Load Alpine's CSP build so the UI's directives run (closes #371)

Browse Source

The pages' Content-Security-Policy forbids eval, which the standard
Alpine.js build needs, so no directive ran: add forms showed open and
events never collapsed. 3p/ now holds the @alpinejs/csp 3.14.9 tarball
instead, and every directive in templates/ names a property or method
of a component registered in static/js/app.js, as that build requires.
The policy is unchanged.

A browser test in internal/server, built only with the browser tag,
loads the webhook page and the event log under the real headers.
make test-browser runs it in Docker, in a digest-pinned headless
browser image (Dockerfile.browser).

Model: opus-5-5

...

This commit is contained in:

sneak

2026-10-02 08:37:11 +00:00

parent 5b1d283d06

commit b07157aa15

16 changed files with 623 additions and 53 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

3p/alpinejs-3.14.9.tgz

BIN

Binary file not shown.

3p/alpinejs-csp-3.14.9.tgz

BIN

Binary file not shown.