tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: serve MindSpace public assets as same-origin relative URLs

Browse Source 
Rewrite absolute tkmind asset download links to /api/... at delivery time
and strip base tags that violate public page CSP, so images load on any host.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
john
2026-07-03 23:02:47 +08:00
parent f543a91cc4
commit c3c487a8fb
3 changed files with 65 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mindspace-public-asset-token.test.mjs
+36
View File
@@ -2,7 +2,10 @@ import assert from 'node:assert/strict';
import test from 'node:test';
import {
appendPublicAssetTokens,
normalizePublicAssetReferences,
preparePublicHtmlAssetDelivery,
publicAssetToken,
stripPublicHtmlBaseTag,
verifyPublicAssetToken,
} from './mindspace-public-asset-token.mjs';
@@ -36,3 +39,36 @@ test('appendPublicAssetTokens preserves existing public tokens', () => {
const html = '<img src="/api/mindspace/v1/assets/asset-1/download?inline=1&public_token=keep-me">';
assert.equal(appendPublicAssetTokens(html, SECRET), html);
});
test('normalizePublicAssetReferences rewrites absolute asset urls to same-origin paths', () => {
const html = [
'<img src="https://m.tkmind.cn/api/mindspace/v1/assets/asset-1/download?inline=1">',
'<img src="http://127.0.0.1:5173/api/mindspace/v1/assets/asset-2/download?inline=1&amp;v=3">',
'<meta property="og:image" content="https://mm.tkmind.cn/api/mindspace/v1/assets/asset-3/download?inline=1">',
].join('');
const normalized = normalizePublicAssetReferences(html);
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-1\/download\?inline=1"/);
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-2\/download\?inline=1&amp;v=3"/);
assert.match(
normalized,
/content="\/api\/mindspace\/v1\/assets\/asset-3\/download\?inline=1"/,
);
});
test('stripPublicHtmlBaseTag removes base tags blocked by public page CSP', () => {
const html = '<head><base href="/"><title>demo</title></head>';
assert.equal(stripPublicHtmlBaseTag(html), '<head><title>demo</title></head>');
});
test('preparePublicHtmlAssetDelivery normalizes asset urls before signing', () => {
const html = '<head><base href="/"></head><img src="https://m.tkmind.cn/api/mindspace/v1/assets/asset-1/download?inline=1">';
const prepared = preparePublicHtmlAssetDelivery(html, SECRET);
assert.doesNotMatch(prepared, /<base\b/i);
assert.match(
prepared,
/src="\/api\/mindspace\/v1\/assets\/asset-1\/download\?inline=1&public_token=[A-Za-z0-9_-]+"/,
);
});