WorkRoot/CompanySite
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: WorkRoot/CompanySite:41abcaa7a4981ac0ea9d6d5a1228b2ac2e7c10c1
Branches Tags
WorkRoot/CompanySite:main
...
compare: WorkRoot/CompanySite:7b67897612d3cf0490334198c910a7f8f6e5a3dc
Branches Tags
WorkRoot/CompanySite:main
2 Commits
41abcaa7a4 ... 7b67897612
Author SHA1 Message Date
platform-mcpandClaude Opus 4.8 7b67897612 fix(csp): allow WRNexus push SDK origin in script-src and connect-src
E2E Test Suite / Form Interaction Tests (push) Failing after 10m29s
Details
E2E Test Suite / Security Header Tests (push) Failing after 10m15s
Details
E2E Test Suite / Mobile Device Tests (push) Failing after 11m8s
Details
E2E Test Suite / Cross-Browser Regression (webkit) (push) Failing after 12m0s
Details
E2E Test Suite / Cross-Browser Regression (firefox) (push) Failing after 12m52s
Details
E2E Test Suite / Cross-Browser Regression (chromium) (push) Failing after 13m44s
Details
E2E Test Suite / Destructive & Chaos Tests (push) Failing after 14m37s
Details
E2E Test Suite / Smoke Tests (P0) (push) Failing after 21m17s
Details
E2E Test Suite / Critical User Journeys (push) Has been skipped
Details
E2E Test Suite / API Integration Tests (push) Has been skipped
Details
E2E Test Suite / Test Report Summary (push) Failing after 12m14s
Details
Deploy to Production / Notify on Failure (push) Successful in 1s
Details
Deploy to Production / Build & Verify (push) Failing after 5m47s
Details
Deploy to Production / Pre-Deploy Tests (push) Failing after 14m54s
Details
Deploy to Production / Deploy to Railway (push) Failing after 14m58s
Details
Deploy to Production / Deploy to Render (push) Failing after 14m35s
Details
Deploy to Production / Deploy to VPS (PM2) (push) Failing after 14m6s
Details
Deploy to Production / Deploy to Fly.io (push) Failing after 13m43s
Details
Deploy to Production / Post-Deploy Verification (push) Failing after 14m11s
Details 
The web-push SDK (https://api.wrnexus.com/push/sdk.js) and its runtime
config fetch were blocked by the Content-Security-Policy set in
src/middleware.ts. Added https://api.wrnexus.com to script-src (prod and
dev) and connect-src. No wildcards introduced; existing analytics
origins (GTM, GA, Plausible) unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-24 01:38:51 +05:30
platform-mcp c5f79f1fd2 pre-agent: Allow WRNexus push SDK in CSP script-src 2026-06-24 01:35:55 +05:30
1 changed files with 4 additions and 3 deletions
Expand all files Collapse all files
src/middleware.ts
+4 -3
View File
@@ -155,11 +155,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
// - inline scripts/styles: Required for Astro framework // - inline scripts/styles: Required for Astro framework
// - https://www.googletagmanager.com & https://www.google-analytics.com: GA4 // - https://www.googletagmanager.com & https://www.google-analytics.com: GA4
// - https://plausible.io: Plausible Analytics // - https://plausible.io: Plausible Analytics
// - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js) + runtime config
// Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode) // Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode)
const isProduction = import.meta.env.PROD; const isProduction = import.meta.env.PROD;
const scriptSrc = isProduction const scriptSrc = isProduction
? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io" ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com"
: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io"; : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com";
const csp = [ const csp = [
"default-src 'self'", "default-src 'self'",
@@ -167,7 +168,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com", "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
"img-src 'self' data: https://images.unsplash.com https://www.google-analytics.com https://www.googletagmanager.com https://maps.googleapis.com https://maps.gstatic.com", "img-src 'self' data: https://images.unsplash.com https://www.google-analytics.com https://www.googletagmanager.com https://maps.googleapis.com https://maps.gstatic.com",
"font-src 'self' data: https://fonts.gstatic.com", "font-src 'self' data: https://fonts.gstatic.com",
"connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io", "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io https://api.wrnexus.com",
"worker-src 'self'", "worker-src 'self'",
"manifest-src 'self'", "manifest-src 'self'",
"object-src 'none'", // Block Flash/plugins (defense-in-depth) "object-src 'none'", // Block Flash/plugins (defense-in-depth)