wellkilo opened a new pull request, #631:
URL: https://github.com/apache/fineract-backoffice-ui/pull/631
## What and why
Fixes both production-CSP failures in #360.
Angular's critical-CSS optimisation emitted `<link ...
onload="this.media='all'">`, which `script-src 'self'` blocks, leaving the main
stylesheet at `media="print"`. Production builds now set
`optimization.styles.inlineCritical=false` for both the host and the MFE.
Native federation still needs one Blob module during bootstrap. The shipped
CSP therefore allows `blob:` alongside `'self'` for scripts, but still forbids
`unsafe-inline` and `unsafe-eval`. In addition, remote discovery is now
restricted to the actual HTTPS dev server (`localhost:4200`); a production
container opened on localhost no longer mistakes its own `remoteEntry.json`
metadata for a live remote.
The result keeps `'self'` as the only network script source while admitting
only the same-origin Blob bootstrap native federation requires.
## Verification
- `npm run build` — passed; the production `index.html` contains neither
`onload=` nor `media="print"`
- Served the actual `dist/` output with the final production CSP and opened
it in Chromium:
- application reached the login form
- 314 parsed stylesheet rules
- compiled `--primary-color` resolved
- zero CSP console errors
- `npm run lint` — passed
- `npm run format:check` — passed
- `npm run test:scripts` — 43 tests passed
- `npm test -- --watch=false` — 252 test files, 1578 tests passed
- `npm run check:responsive` — passed
- `npm run ga:check` — the new `container-csp` gate passes; the command
still exits non-zero because offline `npm audit` reports an undetermined
dependency-vulnerability gate
- New container CI steps verify the served HTML has no inline event handler
and the CSP permits only `'self'`/`blob:` for scripts
- Commit `b0a8e234` is signed and GitHub reports it as **Verified**
Docker is not installed on this machine, so the exact image job could not be
run locally. The Chromium check used the production `dist/` and the same final
CSP header; the PR's container job repeats the static checks in CI once
approved.
## Screenshots
Not applicable: this fixes production bootstrap and security headers, with
browser console/request evidence rather than a visual redesign.
## AI assistance (optional)
- Tool / model: OpenAI Codex
- Harness / workflow: repository guidance in `AGENTS.md`, local
build/lint/unit/Chromium verification
## Checklist
- [x] I did not hand-edit generated files under `src/app/api/`.
- [x] New component or service code uses the adapter boundary in
`src/app/core/adapters/` instead of direct browser globals or imperative
third-party APIs. The new helper contains no framework or browser-adapter
surface.
- [x] User-facing strings use translation keys. No user-facing strings were
added.
- [x] I added or updated tests appropriate to this change.
- [x] UI workflow changes include suitable e2e coverage. The production
bundle was exercised in Chromium under the exact CSP; CI retains
container-level assertions.
- [x] Commits are signed — `b0a8e234` is Verified on GitHub.
- [x] I followed the AI-assisted contributions guidance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
