add csp headers for decofile route #1021
Conversation
WalkthroughVersion references updated across configuration files to "1.132.4-beta". The release route handler now applies Content Security Policy headers to responses by invoking a CSP utility before returning. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Tagging OptionsShould a new tag be published when this PR is merged?
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
deno.json(1 hunks)dev/deno.json(1 hunks)runtime/routes/release.ts(1 hunks)scripts/deno.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: publish
🔇 Additional comments (5)
dev/deno.json (1)
3-3: LGTM: Version bump for beta release.The version update to
1.132.4-betaaligns with the corresponding changes in other configuration files.scripts/deno.json (1)
3-3: LGTM: Version bump for beta release.The version update to
1.132.4-betais consistent with the other configuration files in this PR.deno.json (1)
3-3: LGTM: Version bump for beta release.The root configuration version update to
1.132.4-betamaintains consistency across all package configurations.runtime/routes/release.ts (2)
1-1: ThesetCSPHeadersimplementation is correctly defined with signaturesetCSPHeaders(request: Request, response: Response): Responseand the import in release.ts is valid. No issues found.
5-5: Thereq.rawusage is correct. The destructuredreqproperty contains therawfield which holds the underlying Request object required bysetCSPHeaders. This pattern is consistently used throughout the codebase for accessing the native Request object.
| const response = new Response( | ||
| JSON.stringify(await state.release.state()), | ||
| { | ||
| headers: { | ||
| "Content-Type": "application/json", | ||
| }, | ||
| }, | ||
| ); | ||
| return setCSPHeaders(req.raw, response); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for decofile references
rg -nP --type=ts -C3 'decofile'
# Search for route registration or mapping that might clarify the relationship
rg -nP --type=ts -C3 'release.*route|decofile.*route'Repository: deco-cx/deco
Length of output: 24629
Confirmed: release.ts is the decofile route. Consider applying CSP headers to reload.ts as well.
The release route is correctly mapped to handle the /.decofile path in runtime/handler.tsx. However, runtime/routes/reload.ts also handles decofile operations at /.decofile/reload. For consistency, it should also apply setCSPHeaders to its response.
🤖 Prompt for AI Agents
In runtime/routes/reload.ts around the corresponding response return (similar to
lines 7-15 in runtime/routes/release.ts), the handler currently returns a
Response directly without applying CSP headers; update the handler to wrap the
response with setCSPHeaders(req.raw, response) before returning, mirroring
release.ts, and ensure setCSPHeaders is imported from its module if not already.
No description provided.