feat(dashboard,security): load file config defaults in serve & add CSP frame-ancestors

Signed-off-by: Damian Skrzyński <polprog.tech@gmail.com>

Author: polprog-dev

src/releasepilot/cli/cmd_dashboard.py

@@ -127,11 +127,50 @@ def serve(
     """Start the interactive web dashboard server."""
     import uvicorn
 
+    from releasepilot.config.file_config import load_config
     from releasepilot.shared.logging import configure_root_logger
     from releasepilot.web.server import create_app
 
     configure_root_logger(verbose)
-    config: dict[str, str] = {"repo_path": str(Path(repo).resolve())}
+
+    # Load project config file as base defaults (.releasepilot.json, etc.)
+    repo_resolved = str(Path(repo).resolve())
+    file_cfg = load_config(repo_resolved)
+    config: dict[str, str] = {"repo_path": repo_resolved}
+
+    # File config provides defaults for fields not specified via CLI
+    if file_cfg.app_name:
+        config["app_name"] = file_cfg.app_name
+    if file_cfg.audience:
+        config["audience"] = file_cfg.audience
+    if file_cfg.format:
+        config["format"] = file_cfg.format
+    if file_cfg.language:
+        config["language"] = file_cfg.language
+    if file_cfg.title:
+        config["title"] = file_cfg.title
+    if file_cfg.version:
+        config["version"] = file_cfg.version
+    if file_cfg.branch:
+        config["branch"] = file_cfg.branch
+    config["show_authors"] = str(file_cfg.show_authors).lower()
+    config["show_hashes"] = str(file_cfg.show_hashes).lower()
+    if file_cfg.accent_color:
+        config["accent_color"] = file_cfg.accent_color
+    if file_cfg.output_dir:
+        config["output_dir"] = file_cfg.output_dir
+    if file_cfg.overwrite:
+        config["overwrite"] = "true"
+    if file_cfg.repos:
+        config["repos"] = ",".join(file_cfg.repos)
+    if file_cfg.export_formats:
+        config["export_formats"] = ",".join(file_cfg.export_formats)
+    if not file_cfg.gitlab_ssl_verify:
+        config["gitlab_ssl_verify"] = "false"
+    if not file_cfg.github_ssl_verify:
+        config["github_ssl_verify"] = "false"
+
+    # CLI args override file config
     if from_ref:
         config["from_ref"] = from_ref
     if to_ref and to_ref != "HEAD":

src/releasepilot/web/middleware.py

@@ -29,6 +29,18 @@ def __init__(self, app: Any) -> None:
             "true",
             "yes",
         )
+        # Portal origin(s) allowed to embed this app in an iframe.
+        self._frame_ancestors = self._build_frame_ancestors()
+
+    def _build_frame_ancestors(self) -> str:
+        """Build frame-ancestors value from environment."""
+        if not self._allow_framing:
+            return "'none'"
+        origins_env = os.environ.get("RELEASEPILOT_CORS_ORIGINS", "").strip()
+        if origins_env:
+            origins = " ".join(o.strip() for o in origins_env.split(",") if o.strip())
+            return f"'self' {origins}"
+        return "'self'"
 
     async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
         if scope["type"] != "http":
@@ -53,7 +65,8 @@ async def send_with_headers(message: dict) -> None:
                     f"style-src 'self' 'nonce-{nonce}'; "
                     f"style-src-attr 'unsafe-inline'; "
                     f"script-src 'self' 'nonce-{nonce}'; "
-                    f"script-src-attr 'unsafe-inline'"
+                    f"script-src-attr 'unsafe-inline'; "
+                    f"frame-ancestors {self._frame_ancestors}"
                 )
                 headers.append((b"content-security-policy", csp.encode()))
                 headers.append((b"referrer-policy", b"strict-origin-when-cross-origin"))