From 75c2c77e06fb94902b17b6d56e95eefe51a66ea6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:49:22 +0000
Subject: [PATCH 1/9] Add CSP headers and sign-in fallback

---
 src/hooks.server.ts                           | 19 ++++++++++++++++++-
 .../components/sidebar/ConnectPanel.svelte    |  8 ++++----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index c0b865b..38f792e 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1 +1,18 @@
-export { handle } from './lib/auth/authHandler';
+import { sequence } from '@sveltejs/kit/hooks';
+import type { Handle } from '@sveltejs/kit';
+import { handle as authHandle } from './lib/auth/authHandler';
+
+const securityHeaders: Handle = async ({ event, resolve }) => {
+	const response = await resolve(event);
+
+	response.headers.set('X-Content-Type-Options', 'nosniff');
+	response.headers.set('X-Frame-Options', 'DENY');
+	response.headers.set(
+		'Content-Security-Policy',
+		"default-src 'self' blob: data: https://*.basemaps.cartocdn.com; font-src 'self'; img-src 'self' https://*.basemaps.cartocdn.com data: blob:; object-src 'none'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com blob: data:; style-src 'self' 'unsafe-inline'"
+	);
+
+	return response;
+};
+
+export const handle = sequence(securityHeaders, authHandle);
diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 811c2f0..67beb0b 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import * as Card from '$lib/components/ui/card';
-	import Button from '$lib/components/ui/button/button.svelte';
 	import * as Alert from '$lib/components/ui/alert'; // @ts-expect-error: this import does exist
 	import { signIn } from '@auth/sveltekit/client';
 	import '$lib/components/sidebar/svg-styles.css';
@@ -23,12 +22,13 @@
 		{/if}
 	</Card.Header>
 	<Card.Content>
-		<Button
+		<a
 			class="bg-[#FC4C02] hover:bg-[#d14002] flex items-center mx-auto px-0 h-10 my-3"
-			on:click={() => signIn('strava')}
+			href="/auth/signin/strava"
+			on:click|preventDefault={() => signIn('strava')}
 		>
 			<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
-		</Button>
+		</a>
 	</Card.Content>
 	<Card.Footer>
 		<Alert.Root>

From a219e3db97b032410a841a44ed81382ff84fdaa3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:51:13 +0000
Subject: [PATCH 2/9] Improve Strava connect accessibility

---
 src/lib/components/sidebar/ConnectPanel.svelte | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 67beb0b..fe912cd 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -26,6 +26,13 @@
 			class="bg-[#FC4C02] hover:bg-[#d14002] flex items-center mx-auto px-0 h-10 my-3"
 			href="/auth/signin/strava"
 			on:click|preventDefault={() => signIn('strava')}
+			on:keydown={(event) => {
+				if (event.key === 'Enter' || event.key === ' ') {
+					event.preventDefault();
+					signIn('strava');
+				}
+			}}
+			role="button"
 		>
 			<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
 		</a>

From ac443c0941c67021db9c0c7ebc55ba625a78d3a0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:52:27 +0000
Subject: [PATCH 3/9] Refine Strava link key handling

---
 src/lib/components/sidebar/ConnectPanel.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index fe912cd..1b54e95 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -27,7 +27,7 @@
 			href="/auth/signin/strava"
 			on:click|preventDefault={() => signIn('strava')}
 			on:keydown={(event) => {
-				if (event.key === 'Enter' || event.key === ' ') {
+				if (event.key === 'Enter') {
 					event.preventDefault();
 					signIn('strava');
 				}

From 495836bf2001e776c16afff009f4af9512e06553 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:53:45 +0000
Subject: [PATCH 4/9] Simplify Strava link accessibility

---
 src/lib/components/sidebar/ConnectPanel.svelte | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 1b54e95..519278a 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -23,16 +23,9 @@
 	</Card.Header>
 	<Card.Content>
 		<a
-			class="bg-[#FC4C02] hover:bg-[#d14002] flex items-center mx-auto px-0 h-10 my-3"
+			class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring flex items-center mx-auto px-0 h-10 my-3"
 			href="/auth/signin/strava"
 			on:click|preventDefault={() => signIn('strava')}
-			on:keydown={(event) => {
-				if (event.key === 'Enter') {
-					event.preventDefault();
-					signIn('strava');
-				}
-			}}
-			role="button"
 		>
 			<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
 		</a>

From 4f6f53c10bf56a3508ce21cc8d82dded7e6ce6e3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:55:06 +0000
Subject: [PATCH 5/9] Use form submit fallback for Strava sign-in

---
 src/lib/components/sidebar/ConnectPanel.svelte | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 519278a..71fb22c 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -22,13 +22,15 @@
 		{/if}
 	</Card.Header>
 	<Card.Content>
-		<a
-			class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring flex items-center mx-auto px-0 h-10 my-3"
-			href="/auth/signin/strava"
-			on:click|preventDefault={() => signIn('strava')}
-		>
-			<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
-		</a>
+		<form action="/auth/signin/strava" method="get">
+			<button
+				type="submit"
+				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring flex items-center mx-auto px-0 h-10 my-3"
+				on:click|preventDefault={() => signIn('strava')}
+			>
+				<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
+			</button>
+		</form>
 	</Card.Content>
 	<Card.Footer>
 		<Alert.Root>

From 3b70aec9ec623fe308c11c9009ab84fc952c2831 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:56:26 +0000
Subject: [PATCH 6/9] Handle Strava sign-in via form submit

---
 src/lib/components/sidebar/ConnectPanel.svelte | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 71fb22c..2051415 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -22,11 +22,14 @@
 		{/if}
 	</Card.Header>
 	<Card.Content>
-		<form action="/auth/signin/strava" method="get">
+		<form
+			action="/auth/signin/strava"
+			method="get"
+			on:submit|preventDefault={() => signIn('strava')}
+		>
 			<button
 				type="submit"
 				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring flex items-center mx-auto px-0 h-10 my-3"
-				on:click|preventDefault={() => signIn('strava')}
 			>
 				<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
 			</button>

From 9505a8c42e86f9e05418e5ff7167b1fcf0f3e052 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:57:54 +0000
Subject: [PATCH 7/9] Align Strava button focus styles

---
 src/lib/components/sidebar/ConnectPanel.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 2051415..8da355c 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -29,7 +29,7 @@
 		>
 			<button
 				type="submit"
-				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring flex items-center mx-auto px-0 h-10 my-3"
+				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-offset-2 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 flex items-center mx-auto px-0 h-10 my-3"
 			>
 				<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
 			</button>

From 0e09d6995e5a5d95f74f28ac3c2e10028c936299 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 01:59:11 +0000
Subject: [PATCH 8/9] Add Strava button label

---
 src/lib/components/sidebar/ConnectPanel.svelte | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 8da355c..194926b 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -30,6 +30,7 @@
 			<button
 				type="submit"
 				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-offset-2 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 flex items-center mx-auto px-0 h-10 my-3"
+				aria-label="Connect with Strava"
 			>
 				<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
 			</button>

From a3a610032a19339c3b00c964c5c8cc734fb081fd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 02:00:38 +0000
Subject: [PATCH 9/9] Refactor CSP header constant

---
 src/hooks.server.ts | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 38f792e..78fc9ea 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -2,15 +2,21 @@ import { sequence } from '@sveltejs/kit/hooks';
 import type { Handle } from '@sveltejs/kit';
 import { handle as authHandle } from './lib/auth/authHandler';
 
+const contentSecurityPolicy = [
+	"default-src 'self' blob: data: https://*.basemaps.cartocdn.com",
+	"font-src 'self'",
+	"img-src 'self' https://*.basemaps.cartocdn.com data: blob:",
+	"object-src 'none'",
+	"script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com blob: data:",
+	"style-src 'self' 'unsafe-inline'"
+].join('; ');
+
 const securityHeaders: Handle = async ({ event, resolve }) => {
 	const response = await resolve(event);
 
 	response.headers.set('X-Content-Type-Options', 'nosniff');
 	response.headers.set('X-Frame-Options', 'DENY');
-	response.headers.set(
-		'Content-Security-Policy',
-		"default-src 'self' blob: data: https://*.basemaps.cartocdn.com; font-src 'self'; img-src 'self' https://*.basemaps.cartocdn.com data: blob:; object-src 'none'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com blob: data:; style-src 'self' 'unsafe-inline'"
-	);
+	response.headers.set('Content-Security-Policy', contentSecurityPolicy);
 
 	return response;
 };