Changeset c6185fa in Klonkt

Timestamp:

07/24/2026 09:30:48 PM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

c1f5c23

Parents:

fcd6964

git-author:

Robin <roboburr@…> (07/24/2026 09:30:36 PM)

git-committer:

Robin <roboburr@…> (07/24/2026 09:30:48 PM)

Message:

Guardian-PWA: CSP-nonce injecteren zodat de JS laadt

DIT was de echte oorzaak van "guardian-PWA doet niks / hangt / niks functioneel",
en waarom cache legen en incognito nooit hielpen: het is geen caching.

De guardian-PWA wordt direct met res.render gerenderd, NIET via renderPage. Alleen
renderPage draait injectCspNonce over de HTML. Onze CSP is strict-dynamic + per-
request nonce, dus een <script src="/guardian/app.js"> zonder nonce wordt door de
browser geweigerd (precies de fout die Robin zag op boiert.eu). Gevolg: guardian.js
laadde nooit, dus alle knoppen deden niks. Dit gold ook al voor de oude
/assets/js/guardian.js; de no-cache-verhuizing veranderde daar niks aan.

Fix: de guardian-render door injectCspNonce halen, net als de rest van de app.
injectCspNonce is nu exporteerbaar. Geverifieerd: na injectie heeft het app.js-
script de per-request nonce.

Changed files:
src/middleware/render.js

• injectCspNonce geexporteerd

src/routes/guardian.js

• guardian-PWA gerenderd naar string en nonce geinjecteerd (anders blokkeert strict-dynamic de JS)

remarks: embed-player zet een eigen CSP (unsafe-inline) en is niet geraakt. Tests 6/6.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Location:

src

Files:

• middleware/render.js (modified) (1 diff)
• routes/guardian.js (modified) (3 diffs)

src/middleware/render.js

@@ -27 +27 @@
 // partials. HTML-escaped "<script" in rendered content (e.g. sanitized post bodies) won't
 // match, so this only touches real tags.
-function injectCspNonce(html, nonce) {
+export function injectCspNonce(html, nonce) {
   if (!html || !nonce) return html;
   return String(html).replace(/<script(?![^>]*\snonce=)/gi, () => `<script nonce="${nonce}"`);

src/routes/guardian.js

@@ -17 +17 @@
 import * as Guardianship from '../services/guardianship/index.js';
 import { t as i18nT, resolveLang } from '../services/i18n.js';
+import { injectCspNonce } from '../middleware/render.js';
 
 const router = express.Router();
@@ -63 +64 @@
   if (!site) return res.status(404).send('No site for this account.');
   const sites = db.prepare('SELECT slug, title FROM sites WHERE owner_id = ? ORDER BY id').all(req.session.user.id);
+  // This standalone PWA page is rendered directly (not through renderPage), so
+  // the CSP nonce must be injected here — otherwise strict-dynamic blocks
+  // guardian.js and the whole dashboard is dead (buttons do nothing).
   res.render('pages/guardian', {
     state: dashboardState(site, L),
@@ -69 +73 @@
     t: (k, v) => i18nT(L, k, v),
     cspNonce: res.locals.cspNonce,
+  }, (err, html) => {
+    if (err) { console.error('[guardian] render error', err); return res.status(500).send('Internal Server Error'); }
+    res.send(injectCspNonce(html, res.locals.cspNonce));
   });
 });