harden: CSP meta + workbox auth-relay tripwire

[silverbucket]

Summary

• Adds a strict Content-Security-Policy meta tag to index.html and public/auth-relay.html. Pins inline scripts/styles by sha256 hash so the no-third-party-JS property is enforced by the browser, not just by convention. (Add Content-Security-Policy meta to harden token-in-localStorage #79)
• Pins the Workbox precache exclusion of auth-relay.html with a unit test against the exported workbox config, so a vite-plugin-pwa bump that silently re-includes the OAuth relay surfaces in CI rather than at runtime. (Verify Workbox precache excludes auth-relay.html #80)

Notes

• The CSP comment is honest about its scope: it blocks inline-script injection, eval, base-tag hijacking, plugin embeds, cross-origin form posts, and PWA manifest takeover — but it does not close the token-exfiltration channel on its own. connect-src https: has to be wide-open so rs.js can talk to whichever remoteStorage server the user picks. Tightening that further is a deploy-time-header job, called out in the comment.
• frame-ancestors, report-to, and sandbox are intentionally omitted from the meta CSP — the spec says they're ignored when set via <meta>. Use HTTP headers at deploy for those.
• The denylist test exercises three realistic OAuth callback shapes (bare path, ?code= query, #access_token= hash) so an over-anchored regex change is caught.

Closes #79.
Closes #80.

Test plan

• npm test — all 278 existing tests + 2 new workbox tests pass
• npm run lint — biome clean
• npm run build — clean build; verified dist/index.html retains the CSP meta tag, dist/auth-relay.html retains its CSP, dist/sw.js precache list does not contain auth-relay.html
• Manual smoke: load the built app, confirm DevTools console shows no CSP violations, confirm rs.js login still completes through auth-relay.html

[silverbucket]

Thanks for the review — addressed all three points in two follow-up commits:

1. Workbox test now inspects the built sw.js (ce08353)
Replaced the config-level assertions with precache.test.js, which runs vite.build() into a tempdir, parses the precache list out of the generated sw.js, and asserts no entry contains auth-relay. Also asserts the navigate-fallback denylist substring survives minification. This actually catches the dep-bump failure mode #80 cares about (a Workbox change that reinterprets globIgnores/navigateFallbackDenylist). Adds ~3s to the test run; keeping it. Dropped the now-unused workboxConfig named export.

2. Hash maintenance is now automatic via csp.test.js (67f3e7b)
The previous setup required node -e "..." to recompute hashes by hand and a comment reminding you to do it. New csp.test.js walks every inline <script> and <style> in index.html and public/auth-relay.html, recomputes sha256, and asserts the CSP meta tag's directive contains it. Edit a script body, the test fails with the new hash printed in the assertion error — paste it into the meta tag, done. Verified by mutating the index.html theme script:

Expected: "'sha256-7xaLG2DD/ajImSSJTPT7Md0M7ACEU0qpci8JoeY+YnQ='"
Received: "script-src 'self' 'sha256-vzZ/YetcF3xkxNnz4tG+fpSoUODEamJeUrlWt4PjMP8='"

3. Trimmed the verbose comments (also in 67f3e7b)
The 25-line CSP block in index.html is now 8 lines; the auth-relay.html comment is 2 lines. Removed the standalone <!-- CSP-HASH: ... --> reminder since the test enforces it.

All 281 tests pass, lint clean, build succeeds.

[silverbucket]

Made it fully automatic — pushed 95f90b8.

Added vite-plugin-csp-hash.js, a small Vite plugin that replaces __CSP_SCRIPT_HASHES__ / __CSP_STYLE_HASHES__ tokens in CSP meta tags with the sha256 of every inline <script>/<style> block in the document. Source HTML now uses placeholders; dev refresh and prod build both auto-fill the correct hash.

Workflow now:

1. Edit an inline script
2. Refresh / rebuild
3. Done

No copy-paste, no test failure to react to. Dropped csp.test.js since drift is impossible by construction — the plugin derives the hash from the actual content it's hashing.

Verified working:

• Build: dist/index.html and dist/auth-relay.html have the correct sha256 hashes; no __CSP_*__ tokens remain.
• Dev: curl http://localhost:4173/auth-relay.html returns the rewritten file with hashes filled in (the dev middleware path).
• Round-trip: mutated var p → var theme_pref in the inline theme script, rebuilt, hash changed from vzZ/Yetc... to ON0l4d7z.... Restored, hash returned to original. Plugin derives from current content.

Plugin scope: ~50 lines, three hooks (transformIndexHtml, configureServer middleware, writeBundle). All 278 tests pass, lint clean.