Load Alpine's CSP build so the UI's directives run (closes #371)

Browse Source

Every page's Content-Security-Policy forbids eval, which the standard Alpine.js build needs, so no directive ran in a browser: both add forms on the webhook page showed open, and events in the event log could not be collapsed. The UI now loads Alpine's CSP build (@alpinejs/csp 3.14.9 in 3p/); the policy is unchanged. Each directive names a property or method of a component registered in static/js/app.js (collapsible, targetForm), and each card holds its own x-data. A browser test, built only with the browser tag, loads the webhook page and the event log under the real headers; make test-browser runs it in Docker. New test-only dependency chromedp, which raises golang.org/x/sys to 0.47.0.

Model: opus-5-5

This commit was merged in pull request #411.

...

This commit is contained in:

clawbot

2026-10-02 16:09:03 +02:00

parent 3e209bfe4e

commit e8379272ae

16 changed files with 626 additions and 56 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

3p/alpinejs-csp-3.14.9.tgz

BIN

Binary file not shown.