From ad5859954949154f44a08048e9bfef5d731986e4 Mon Sep 17 00:00:00 2001
From: Keith Morrison <keithm@infused.org>
Date: Thu, 6 Aug 2026 15:27:28 -0700
Subject: [PATCH] Emit csp-nonce meta tag so Turbo-injected styles work under a
 strict CSP

The bundled Turbo injects its progress-bar <style> (and an async-import
<script> shim) at runtime and reads the nonce from a <meta name="csp-nonce">
tag. The layout never rendered that tag, so under a strict, nonce-based CSP
(no 'unsafe-inline') those injected elements were nonce-less and blocked.

Render Rails' csp_meta_tag in the layout head. It emits the meta only when a
CSP is configured, so it is a no-op for hosts without one.
---
 CHANGELOG.md                                  |  7 ++
 .../layouts/flightdeck/application.html.erb   |  4 ++
 test/integration/csp_nonce_test.rb            | 68 +++++++++++++++++++
 3 files changed, 79 insertions(+)
 create mode 100644 test/integration/csp_nonce_test.rb

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8315102..c76fd8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fixed
+
+- The dashboard no longer breaks under a strict, nonce-based Content Security
+  Policy. The layout now renders `csp_meta_tag`, so the bundled Turbo can nonce
+  the `<style>`/`<script>` it injects at runtime. No effect on hosts without a
+  CSP configured.
+
 ## [0.6.0] - 2026-07-28
 
 ### Changed
diff --git a/app/views/layouts/flightdeck/application.html.erb b/app/views/layouts/flightdeck/application.html.erb
index 11c7b42..8528882 100644
--- a/app/views/layouts/flightdeck/application.html.erb
+++ b/app/views/layouts/flightdeck/application.html.erb
@@ -6,6 +6,10 @@
     <title><%= content_for?(:title) ? yield(:title) : "Flightdeck" %></title>
     <meta name="turbo-root" content="<%= root_path %>">
     <%= csrf_meta_tags %>
+    <%# The bundled Turbo reads this nonce and stamps it on the <style>/<script> it injects
+        at runtime, so the dashboard works under a strict (nonce-based) CSP. Renders nothing
+        when the host has no CSP configured. %>
+    <%= csp_meta_tag %>
     <% if (css = flightdeck_asset_path("flightdeck.css")) %>
       <link rel="stylesheet" href="<%= css %>">
     <% end %>
diff --git a/test/integration/csp_nonce_test.rb b/test/integration/csp_nonce_test.rb
new file mode 100644
index 0000000..643921f
--- /dev/null
+++ b/test/integration/csp_nonce_test.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# The bundled Turbo injects its progress-bar <style> (and an async-import <script>
+# shim) at runtime and stamps them with the nonce it reads from a
+# <meta name="csp-nonce"> tag. Under a strict, nonce-based CSP the layout must emit
+# that tag or those injected elements are nonce-less and get blocked.
+class Flightdeck::CspNonceTest < ActionDispatch::IntegrationTest
+  USERNAME = "pilot"
+  PASSWORD = "correct-horse-battery"
+
+  # Seed a nonce-based CSP into the dummy app for the duration of this test only.
+  # env_config is memoized, so writing the keys the CSP machinery reads applies it
+  # to each request here, and restoring them keeps it out of every other test.
+  CSP_ENV_KEYS = %w[
+    action_dispatch.content_security_policy
+    action_dispatch.content_security_policy_nonce_generator
+    action_dispatch.content_security_policy_nonce_directives
+  ].freeze
+
+  setup do
+    ENV["FLIGHTDECK_USERNAME"] = USERNAME
+    ENV["FLIGHTDECK_PASSWORD"] = PASSWORD
+
+    env = Rails.application.env_config
+    @previous_csp_env = CSP_ENV_KEYS.to_h { |key| [ key, env[key] ] }
+    env["action_dispatch.content_security_policy"] =
+      ActionDispatch::ContentSecurityPolicy.new do |policy|
+        policy.default_src :self
+        policy.style_src :self # deliberately no :unsafe_inline
+      end
+    env["action_dispatch.content_security_policy_nonce_generator"] = ->(_request) { SecureRandom.base64(16) }
+    env["action_dispatch.content_security_policy_nonce_directives"] = %w[style-src script-src]
+  end
+
+  teardown do
+    Rails.application.env_config.merge!(@previous_csp_env)
+  end
+
+  test "the layout emits a csp-nonce meta tag under a nonce-based CSP" do
+    get_dashboard
+
+    meta_nonce = response.body[/<meta name="csp-nonce" content="([^"]*)"/, 1]
+    assert meta_nonce.present?, "expected a non-empty csp-nonce meta tag in the layout"
+
+    # A full host (not an api_only one) also carries the CSP response header; when
+    # it does, the meta must carry the very same nonce the header advertises.
+    if (header = response.headers["Content-Security-Policy"])
+      assert_equal header[/style-src[^;]*'nonce-([^']+)'/, 1], meta_nonce,
+                   "expected the csp-nonce meta tag to match the style-src nonce"
+    end
+  end
+
+  test "the layout emits no csp-nonce meta tag when the host has no CSP" do
+    Rails.application.env_config.merge!(@previous_csp_env) # drop the CSP for this request
+
+    get_dashboard
+
+    assert_not_includes response.body, %(name="csp-nonce")
+  end
+
+  private
+    def get_dashboard
+      get "/flightdeck", headers: { "HTTP_AUTHORIZATION" => basic_auth_header(USERNAME, PASSWORD) }
+      assert_response :success
+    end
+end