josh
01f83d25f6
Three root causes addressed: 1. Added <base href="/"> to index.html so all relative asset paths (css/app.css, js/*.js) resolve from the root regardless of the current SPA route. Without this, /instance/117 requested /instance/css/app.css, which hit the SPA fallback and returned HTML; helmet's nosniff then refused it as a stylesheet. 2. Removed upgrade-insecure-requests from the CSP (useDefaults: false). This directive told browsers to upgrade HTTP→HTTPS for every asset request, breaking all resource loading on HTTP-only deployments. 3. Changed script-src-attr from 'none' to 'unsafe-inline' to allow the inline onclick handlers used throughout the UI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
1.5 KiB
JavaScript
52 lines
1.5 KiB
JavaScript
import express from 'express';
|
|
import helmet from 'helmet';
|
|
import { fileURLToPath } from 'url';
|
|
import { dirname, join } from 'path';
|
|
import { router } from './routes.js';
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
const PORT = process.env.PORT ?? 3000;
|
|
|
|
export const app = express();
|
|
|
|
app.use(helmet({
|
|
contentSecurityPolicy: {
|
|
useDefaults: false, // explicit — upgrade-insecure-requests breaks HTTP deployments
|
|
directives: {
|
|
'default-src': ["'self'"],
|
|
'base-uri': ["'self'"],
|
|
'font-src': ["'self'", 'https://fonts.gstatic.com'],
|
|
'form-action': ["'self'"],
|
|
'frame-ancestors': ["'self'"],
|
|
'img-src': ["'self'", 'data:'],
|
|
'object-src': ["'none'"],
|
|
'script-src': ["'self'"],
|
|
'script-src-attr': ["'unsafe-inline'"], // allow onclick handlers
|
|
'style-src': ["'self'", 'https://fonts.googleapis.com'],
|
|
},
|
|
},
|
|
}));
|
|
app.use(express.json());
|
|
|
|
// API
|
|
app.use('/api', router);
|
|
|
|
// Static files
|
|
app.use(express.static(join(__dirname, '..')));
|
|
|
|
// SPA fallback — all non-API, non-asset routes serve index.html
|
|
app.get('*', (req, res) => {
|
|
res.sendFile(join(__dirname, '../index.html'));
|
|
});
|
|
|
|
// Error handler
|
|
app.use((err, _req, res, _next) => {
|
|
console.error(err);
|
|
res.status(500).json({ error: 'internal server error' });
|
|
});
|
|
|
|
// Boot — only when run directly, not when imported by tests
|
|
if (process.argv[1] === fileURLToPath(import.meta.url)) {
|
|
app.listen(PORT, () => console.log(`catalyst on :${PORT}`));
|
|
}
|