mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 10:24:02 +00:00
Sameh KhamisandClaude Opus 5.5
e6f1dd70a1
Vite installs its Host check after the middleware plugins add in configureServer, so the provider and /api routes answered any Host, including a DNS-rebinding name. hostCheckPlugin runs first on the dev and preview servers and applies Vite's rule with the same allowed hosts: IP addresses, localhost and *.localhost, the configured server host, and the listed names. A test drives a real Vite server with an unlisted Host. Co-Authored-By: Claude Opus 5.5 <[email protected]>
105 lines
4.1 KiB
JavaScript
105 lines
4.1 KiB
JavaScript
import { applicationHtmlPlugin } from './application-html.js';
|
|
import cesium from 'vite-plugin-cesium';
|
|
import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
|
|
import { embedFramingPlugin } from './embed-framing.js';
|
|
import { panelBuildPlugin } from './panel.js';
|
|
|
|
/**
|
|
* Content-Security-Policy for every document the dev/preview server serves.
|
|
* No inline script and no foreign script origin is permitted. 'unsafe-eval' is
|
|
* required: Knockout (bundled inside @cesium/widgets) resolves the global
|
|
* object with `(0, eval)("this")` at module load, and without it the Cesium
|
|
* widget never initializes (verified in headless Chrome). It also covers
|
|
* Cesium's WASM decoders. `blob:` is required in the built app: Cesium's
|
|
* bundled workers bootstrap through `importScripts(blob:...)`, which a worker
|
|
* checks against script-src (the dev server loads them by URL instead).
|
|
* Widen any other directive only for a real violation.
|
|
*/
|
|
export const BROWSER_CSP = [
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-eval' blob:",
|
|
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
|
|
"font-src 'self' data: https://fonts.gstatic.com",
|
|
"img-src 'self' data: blob: https:",
|
|
"media-src 'self' blob: https:",
|
|
"connect-src 'self' blob: data: https: wss: ws:",
|
|
"worker-src 'self' blob:",
|
|
"child-src 'self' blob:",
|
|
"manifest-src 'self'",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
].join('; ');
|
|
|
|
/** Response headers shared by the dev and preview servers. */
|
|
export const BROWSER_HEADERS = Object.freeze({
|
|
'X-Frame-Options': 'DENY',
|
|
'Content-Security-Policy': BROWSER_CSP,
|
|
// Responses are only ever used as the type the server declares.
|
|
'X-Content-Type-Options': 'nosniff',
|
|
});
|
|
|
|
/** Build browser assets with explicit inputs; never load environment or providers. */
|
|
export function createBrowserViteConfig({
|
|
plugins = [],
|
|
publicDir,
|
|
googleApiKey,
|
|
cesiumToken,
|
|
host = 'localhost',
|
|
port = 4173,
|
|
allowedHosts = DEFAULT_ALLOWED_HOSTS,
|
|
command,
|
|
} = {}) {
|
|
return {
|
|
plugins: [
|
|
// First, so no provider route answers a Host the server does not allow.
|
|
hostCheckPlugin(),
|
|
cesium(),
|
|
applicationHtmlPlugin(),
|
|
...plugins,
|
|
embedFramingPlugin(),
|
|
panelBuildPlugin(),
|
|
],
|
|
...(publicDir === undefined ? {} : { publicDir }),
|
|
// A production build must not clean the dependency cache a running dev
|
|
// server is still serving optimized module URLs from.
|
|
...(command === 'build' ? { cacheDir: 'node_modules/.vite-build' } : {}),
|
|
optimizeDeps: {
|
|
// First reached through the SDR worker or a dynamic import. Pre-bundle
|
|
// them at startup so first use cannot invalidate already-transformed
|
|
// URLs with Vite's "Outdated Optimize Dep" 504 response.
|
|
include: [
|
|
'@jtarrio/signals/demod/demodulator.js',
|
|
'@jtarrio/signals/demod/modes.js',
|
|
'@jtarrio/webrtlsdr/rtlsdr.js',
|
|
'egm96-universal',
|
|
],
|
|
},
|
|
server: {
|
|
host: host || 'localhost',
|
|
port: parseInt(port, 10) || 4173,
|
|
// A wildcard bind only chooses interfaces; it never disables Vite's
|
|
// Host-header check. LAN hostnames are added explicitly (see
|
|
// build/allowedHosts.js); IP addresses are always accepted.
|
|
allowedHosts: [...allowedHosts],
|
|
fs: {
|
|
deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/ENVIRONMENT'],
|
|
},
|
|
// These headers protect the document containing Provider Settings and
|
|
// give the whole page a real Content-Security-Policy (BROWSER_CSP).
|
|
// Embed-mode documents are framable instead: embed-framing.js rewrites
|
|
// only the frame-ancestors directive and keeps the rest of the policy.
|
|
headers: BROWSER_HEADERS,
|
|
},
|
|
// The preview server serves the same documents, so it carries the same
|
|
// framing + CSP hardening (one constant, no drift).
|
|
preview: { headers: BROWSER_HEADERS },
|
|
define: {
|
|
'import.meta.env.GOOGLE_MAPS_API_KEY': JSON.stringify(googleApiKey),
|
|
'import.meta.env.CESIUM_ION_TOKEN': JSON.stringify(cesiumToken),
|
|
},
|
|
build: { chunkSizeWarningLimit: 1500 },
|
|
};
|
|
}
|