Feat/convertx embed 16650462168991176367

[cookiebaits]

Summary by cubic

Enables cross-origin iframe embedding by setting cookies to SameSite=None on HTTPS-only deployments. Also updates Tailwind, ESLint, and other dev dependencies.

• New Features

  • Cookies now use SameSite: none with Secure when HTTPS is enforced, allowing sessions inside cross-origin iframes.
  • Added agent.md with universal developer instructions.

• Dependencies

  • Bumped tailwindcss, @tailwindcss/cli, and @tailwindcss/postcss to 4.3.3.
  • Updated eslint to ^10.8.0, prettier to ^3.9.6, postcss to ^8.5.24, tar to ^7.5.22, and @types/node to ^24.13.3.

^{Written for commit 1e05820. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/pages/user.tsx">

<violation number="1" location="src/pages/user.tsx:231">
P1: Authenticated cross-site POSTs now include `auth`, so a malicious site can trigger deletion/conversion requests in a logged-in user's session. Preserve CSRF protection for non-embedded sessions or add a validated CSRF/origin mechanism before using `SameSite=None`.</violation>

<violation number="2" location="src/pages/user.tsx:231">
P1: The `/register` POST handler was updated to use a dynamic `sameSite` value for embed support (`"none"` on HTTPS, `"lax"` on HTTP), but the `/login` POST handler in the same file still sets `sameSite: "strict"`. Both handlers set the identical `auth` cookie for the same session-token purpose, so they must use consistent cookie attributes. Users who log in will get a `SameSite=Strict` cookie that won't be sent on cross-origin embed requests, defeating the embed feature for the login flow. Apply the same conditional `sameSite` logic to the login handler.</violation>
</file>

<file name="agent.md">

<violation number="1" location="agent.md:1">
P1: agent.md has broken markdown structure: every line that begins with '# ' renders as an H1 heading, so the entire file is a flat list of H1 elements. Body paragraphs, numbered lists, and subheadings are all flattened, making the document unreadable as structured markdown. Remove the leading '# ' prefix from body-text lines and remove '\#' escaping from intended headings.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Authenticated cross-site POSTs now include auth, so a malicious site can trigger deletion/conversion requests in a logged-in user's session. Preserve CSRF protection for non-embedded sessions or add a validated CSRF/origin mechanism before using SameSite=None.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 231:

<comment>Authenticated cross-site POSTs now include `auth`, so a malicious site can trigger deletion/conversion requests in a logged-in user's session. Preserve CSRF protection for non-embedded sessions or add a validated CSRF/origin mechanism before using `SameSite=None`.</comment>

<file context>
@@ -228,7 +228,7 @@ export const user = new Elysia()
         secure: !HTTP_ALLOWED,
         maxAge: 60 * 60 * 24 * 7,
-        sameSite: "strict",
+        sameSite: !HTTP_ALLOWED ? "none" : "lax",
       });
 
</file context>

[cubic-dev-ai]

P1: agent.md has broken markdown structure: every line that begins with '# ' renders as an H1 heading, so the entire file is a flat list of H1 elements. Body paragraphs, numbered lists, and subheadings are all flattened, making the document unreadable as structured markdown. Remove the leading '# ' prefix from body-text lines and remove '#' escaping from intended headings.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At agent.md, line 1:

<comment>agent.md has broken markdown structure: every line that begins with '# ' renders as an H1 heading, so the entire file is a flat list of H1 elements. Body paragraphs, numbered lists, and subheadings are all flattened, making the document unreadable as structured markdown. Remove the leading '# ' prefix from body-text lines and remove '\#' escaping from intended headings.</comment>

<file context>
@@ -0,0 +1,65 @@
+# \# Universal AI Developer Instructions
+
+#
</file context>

[cubic-dev-ai]

P1: The /register POST handler was updated to use a dynamic sameSite value for embed support ("none" on HTTPS, "lax" on HTTP), but the /login POST handler in the same file still sets sameSite: "strict". Both handlers set the identical auth cookie for the same session-token purpose, so they must use consistent cookie attributes. Users who log in will get a SameSite=Strict cookie that won't be sent on cross-origin embed requests, defeating the embed feature for the login flow. Apply the same conditional sameSite logic to the login handler.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 231:

<comment>The `/register` POST handler was updated to use a dynamic `sameSite` value for embed support (`"none"` on HTTPS, `"lax"` on HTTP), but the `/login` POST handler in the same file still sets `sameSite: "strict"`. Both handlers set the identical `auth` cookie for the same session-token purpose, so they must use consistent cookie attributes. Users who log in will get a `SameSite=Strict` cookie that won't be sent on cross-origin embed requests, defeating the embed feature for the login flow. Apply the same conditional `sameSite` logic to the login handler.</comment>

<file context>
@@ -228,7 +228,7 @@ export const user = new Elysia()
         secure: !HTTP_ALLOWED,
         maxAge: 60 * 60 * 24 * 7,
-        sameSite: "strict",
+        sameSite: !HTTP_ALLOWED ? "none" : "lax",
       });
 
</file context>