Projets/ObsiGate
1
1
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases 20 Wiki Activity

fix(excalidraw): fusion imports ESM en un seul module + CSP worker-src/blob:
CI / lint (push) Failing after 13s
Details
CI / test (push) Has been skipped
Details
CI / build (push) Has been skipped
Details
CI / e2e (push) Has been skipped
Details
CI / security (push) Successful in 29s
Details
Desktop Build / build-windows (push) Has been cancelled
Details
Desktop Build / build-linux (push) Has been cancelled
Details

Browse Source
This commit is contained in:
bruno
2026-07-29 11:17:06 -04:00
parent 1b5319fde1
commit dfd8d5929c
4 changed files with 67 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
20260728_223525_3b7c18
+57
View File
File diff suppressed because one or more lines are too long
20260728_223552_b97cd4
+2
View File
File diff suppressed because one or more lines are too long
backend/main.py
+5 -3
View File
@@ -570,11 +570,13 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin" response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
response.headers["Content-Security-Policy"] = ( response.headers["Content-Security-Policy"] = (
"default-src 'self'; " "default-src 'self'; "
"script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh https://cdn.jsdelivr.net https://static.cloudflareinsights.com; " "script-src 'self' 'unsafe-inline' blob: https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh https://cdn.jsdelivr.net https://static.cloudflareinsights.com; "
"style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; " "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; "
"img-src 'self' data: blob:; " "img-src 'self' data: blob:; "
"connect-src 'self' https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com https://cdn.jsdelivr.net; " "connect-src 'self' blob: https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com https://cdn.jsdelivr.net; "
"font-src 'self' https://fonts.gstatic.com;" "font-src 'self' data: https://fonts.gstatic.com; "
"worker-src 'self' blob:; "
"frame-src 'self' blob:;"
) )
# Cache static assets aggressively (fingerprinted by PWA manifest hash) # Cache static assets aggressively (fingerprinted by PWA manifest hash)
if request.url.path.startswith("/static/"): if request.url.path.startswith("/static/"):
frontend/excalidraw-editor.html
+3 -6
View File
@@ -89,18 +89,15 @@
<button id="btn-export-svg" title="Export SVG">📐 SVG</button> <button id="btn-export-svg" title="Export SVG">📐 SVG</button>
</div> </div>
<!-- Import React + ReactDOM (Excalidraw peer dependencies) --> <!-- Import React, ReactDOM, and Excalidraw in a single module (order matters!) -->
<script type="module"> <script type="module">
import React from "https://esm.sh/react@18"; import React from "https://esm.sh/react@18";
import ReactDOM from "https://esm.sh/react-dom@18"; import ReactDOM from "https://esm.sh/react-dom@18";
import * as ExcalidrawLib from "https://esm.sh/@excalidraw/[email protected]";
window.React = React; window.React = React;
window.ReactDOM = ReactDOM; window.ReactDOM = ReactDOM;
</script>
<!-- Configure Excalidraw asset path BEFORE import -->
<script type="module">
window.EXCALIDRAW_ASSET_PATH = "https://esm.sh/@excalidraw/[email protected]/dist/prod/"; window.EXCALIDRAW_ASSET_PATH = "https://esm.sh/@excalidraw/[email protected]/dist/prod/";
import * as ExcalidrawLib from "https://esm.sh/@excalidraw/[email protected]";
window.ExcalidrawLib = ExcalidrawLib; window.ExcalidrawLib = ExcalidrawLib;
const { Excalidraw, exportToBlob, exportToSvg } = ExcalidrawLib; const { Excalidraw, exportToBlob, exportToSvg } = ExcalidrawLib;