fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 10:27:42 +08:00
parent eea14c1855
commit aede1e6fcb
12 changed files with 392 additions and 5 deletions
@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  findExternalScriptSources,
+  isExternalScriptSrc,
+  rewriteKnownCdnScriptSources,
+} from './mindspace-published-script-localize.mjs';
+
+test('isExternalScriptSrc detects http and protocol-relative urls', () => {
+  assert.equal(isExternalScriptSrc('https://cdn.jsdelivr.net/npm/chart.js'), true);
+  assert.equal(isExternalScriptSrc('//cdn.jsdelivr.net/npm/chart.js'), true);
+  assert.equal(isExternalScriptSrc('/assets/page-data-client.js'), false);
+  assert.equal(isExternalScriptSrc('assets/chart.umd.min.js'), false);
+});
+
+test('rewriteKnownCdnScriptSources rewrites chart.js cdn urls to platform asset', () => {
+  const source = `<!doctype html><html><body>
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
+<script src="//cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script>
+<script src="/assets/page-data-client.js"></script>
+</body></html>`;
+  const result = rewriteKnownCdnScriptSources(source);
+  assert.equal(result.rewrittenCount, 2);
+  assert.match(result.html, /src="\/assets\/chart\.umd\.min\.js"/g);
+  assert.doesNotMatch(result.html, /cdn\.jsdelivr\.net/);
+  assert.doesNotMatch(result.html, /cdnjs\.cloudflare\.com/);
+  assert.match(result.html, /src="\/assets\/page-data-client\.js"/);
+});
+
+test('findExternalScriptSources lists unresolved external scripts only', () => {
+  const source = `<html><body>
+<script src="https://cdn.example.com/app.js"></script>
+<script src="assets/local.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/chart.js/dist/chart.umd.min.js"></script>
+</body></html>`;
+  const rewritten = rewriteKnownCdnScriptSources(source).html;
+  assert.deepEqual(findExternalScriptSources(rewritten), ['https://cdn.example.com/app.js']);
+});