feat: add security headers and enhance accessibility

Author: strahe

internal/admin/server.go

@@ -253,7 +253,7 @@ func (s *Server) Run(ctx context.Context) error {
 
 	srv := &http.Server{
 		Addr:              s.addr,
-		Handler:           mux,
+		Handler:           withSecurityHeaders(mux),
 		ReadHeaderTimeout: 5 * time.Second,
 		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       60 * time.Second,
@@ -282,6 +282,15 @@ func (s *Server) Run(ctx context.Context) error {
 	}
 }
 
+func withSecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		next.ServeHTTP(w, r)
+	})
+}
+
 type healthResponse struct {
 	Status string   `json:"status"`
 	Errors []string `json:"errors,omitempty"`

internal/admin/server_test.go

@@ -359,3 +359,27 @@ func TestRefreshMetrics(t *testing.T) {
 		}
 	}
 }
+
+func TestWithSecurityHeaders(t *testing.T) {
+	handler := withSecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	res := rec.Result()
+	defer func() { _ = res.Body.Close() }()
+
+	if got := res.Header.Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+	if got := res.Header.Get("X-Frame-Options"); got != "DENY" {
+		t.Errorf("X-Frame-Options = %q, want DENY", got)
+	}
+	if got := res.Header.Get("Referrer-Policy"); got != "strict-origin-when-cross-origin" {
+		t.Errorf("Referrer-Policy = %q, want strict-origin-when-cross-origin", got)
+	}
+}

internal/db/repository/task_repo_test.go

@@ -421,6 +421,42 @@ func TestTaskRepo_Complete(t *testing.T) {
 	}
 }
 
+func TestTaskRepo_CompleteWithMessage(t *testing.T) {
+	db := testDB(t)
+	repos := repository.NewRepositories(db)
+	ctx := context.Background()
+
+	seedTask(t, repos, model.TaskTypeUpload)
+	claimed, err := repos.Tasks.ClaimReady(ctx, model.TaskTypeUpload, 5*time.Minute)
+	if err != nil {
+		t.Fatalf("ClaimReady: %v", err)
+	}
+	if claimed == nil {
+		t.Fatal("setup: could not claim task")
+	}
+
+	message := "completed successfully with special condition"
+	if err := repos.Tasks.CompleteWithMessage(ctx, claimed, message); err != nil {
+		t.Fatalf("CompleteWithMessage: %v", err)
+	}
+
+	task, err := repos.Tasks.GetByID(ctx, claimed.ID)
+	if err != nil {
+		t.Fatalf("GetByID: %v", err)
+	}
+	if task == nil {
+		t.Fatal("expected task to be found, got nil")
+	}
+	if task.Status != model.TaskStatusCompleted {
+		t.Errorf("expected status %s, got %s", model.TaskStatusCompleted, task.Status)
+	}
+	if task.StatusMessage == nil {
+		t.Errorf("expected status_message %q, got nil", message)
+	} else if *task.StatusMessage != message {
+		t.Errorf("expected status_message %q, got %q", message, *task.StatusMessage)
+	}
+}
+
 func TestTaskRepo_Complete_NotRunning(t *testing.T) {
 	db := testDB(t)
 	repos := repository.NewRepositories(db)

ui/src/routes/index.tsx

@@ -180,7 +180,14 @@ function StorageHealthCard({ health }: { health: OverviewData['filecoin_storage_
               </span>
               <span className="font-semibold text-foreground">{formatOptionalPercent(dataSets.readyPercent)}</span>
             </div>
-            <div className="h-2 min-w-0 overflow-hidden rounded-full bg-muted">
+            <div
+              role="progressbar"
+              aria-label="Storage copy readiness"
+              aria-valuemin={dataSets.readyPercent != null ? 0 : undefined}
+              aria-valuemax={dataSets.readyPercent != null ? 100 : undefined}
+              aria-valuenow={dataSets.readyPercent ?? undefined}
+              className="h-2 min-w-0 overflow-hidden rounded-full bg-muted"
+            >
               <div
                 className={`h-full rounded-full ${healthStyle.progressClassName}`}
                 style={{ width: `${dataSets.readyPercent ?? 0}%` }}