Support Content Security Policy (style-src)

[scottmizo]

Which scope/s are relevant/related to the feature request?

astro-angular

Information

It appears that the astro-angular package does not currently work with the Astro CSP experimental feature. From what I can tell, the hash-sources for styles defined in the Angular component styles, styleUrl or stylesUrls properties are not being computed. This causes the browser not apply the inline styles associated with the component. This is also an issue with any modules imported into the component.

As per Astro CSP roadmap: When using client islands, Astro injects known styles (Astro island) and scripts (Astro island and directives). These assets are known at build time, so Astro calculates the hashes at build time and stores them in the manifest. The rendering engine will just read and render them.

I'm not even sure this is possible due to the way the Angular component is packaged but it would be great to be able to use the CSP feature.

Describe any alternatives/workarounds you're currently using

No response

I would be willing to submit a PR to fix this issue

• Yes
• No

[brandonroberts]

You may be able to use Angular's providers for setting the CSP https://angular.dev/best-practices/security#content-security-policy

At the component level, use the renderProviders to register the token