fix: magic link JWT (?token=) を先頭スクリプトで localStorage に保存

Made-with: Cursor

index.html

@@ -6,11 +6,18 @@
     <script>
     (function () {
         const p = new URLSearchParams(location.search);
+        const tk = p.get('token');
+        if (tk) {
+            localStorage.setItem('posimai_token', tk);
+            p.delete('token');
+        }
         const k = p.get('init_key');
         if (k) {
             localStorage.setItem('posimai-brief-apikey', k);
             p.delete('init_key');
-            const u = location.pathname + (p.toString() ? '?' + p : '');
+        }
+        if (tk || k) {
+            const u = location.pathname + (p.toString() ? '?' + p.toString() : '') + location.hash;
             history.replaceState({}, '', u);
         }
         const t = localStorage.getItem('posimai-brief-theme') || 'system';

vercel.json

@@ -30,7 +30,7 @@
         },
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.soar-enrich.com wss://api.soar-enrich.com https:; worker-src 'self'; frame-ancestors 'none';"
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com https://posimai-ui.vercel.app; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.soar-enrich.com wss://api.soar-enrich.com https:; worker-src 'self'; frame-ancestors 'none';"
         },
         {
           "key": "Strict-Transport-Security",