You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
2.5 KiB
65 lines
2.5 KiB
// SvelteKit configuration of the inspector page (plan §8, phase 1): a static
|
|
// site, every page prerendered, no server code, and a Content-Security-Policy
|
|
// that keeps the page on its own origin.
|
|
import adapter from '@sveltejs/adapter-static';
|
|
|
|
// The only inline style of the site: the style attribute of SvelteKit's route
|
|
// announcer (<div id="svelte-announcer">, written by `svelte-kit sync` into
|
|
// .svelte-kit/generated/root.svelte), allowed by its SHA-256 and nothing else.
|
|
// It is the hash of the attribute value for @sveltejs/kit 2.70.3; the build
|
|
// check (scripts/check-build.mjs) fails if the bundle holds any other inline
|
|
// style, and src/app.css hides the announcer anyway in browsers without
|
|
// style-src-attr.
|
|
const ANNOUNCER_STYLE_HASH = 'sha256-S8qMpvofolR8Mpjy4kQvEm7m1q8clzU4dfDH0AmvZjo=';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
compilerOptions: {
|
|
runes: true,
|
|
},
|
|
kit: {
|
|
// strict: the build fails if any route is not prerendered.
|
|
adapter: adapter({ strict: true }),
|
|
// Prerendered pages get the policy as <meta http-equiv>, the first element
|
|
// of <head>. In 'hash' mode SvelteKit adds the SHA-256 of each inline
|
|
// script it writes (the hydration bootstrap) to script-src; the styles are
|
|
// external files (inlineStyleThreshold stays 0), so style-src needs no
|
|
// hash, and style-src-attr allows the announcer's style attribute alone.
|
|
// Nonces cannot work in prerendered HTML. The fixtures are fetched
|
|
// from the same origin, so connect-src 'self' is enough: no other origin
|
|
// can be reached from the page.
|
|
csp: {
|
|
mode: 'hash',
|
|
directives: {
|
|
'default-src': ['self'],
|
|
'script-src': ['self'],
|
|
'style-src': ['self'],
|
|
'style-src-attr': ['unsafe-hashes', ANNOUNCER_STYLE_HASH],
|
|
'img-src': ['self'],
|
|
'font-src': ['self'],
|
|
'connect-src': ['self'],
|
|
'manifest-src': ['self'],
|
|
'frame-src': ['none'],
|
|
'worker-src': ['none'],
|
|
'object-src': ['none'],
|
|
'base-uri': ['none'],
|
|
'form-action': ['none'],
|
|
},
|
|
},
|
|
prerender: {
|
|
handleHttpError: 'fail',
|
|
handleMissingId: 'fail',
|
|
handleUnseenRoutes: 'fail',
|
|
},
|
|
typescript: {
|
|
// The generated tsconfig covers src/ and vite.config.ts; the vitest
|
|
// configuration is type-checked as well.
|
|
config(tsconfig) {
|
|
tsconfig.include.push('../vitest.config.ts');
|
|
},
|
|
},
|
|
},
|
|
};
|
|
|
|
export default config;
|