Fix/csp hash and push #5

Merged

TehRiehlDeal merged 2 commits from fix/csp-hash-and-push into main 2026-09-12 10:35:48 -07:00

Conversation 0 Commits 2 Files Changed 14

+355 -33

TehRiehlDeal commented 2026-09-12 10:31:43 -07:00

Owner

Copy link

Copy source

No description provided.

TehRiehlDeal added 2 commits 2026-09-12 10:31:43 -07:00

chore: force LF on every text file, on every platform ... 4aceca1790

The repo already stored LF throughout (audited: 0 of the tracked text
blobs contain CR), but a Windows checkout with core.autocrlf=true
converted on the way out - which is how a built image once shipped a
CRLF shebang (N9). `* text=auto eol=lf` makes the checkout rule part of
the repo rather than each developer's config. Renormalising changed no
content.

fix: push subscription payload; CSP hash computed from the shipped page (2.2.3) ... da32e49b0b

Enabling push in production failed with "Validation failed": the
browser's PushSubscription.toJSON() carries expirationTime, and it was
sent verbatim to a schema that is strict about unknown fields. The
client now sends exactly endpoint + keys. The test doubles had been
shaped like the schema rather than like a browser, which is why 1,112
tests said nothing.

The CSP hash for index.html's inline theme script was hardcoded in the
container's start-up script behind a comment asking for it to be
regenerated by hand, and claiming a test asserted it; none did. The
bytes are what the browser hashes, so an edit or a checkout with
different line endings would have silently blocked the page's own
script. The hash is now emitted by `npm run build` from the index.html
that is actually shipped, copied into the image, and read at start; the
container refuses to start without it. Verified against the built
image: header hash equals served-script hash.

For the record: a CSP console message in production is what led here,
and the served page turned out to be correct - that message was a
browser extension's injected script, which the policy is right to
refuse.

TehRiehlDeal merged commit f417bb8132 into main 2026-09-12 10:35:48 -07:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot TehRiehlDeal (Kevin Riehl)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TehRiehlDeal/movieloop-frontend#5