fix(admin): analytics pages load as their own document (route-only CSP); drop dead saas CSS - #279
Merged
Merged
Conversation
… saas CSS
The analytics pages carry a wider CSP ('unsafe-eval' for plotly.js) than
the rest of the admin. A policy belongs to the document, so a client-side
navigation into analytics kept the narrower policy of the page the user
started on, and a navigation out carried the wider one along — the same
trap that blocked the guide videos (#278), applied to scripts.
lib/admin/hard-navigation.ts names the routes that need their own document;
AdminSidebar and QuickActionsWidget render links into and out of them as
plain anchors. The contract is documented next to the CSP variant picker.
Also removes .saas-shell/.saas-card/.saas-pill and their tokens from
globals.css: their last consumer (/settings) moved onto tenant tokens in #277.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe change adds CSP-aware full-document navigation for admin analytics routes and removes legacy SaaS storefront styles from the global stylesheet. ChangesAdmin hard navigation
Storefront CSS cleanup
Estimated code review effort: 2 (Simple) | ~15 minutes Sequence Diagram(s)sequenceDiagram
participant AdminComponent
participant HardNavigation
participant Browser
AdminComponent->>HardNavigation: Check pathname and destination
HardNavigation-->>AdminComponent: Return full-load decision
AdminComponent->>Browser: Render anchor or Next.js Link
Browser->>Browser: Load document with route CSP
Suggested reviewers: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
/tenant-admin/analyticsand/super-admin/analyticsare the one place the admin CSP is wider ('unsafe-eval'for plotly.js). A CSP belongs to the document, not the route: a<Link>navigation into analytics keeps the policy of the page the user started on (plotly then can't run), and a<Link>out of analytics carries the wider policy onto pages that should not have it. Same class as the guide-video block fixed in #278.What
lib/admin/hard-navigation.ts— the routes that need their own document, plusshouldFullLoad(pathname, href); unit-tested (tests/unit/hard-navigation.test.ts).AdminSidebarandQuickActionsWidgetrender links into and out of those routes as plain<a>(full load); everything else stays on<Link>. No visual change.variantForServedPathinlib/security/csp.ts: add a route there → add it to the helper.globals.css:.saas-shell/.saas-card/.saas-pilland their--saas-*tokens removed — last consumer (/settings) moved onto tenant tokens in fix(theme): complete the tenant token contract with a legibility floor #277; zero references remain.Verify after deploy
Dashboard → click Analytics → charts render (full load). Analytics → click Orders → full load;
document.querySelector('meta')not needed: check the response headercontent-security-policyon /tenant-admin/orders has no'unsafe-eval'.Summary by CodeRabbit
Bug Fixes
Style
Documentation