john
aede1e6fcb
Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP. Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.8 KiB
JavaScript
39 lines
1.8 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import {
|
|
findExternalScriptSources,
|
|
isExternalScriptSrc,
|
|
rewriteKnownCdnScriptSources,
|
|
} from './mindspace-published-script-localize.mjs';
|
|
|
|
test('isExternalScriptSrc detects http and protocol-relative urls', () => {
|
|
assert.equal(isExternalScriptSrc('https://cdn.jsdelivr.net/npm/chart.js'), true);
|
|
assert.equal(isExternalScriptSrc('//cdn.jsdelivr.net/npm/chart.js'), true);
|
|
assert.equal(isExternalScriptSrc('/assets/page-data-client.js'), false);
|
|
assert.equal(isExternalScriptSrc('assets/chart.umd.min.js'), false);
|
|
});
|
|
|
|
test('rewriteKnownCdnScriptSources rewrites chart.js cdn urls to platform asset', () => {
|
|
const source = `<!doctype html><html><body>
|
|
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
|
|
<script src="//cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script>
|
|
<script src="/assets/page-data-client.js"></script>
|
|
</body></html>`;
|
|
const result = rewriteKnownCdnScriptSources(source);
|
|
assert.equal(result.rewrittenCount, 2);
|
|
assert.match(result.html, /src="\/assets\/chart\.umd\.min\.js"/g);
|
|
assert.doesNotMatch(result.html, /cdn\.jsdelivr\.net/);
|
|
assert.doesNotMatch(result.html, /cdnjs\.cloudflare\.com/);
|
|
assert.match(result.html, /src="\/assets\/page-data-client\.js"/);
|
|
});
|
|
|
|
test('findExternalScriptSources lists unresolved external scripts only', () => {
|
|
const source = `<html><body>
|
|
<script src="https://cdn.example.com/app.js"></script>
|
|
<script src="assets/local.js"></script>
|
|
<script src="https://cdn.jsdelivr.net/npm/chart.js/dist/chart.umd.min.js"></script>
|
|
</body></html>`;
|
|
const rewritten = rewriteKnownCdnScriptSources(source).html;
|
|
assert.deepEqual(findExternalScriptSources(rewritten), ['https://cdn.example.com/app.js']);
|
|
});
|