Skip to content

feat(csp): runtime APIs#13824

Merged
ematipico merged 3 commits into
feat/cspfrom
feat/csp-runtime-api
May 21, 2025
Merged

feat(csp): runtime APIs#13824
ematipico merged 3 commits into
feat/cspfrom
feat/csp-runtime-api

Conversation

@ematipico
Copy link
Copy Markdown
Member

@ematipico ematipico commented May 19, 2025 •
edited
Loading

Changes

This PR applies two main changes

Directives

I changed the way directives are passed: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#provide-additional-directives

Now it's a string, which is validated using a custom zod schema, and provides good safety in the editor.

Runtime APIs

RFC has been updated to match the implementation: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#runtime-apis

Here, we are doing something new that our runtime engine didn't support: allow to change SSRResult during the rendering.

To provide such a level of mutation, I had to save the SSRResult inside the RenderContext class. This allows for the manipulation of information that belongs only to the route being rendered. I tried to manipulate manifest.csp, but this has a side-effect of keeping this information when we render the next route.

Testing

Added new tests to cover all the APIs.

Docs

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 19, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: 70f7718

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions Bot added pkg: astro Related to the core `astro` package (scope) docs pr labels May 19, 2025
@ematipico ematipico changed the title chore: build hashes of scripts (#13590) feat(csp): runtime APIs May 19, 2025
@ematipico ematipico marked this pull request as ready for review May 19, 2025 15:31
ascorbic
ascorbic reviewed May 20, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@ascorbic ascorbic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Just some unneeded use of !! that I've flagged.

Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
Comment thread packages/astro/src/core/render-context.ts Outdated
@ematipico @ascorbic
Apply suggestions from code review
70f7718 
Co-authored-by: Matt Kane <m@mk.gg>
@ematipico ematipico merged commit 88d4a35 into feat/csp May 21, 2025
15 checks passed
@ematipico ematipico deleted the feat/csp-runtime-api branch May 21, 2025 09:48
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico @ascorbic
feat(csp): runtime APIs (#13824)
0bb2574 
Co-authored-by: Matt Kane <m@mk.gg>
ascorbic added a commit that referenced this pull request Jun 4, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot
feat: experimental CSP (#13802)
0eafe14 
* chore: build hashes of scripts (#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (#13675)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): fix CSP header, inject astro island script/style (#13687)

* feat(csp): track client scripts and CSS (#13725)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): support view transitions (#13738)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (#13687)

* feat(csp): server islands (#13775)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): customise algorithm (#13803)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* chore: build hashes of scripts (#13590) (#13805)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* feat(csp): allow additional directives (#13810)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): resources for script and styles directives (#13812)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): runtime APIs (#13824)

Co-authored-by: Matt Kane <m@mk.gg>

* feat(csp): add script-dynamic keyword support (#13834)

* update lockfile

* chore: docs and changeset (#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

---------

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>
openscript pushed a commit to openscript/astro that referenced this pull request Sep 12, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot @openscript
feat: experimental CSP (withastro#13802)
1d9a567 
* chore: build hashes of scripts (withastro#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (withastro#13675)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): track client scripts and CSS (withastro#13725)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): support view transitions (withastro#13738)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): server islands (withastro#13775)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): customise algorithm (withastro#13803)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* chore: build hashes of scripts (withastro#13590) (withastro#13805)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* feat(csp): allow additional directives (withastro#13810)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): resources for script and styles directives (withastro#13812)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): runtime APIs (withastro#13824)

Co-authored-by: Matt Kane <m@mk.gg>

* feat(csp): add script-dynamic keyword support (withastro#13834)

* update lockfile

* chore: docs and changeset (withastro#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

---------

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ascorbic ascorbic ascorbic left review comments

Assignees

No one assigned

Labels

docs pr pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ematipico @ascorbic