fix(app): derive renderer CSP origins from SPOOL_SHARE_BACKEND#380
Merged
Conversation
The Share button, Publish/Export tab labels, and the popover/tablist aria-labels were the last hardcoded English strings in the share-publish surfaces after the #372 i18n pass. Route them through t() with new shareEditor.shareMenu.* keys across all 7 locales. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The prod CSP hardcoded the spool.pro origin family in connect-src and img-src. When SPOOL_SHARE_BACKEND redirects API traffic elsewhere (staging, local mock), main-process fetches follow the override but the renderer's direct fetches — avatar <img> loads and api calls — get silently blocked by CSP, which looks like a broken image with an empty network tab. buildCsp() now appends the override origin (normalized via URL.origin, so a trailing-slash default doesn't duplicate) to both directives in both profiles. The canonical spool.pro family stays unconditionally: published-share URLs and avatar links keep pointing there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Refactors the renderer CSP into a
buildCsp()builder and appends theSPOOL_SHARE_BACKENDoverride origin (when set) toconnect-srcandimg-srcin both dev and prod profiles. Origins are compared afterURL.originnormalization so a trailing-slash spelling of the default doesn't duplicate entries. The canonicalspool.profamily stays in the prod allow-list unconditionally — published-share URLs and avatar links keep pointing there even when the API origin is overridden.Why
Main-process fetches follow
SPOOL_SHARE_BACKEND, but the renderer's direct fetches (user-avatar<img>loads from/api/avatars/<id>, renderer-side API calls) were pinned to the hardcodedspool.profamily. Pointing the app at staging or a local mock made those requests silently disappear behind CSP — broken image, empty network tab, no console hint. Found in the pre-GA launch audit.Test plan
csp.test.ts: override origin lands in connect-src/img-src (both profiles), spool.pro family retained alongside the override, no-override output is byte-identical to the previous fixtures (19 tests green)SPOOL_SHARE_BACKENDpointed at the in-process mock — exercises the override path on every run🤖 Generated with Claude Code