Snapshot: alpha-2026-9

frontend/vite.config.js

@@ -1,11 +1,56 @@
 import {fileURLToPath, URL} from 'node:url'
+import {execSync} from 'node:child_process'
+import {existsSync} from 'node:fs'
 
 import {defineConfig} from 'vite'
 import vue from '@vitejs/plugin-vue'
-import * as fs from "fs";
+
+// Vite's dev-server SPA fallback only rewrites a request to index.html when the last path
+// segment has no dot (it sniffs for a file extension). A route whose only/last segment is a
+// URL-encoded handle (e.g. /groups/+user@a.localhost, see encodeHandleForUrl in src/router.js)
+// legitimately contains a dot from the domain part, so a direct load/refresh 404s there unless
+// we pre-empt that check ourselves. Gating on both a text/html Accept header and an '@' in the
+// last segment keeps this from ever matching real asset requests or vite's own internal
+// @fs/@id/@vite module paths (which never carry an html Accept header).
+function handleUrlFallback() {
+    return {
+        name: 'handle-url-fallback',
+        configureServer(server) {
+            server.middlewares.use((req, res, next) => {
+                const accept = req.headers.accept || ''
+                const pathname = (req.url || '').split('?')[0]
+                const lastSegment = pathname.slice(pathname.lastIndexOf('/') + 1)
+                if (req.method === 'GET' && accept.includes('text/html') && lastSegment.includes('@')) {
+                    req.url = '/index.html'
+                }
+                next()
+            })
+        }
+    }
+}
+
+function gitCommit() {
+    // deploy/dev/docker-compose.yml bind-mounts the repo's real .git dir at
+    // /git (separate from /app, which only has the frontend/ subtree) -
+    // point git at it explicitly there. Bare-metal dev has no such mount,
+    // but this file's cwd sits inside the real checkout so plain rev-parse
+    // finds it by walking up. In prod, the build context is frontend/ alone
+    // with no .git anywhere, so both fail and we fall back to the
+    // GIT_COMMIT build-arg/env var (see deploy/prod/Dockerfile.frontend and
+    // playbook.yml).
+    const gitDirFlag = existsSync('/git') ? '--git-dir=/git ' : ''
+    try {
+        return execSync(`git ${gitDirFlag}rev-parse --short HEAD`).toString().trim()
+    } catch {
+        return process.env.GIT_COMMIT || 'unknown'
+    }
+}
 
 export default defineConfig({
-    plugins: [vue()],
+    plugins: [vue(), handleUrlFallback()],
+    define: {
+        __GIT_COMMIT__: JSON.stringify(gitCommit())
+    },
     resolve: {
         alias: {
             '@': fileURLToPath(new URL('./src', import.meta.url))
@@ -20,11 +65,16 @@ export default defineConfig({
             'Access-Control-Allow-Headers': 'Origin, Content-Type, X-Auth-Token, Authorization, Accept, charset, boundary, Content-Length',
             'Access-Control-Allow-Credentials': 'true',
             'Access-Control-Max-Age': '86400',
+            //'Upgrade-Insecure-Requests': '1',
             'Content-Security-Policy': 'default-src \'self\';'
-                + ' script-src \'self\' \'wasm-unsafe-eval\';'
+                + ' script-src \'self\' \'wasm-unsafe-eval\' \'unsafe-eval\' \'unsafe-inline\';'
+                // Without this, worker-src falls back to script-src, which has no blob: source -
+                // CameraScanner.vue's decode Worker (built from a Blob URL) would be silently
+                // blocked by CSP rather than the app's own capability checks.
+                + ' worker-src \'self\' blob:;'
                 + ' style-src \'self\' \'unsafe-inline\';'
-                + ' img-src \'self\' data:; '
-                + ' connect-src * data:', // TODO: change * to https://* for production (probably in nginx config not here)
+                + ' img-src \'self\' * data: blob:;'
+                + ' connect-src * data:',
         },
     },
     test: {