diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-07-27 21:18:47 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-07-27 21:18:47 +0200 |
| commit | 512e6681418c354fea02761440e701c0f7ade693 (patch) | |
| tree | b2e9e75b330b0f9f3f7d4499d994c2d5119f18cd /internal/web | |
| parent | 706800b6635dd2327ccc91107795d1d6a663d27e (diff) | |
| download | lectio-512e6681418c354fea02761440e701c0f7ade693.tar.gz lectio-512e6681418c354fea02761440e701c0f7ade693.zip | |
docs: design spec for calendar API (JSON + iCal), security-first
Two surfaces, one engine: CLI --format json|ical (offline/pipeable) + thin
lectio-web /api/calendar.json + /calendar.ics endpoints. Pure internal/calfeed
renderer. Identity + reading citations (no full text). Security section:
range-cap DoS control (1830d web), RFC-5545 iCal injection escaping (custom
calendar names are untrusted), strict input validation, nosniff content types,
no file/layer injection over HTTP, GET-only.
Diffstat (limited to 'internal/web')
0 files changed, 0 insertions, 0 deletions