Only generate companion CSP one time to reuse it

[Fijxu]

Closes #5496

CSP with this in config.yml:

invidious_companion:
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"

Looks like this:

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' http://localhost:8282 http://localhost:8282 http://localhost:8282; manifest-src 'self'; media-src 'self' blob: http://localhost:8282 http://localhost:8282 http://localhost:8282; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'

[Copilot]

Pull request overview

This PR optimizes CSP (Content Security Policy) header generation by computing companion URLs once at initialization instead of recalculating them on every request. The change removes duplicate CSP generation logic from the watch and embed route handlers and centralizes it in the before_all middleware.

• Introduces CompanionCSP struct to compute and cache companion URLs at startup
• Removes redundant CSP modification logic from watch.cr and embed.cr
• Updates CSP header generation in before_all.cr to include companion URLs directly

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/invidious/routes/before_all.cr	Adds CompanionCSP struct to compute companion URLs once and includes them in the CSP header directives
src/invidious/routes/watch.cr	Removes duplicate CSP generation logic for companion URLs
src/invidious/routes/embed.cr	Removes duplicate CSP generation logic for companion URLs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.