admin/e-ticket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
179a0703f8dcb4b0039330f81f2163ae9fe0ed26
e-ticket/config/packages/nelmio_security.yaml

95 lines
2.9 KiB
YAML
Raw Normal View History

Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
nelmio_security:
clickjacking:
paths:
'^/.*': DENY
content_type:
nosniff: true
referrer_policy:
enabled: true
policies:
- 'no-referrer'
- 'strict-origin-when-cross-origin'
csp:
enforce:
level1_fallback: false
browser_adaptive:
enabled: false
report-uri: '%router.request_context.base_url%/my-csp-report'
frame-ancestors:
Add Billet entity, BilletDesign, ticket designer, CRUD billets, commissions - Create Billet entity: name, position, priceHT, quantity (nullable=unlimited), isGeneratedBillet, hasDefinedExit, notBuyable, type (billet/reservation_brocante/vote), stripeProductId, description, picture (VichUploader), category (ManyToOne CASCADE) - Create BilletDesign entity (OneToOne Event): accentColor, invitationTitle, invitationColor - Billet CRUD: add/edit/delete with access control, Stripe product sync on connected account - Billet reorder: drag & drop with position field, refactored sortable.js for both categories and billets - Ticket designer tab (custom offer only): accent color, invitation title/color, live iframe preview - A4 ticket preview: 4 zones (HG infos+billet, HD affiche, BG association, BD sortie+invitation), fake QR code SVG - Commission calculator JS: live breakdown of E-Ticket fee, Stripe fee (1.5%+0.25EUR), net amount - Sales recap on categories tab: qty sold, total HT, total commissions, total net - DisableProfilerSubscriber: disable web profiler toolbar on preview iframe - CSP: allow self in frame-src and frame-ancestors for preview iframe - Flysystem: dedicated billets.storage for billet images - Upload accept restricted to png/jpeg/webp/gif (no HEIC) - Makefile: add force_sql_dev command - CLAUDE.md: add rule to never modify existing migrations - Consolidate all migrations into single Version20260321111125 - Tests: BilletTest (20), BilletDesignTest (6), DisableProfilerSubscriberTest (5), billet-designer.test.js (7), commission-calculator.test.js (7), AccountControllerTest billet CRUD tests (11) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 12:19:46 +01:00
- 'self'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
frame-src:
Add Billet entity, BilletDesign, ticket designer, CRUD billets, commissions - Create Billet entity: name, position, priceHT, quantity (nullable=unlimited), isGeneratedBillet, hasDefinedExit, notBuyable, type (billet/reservation_brocante/vote), stripeProductId, description, picture (VichUploader), category (ManyToOne CASCADE) - Create BilletDesign entity (OneToOne Event): accentColor, invitationTitle, invitationColor - Billet CRUD: add/edit/delete with access control, Stripe product sync on connected account - Billet reorder: drag & drop with position field, refactored sortable.js for both categories and billets - Ticket designer tab (custom offer only): accent color, invitation title/color, live iframe preview - A4 ticket preview: 4 zones (HG infos+billet, HD affiche, BG association, BD sortie+invitation), fake QR code SVG - Commission calculator JS: live breakdown of E-Ticket fee, Stripe fee (1.5%+0.25EUR), net amount - Sales recap on categories tab: qty sold, total HT, total commissions, total net - DisableProfilerSubscriber: disable web profiler toolbar on preview iframe - CSP: allow self in frame-src and frame-ancestors for preview iframe - Flysystem: dedicated billets.storage for billet images - Upload accept restricted to png/jpeg/webp/gif (no HEIC) - Makefile: add force_sql_dev command - CLAUDE.md: add rule to never modify existing migrations - Consolidate all migrations into single Version20260321111125 - Tests: BilletTest (20), BilletDesignTest (6), DisableProfilerSubscriberTest (5), billet-designer.test.js (7), commission-calculator.test.js (7), AccountControllerTest billet CRUD tests (11) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 12:19:46 +01:00
- 'self'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
- 'https://stripe.com'
- 'https://*.stripe.com'
- 'https://js.stripe.com'
- 'https://cloudflare.com'
- 'https://*.cloudflareinsights.com'
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- 'https://challenges.cloudflare.com'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
script-src:
- 'self'
- 'https://static.cloudflareinsights.com'
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- 'https://challenges.cloudflare.com'
Switch Leaflet from unpkg to jsdelivr CDN to avoid sourcemap requests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:38:07 +01:00
- 'https://cdn.jsdelivr.net'
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- 'unsafe-inline'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
style-src:
- 'self'
- 'https://fonts.googleapis.com'
- 'https://cdnjs.cloudflare.com'
Switch Leaflet from unpkg to jsdelivr CDN to avoid sourcemap requests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:38:07 +01:00
- 'https://cdn.jsdelivr.net'
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- 'unsafe-inline'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
img-src:
- 'self'
- 'data:'
Replace OSM iframe with Leaflet map: marker, zoom, geocoding via Nominatim - Add event-map.js module: loads Leaflet dynamically, geocodes address, renders map with marker at zoom 16 - Remove iframe, address text and OSM link below map - Add CSP entries for unpkg (Leaflet), tile.openstreetmap.org (tiles), nominatim (geocoding) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:35:54 +01:00
- 'https://*.tile.openstreetmap.org'
Use CartoDB Positron light theme for event map, matches neo-brutalist design Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:37:32 +01:00
- 'https://*.basemaps.cartocdn.com'
Switch Leaflet from unpkg to jsdelivr CDN to avoid sourcemap requests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:38:07 +01:00
- 'https://cdn.jsdelivr.net'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
worker-src:
- 'self'
- 'blob:'
connect-src:
- 'self'
- 'https://cloudflareinsights.com'
- 'https://static.cloudflareinsights.com'
Add cookie consent widget with analytics tunnel bypass for adblock - Create cookie-consent.js module: banner show/hide, cookie management, conditional analytics loading - Add cookie banner widget in base.html.twig (accept/refuse buttons) - Analytics script loaded from /stats/ tunnel (bypass adblock) with data-host-url - Add Caddy reverse proxy tunnel /stats/* -> tools-security.esy-web.dev - Add tools-security.esy-web.dev to CSP connect-src - Add 9 JS tests for cookie consent - Revert manual composer.json edit for amazon-mailer (needs composer require) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:02:36 +01:00
- 'https://tools-security.esy-web.dev'
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- 'https://challenges.cloudflare.com'
Replace OSM iframe with Leaflet map: marker, zoom, geocoding via Nominatim - Add event-map.js module: loads Leaflet dynamically, geocodes address, renders map with marker at zoom 16 - Remove iframe, address text and OSM link below map - Add CSP entries for unpkg (Leaflet), tile.openstreetmap.org (tiles), nominatim (geocoding) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:35:54 +01:00
- 'https://nominatim.openstreetmap.org'
Add cdn.jsdelivr.net to CSP connect-src for Leaflet source maps Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 18:38:24 +01:00
- 'https://cdn.jsdelivr.net'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
font-src:
- 'self'
- 'https://cdnjs.cloudflare.com'
- 'https://fonts.googleapis.com'
- 'https://fonts.gstatic.com'
object-src:
- 'none'
Add SSO E-Cosplay (Keycloak OIDC) and dynamic navbar active state - Install knpuniversity/oauth2-client-bundle and stevenmaguire/oauth2-keycloak - Register KnpUOAuth2ClientBundle in bundles.php - Configure Keycloak OIDC client (realm e-cosplay, auth.esy-web.dev) - Add keycloakId field to User entity with migration - Create KeycloakAuthenticator with group-to-role mapping (/superadmin -> ROLE_ROOT) - Create OAuthController with SSO routes (/connection/sso/login, logout, check) - Add custom_authenticator to security firewall with form_login entry point - Add auth.esy-web.dev to nelmio external_redirects whitelist and CSP form-action - Add SSO button and error flash messages to login page - Make navbar active state dynamic based on current route (desktop + mobile) - Add Keycloak env vars to .env, .env.local, and ansible/env.local.j2 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 10:38:19 +01:00
form-action:
- 'self'
- 'https://auth.esy-web.dev'
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
block-all-mixed-content: true
permissions_policy:
enabled: true
policies:
payment: ['self']
camera: ['self']
microphone: []
geolocation: ['self']
external_redirects:
override: /external-redirect
forward_as: redirUrl
log: true
allow_list:
- cloudflareinsights.com
- static.cloudflareinsights.com
- stripe.com
Refactor Stripe integration: single Connect webhook, account pages, cleanup Stripe webhook: - Single webhook endpoint /stripe/webhook for Connect + payment events - v2 Connect events configured manually in Stripe Dashboard (not via API) - account.updated syncs charges_enabled/payouts_enabled via API retrieve - Remove StripeSyncCommand and saveWebhookSecret (secret managed via Ansible vault) Account page (/mon-compte): - Buyer tabs: Billets, Achats, Factures, Parametres - Organizer tabs: Evenements/Brocantes, Sous-comptes, Virements + buyer tabs - Stripe Connect status banner: setup required, pending verification, active, refused - Stripe Connect onboarding: create account, complete verification (GET links) - Dashboard Stripe: opens in new tab via createLoginLink (Express dashboard) - Cancel/close Stripe account: deletes via API + resets local fields - Stripe required message on events/subaccounts/payouts tabs when not active - Settings: organizer fields locked (name, address), email/phone editable - Return/refresh routes for Stripe Connect onboarding flow - Error handling with flash messages on all Stripe operations - Auto-sync Stripe status on /mon-compte visit StripeService cleanup: - Remove syncWebhook, saveWebhookSecret, getWebhookUrl, projectDir - Add deleteAccount method - Keep: verifyWebhookSignature, createAccountConnect, createAccountLink, createLoginLink Security: - Add connect.stripe.com and dashboard.stripe.com to nelmio whitelist - Add STRIPE_SK, STRIPE_WEBHOOK_SECRET, OUTSIDE_URL to .env.test Tests: 19 AccountControllerTest, 4 StripeWebhookControllerTest, 1 StripeServiceTest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 22:41:31 +01:00
- connect.stripe.com
Add S3/MinIO storage, nelmio security and CSP config - Flysystem S3 adapter configured for MinIO - Vich uploader switched to Flysystem S3 storage - Liip imagine loader/resolver on S3 - S3 client service with path style endpoint for MinIO - Nelmio security: CSP, clickjacking, permissions policy, external redirects - CSP dev: allow Vite HMR (localhost:5173) - CSP prod: nonce scripts, restricted form-action and connect-src - composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 21:10:45 +01:00
- checkout.stripe.com
- hooks.stripe.com
Refactor Stripe integration: single Connect webhook, account pages, cleanup Stripe webhook: - Single webhook endpoint /stripe/webhook for Connect + payment events - v2 Connect events configured manually in Stripe Dashboard (not via API) - account.updated syncs charges_enabled/payouts_enabled via API retrieve - Remove StripeSyncCommand and saveWebhookSecret (secret managed via Ansible vault) Account page (/mon-compte): - Buyer tabs: Billets, Achats, Factures, Parametres - Organizer tabs: Evenements/Brocantes, Sous-comptes, Virements + buyer tabs - Stripe Connect status banner: setup required, pending verification, active, refused - Stripe Connect onboarding: create account, complete verification (GET links) - Dashboard Stripe: opens in new tab via createLoginLink (Express dashboard) - Cancel/close Stripe account: deletes via API + resets local fields - Stripe required message on events/subaccounts/payouts tabs when not active - Settings: organizer fields locked (name, address), email/phone editable - Return/refresh routes for Stripe Connect onboarding flow - Error handling with flash messages on all Stripe operations - Auto-sync Stripe status on /mon-compte visit StripeService cleanup: - Remove syncWebhook, saveWebhookSecret, getWebhookUrl, projectDir - Add deleteAccount method - Keep: verifyWebhookSignature, createAccountConnect, createAccountLink, createLoginLink Security: - Add connect.stripe.com and dashboard.stripe.com to nelmio whitelist - Add STRIPE_SK, STRIPE_WEBHOOK_SECRET, OUTSIDE_URL to .env.test Tests: 19 AccountControllerTest, 4 StripeWebhookControllerTest, 1 StripeServiceTest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 22:41:31 +01:00
- dashboard.stripe.com
Add SSO E-Cosplay (Keycloak OIDC) and dynamic navbar active state - Install knpuniversity/oauth2-client-bundle and stevenmaguire/oauth2-keycloak - Register KnpUOAuth2ClientBundle in bundles.php - Configure Keycloak OIDC client (realm e-cosplay, auth.esy-web.dev) - Add keycloakId field to User entity with migration - Create KeycloakAuthenticator with group-to-role mapping (/superadmin -> ROLE_ROOT) - Create OAuthController with SSO routes (/connection/sso/login, logout, check) - Add custom_authenticator to security firewall with form_login entry point - Add auth.esy-web.dev to nelmio external_redirects whitelist and CSP form-action - Add SSO button and error flash messages to login page - Make navbar active state dynamic based on current route (desktop + mobile) - Add Keycloak env vars to .env, .env.local, and ansible/env.local.j2 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 10:38:19 +01:00
- auth.esy-web.dev
Adapt CSP for Cloudflare Under Attack Mode: add unsafe-inline and challenges.cloudflare.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 16:16:50 +01:00
- challenges.cloudflare.com
Reference in New Issue Copy Permalink