialog for restart, maintenance and destructive admin actions
  
  Blackwellcode
  and
  claude
  committed
  7221095
- fix(a11y): user/group modals as <dialog> with focus management and labels
  
  Blackwellcode
  and
  claude
  committed
  d1dfd73
- fix(a11y): bottom navigation below 768px, one focus colour, dialog styles
  
  Blackwellcode
  and
  claude
  committed
  bc6826e
- fix(a11y,ux): labels, headings, empty states and confirmations across pages
  
  Blackwellcode
  and
  claude
  committed
  df80a5e
- style(restyle): one token layer, dead CSS out, palette/type/radius via tokens
  
  Blackwellcode
  and
  claude
  committed
  7116d5d
- fix(overlays): send overlay tokens as headers, scripts out of inline for CSP
  
  Blackwellcode
  and
  claude
  committed
  3dca32d
- fix(a11y): default theme on Nebula tokens, remaining Lighthouse findings
  
  Blackwellcode
  and
  claude
  committed
  0cbadda
- fix(i18n): sentence-case msgids, one ellipsis, German in Sie form, catalogs rebuilt
  
  Blackwellcode
  and
  claude
  committed
  a3a1372
- fix(security): css_url filter for CSS url(), https images in CSP, strict nonce test
  
  Blackwellcode
  and
  claude
  committed
  4e56b54
- refactor(ux): one confirmation dialog, dialog strings via svT/JS_MESSAGES
  
  Blackwellcode
  and
  claude
  committed
  69badf8
- fix(i18n): translate the new UI strings in all 11 catalogs
  
  Blackwellcode
  and
  claude
  committed
  3b683ad
- refactor(overlays): shared overlay_audio.js, log failures instead of empty catch
  
  Blackwellcode
  and
  claude
  committed
  66f3390
- style(tokens): dynamic VOD cards and brand glyph on tokens
  
  Blackwellcode
  and
  claude
  committed
  97d79ed
- perf(lcp): eager above-the-fold images on the dashboards
  
  Blackwellcode
  and
  claude
  committed
  c1cf56c
- docs: changelog and .env.example for CSP enforcement and overlay headers
  
  Blackwellcode
  and
  claude
  committed
  1bbe002
- Merge origin/master (PR #12 backend audit fixes) into audit/ui-fixes
  
  Blackwellcode
  and
  claude
  committed
  0d05a3a
- feat(overlays): token from the URL fragment, OBS URLs shown in Options
  
  Blackwellcode
  and
  claude
  committed
  79cfafa
- feat(auth-ui): "Log out everywhere" in the rail, bottom nav and mobile pages
  
  Blackwellcode
  and
  claude
  committed
  b5624af
- docs(changelog): overlay #token= URLs and log out everywhere in the UI
  
  Blackwellcode
  and
  claude
  committed
  90df570
- fix(a11y): dialog button variants win over legacy page button rules; PR screenshots
  
  Blackwellcode
  and
  claude
  committed
  637114d
- fix(overlays): no polling without token, stop on 401, move ?token= into the fragment
  
  Blackwellcode
  and
  claude
  committed
  efb0423
- refactor(ux): files and VOD delete use the confirmation dialog only
  
  Blackwellcode
  and
  claude
  committed
  4fbb2bb
- style(a11y): exclude .sv-btn from legacy button rules, tokens instead of literals; PWA banner above the bottom nav
  
  Blackwellcode
  and
  claude
  committed
  196df90
- fix(a11y): unique field ids in the add/edit storage provider modals
  
  Blackwellcode
  and
  claude
  committed
  f1443bd
- refactor(templates): logout-everywhere form as one include
  
  Blackwellcode
  and
  claude
  committed
  7ce4981
- fix(i18n): login throttle plural in all catalogs
  
  Blackwellcode
  and
  claude
  committed
  ac731b4
- test(webui): shared admin client, node logic tests for overlays, B and OBS panel
  
  Blackwellcode
  and
  claude
  committed
  f756fe8

Commits

Commits on Nov 12, 2026