Summary: Under a strict CSP that nonces style-src/script-src and disallows unsafe-inline, the dashboard's Turbo-injected progress-bar <style> (and async-import <script> shim) are blocked, because the engine layout never renders a csp-nonce meta tag.
Root cause: The bundled Turbo build reads the nonce from <meta name="csp-nonce"> (getMetaContent("csp-nonce")) and stamps .nonce on the elements it injects. app/views/layouts/flightdeck/application.html.erb renders csrf_meta_tags but no csp-nonce meta, so the nonce is never available and the injected style/script are rejected.
Repro: Mount the engine in an app with a nonce-based CSP (Rails' default generator + content_security_policy_nonce_directives including style-src, and style-src without unsafe-inline); load /flightdeck. The browser reports a violation:
effective-directive: style-src-elemblocked-uri: inlinesource-file: …/flightdeck/assets/flightdeck-*.js
Suggested fix: render Rails' csp_meta_tag in the layout <head>. It emits the meta only when a CSP is configured, so it's a no-op for apps without one. PR to follow.
Summary: Under a strict CSP that nonces
style-src/script-srcand disallowsunsafe-inline, the dashboard's Turbo-injected progress-bar<style>(and async-import<script>shim) are blocked, because the engine layout never renders acsp-noncemeta tag.Root cause: The bundled Turbo build reads the nonce from
<meta name="csp-nonce">(getMetaContent("csp-nonce")) and stamps.nonceon the elements it injects.app/views/layouts/flightdeck/application.html.erbrenderscsrf_meta_tagsbut nocsp-noncemeta, so the nonce is never available and the injected style/script are rejected.Repro: Mount the engine in an app with a nonce-based CSP (Rails' default generator +
content_security_policy_nonce_directivesincludingstyle-src, andstyle-srcwithoutunsafe-inline); load/flightdeck. The browser reports a violation:effective-directive: style-src-elemblocked-uri: inlinesource-file: …/flightdeck/assets/flightdeck-*.jsSuggested fix: render Rails'
csp_meta_tagin the layout<head>. It emits the meta only when a CSP is configured, so it's a no-op for apps without one. PR to follow.