fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 10:27:42 +08:00
parent eea14c1855
commit aede1e6fcb
12 changed files with 392 additions and 5 deletions
@@ -709,6 +709,27 @@ test('prepareHtmlPublishContent rewrites workspace public asset paths relative t
  assert.doesNotMatch(prepared, /"cover":"public\//);
 });

+test('prepareHtmlPublishContent rewrites known chart.js cdn scripts to platform asset', async () => {
+  const prepared = await publicationInternals.prepareHtmlPublishContent({
+    pool: {
+      async query() {
+        return [[]];
+      },
+    },
+    userId: 'user-1',
+    html: '<!doctype html><body><script src="https://cdn.jsdelivr.net/npm/chart.js/dist/chart.umd.min.js"></script></body></html>',
+    ownerSlug: 'john',
+    urlSlug: 'survey-admin',
+    htmlRelativePath: 'public/survey-admin.html',
+    absoluteStoragePath: () => {
+      throw new Error('should not read private storage');
+    },
+  });
+
+  assert.match(prepared, /src="\/assets\/chart\.umd\.min\.js"/);
+  assert.doesNotMatch(prepared, /cdn\.jsdelivr\.net/);
+});
+
 test('rewritePublicationCanonicalAssetUrls rewrites workspace tmp image paths for /u pages routes', () => {
  const html = [
    '<img src=".tmp-images/one.jpg">',