doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

correct a false claim: the map engines load from CDN, not from vendor/
Some checks are pending
build-gate / build (push) Waiting to run
Details

Browse source 
The Tauri README said the bundles 'self-host mapbox-gl from public/assets/vendor/
(the no-CDN rule)'. Measured: vendor/ contains only tabulator, and every leaf
carries src=https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js. MapLibre
likewise loads from cdn.jsdelivr.net. The ENGINES registry in
library/composables/useMapInstance.js is the authority.

This mattered because the sentence sat next to CSP guidance: a script-src
written from the old claim would have blocked the engine and produced a blank
map - the exact symptom being debugged elsewhere.
This commit is contained in:
doxa-maps-88655c70 2026-09-21 23:36:55 +00:00
parent 9dc4dda8cf
commit 6005bc101b
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
deployment/src-tauri/README.md
View file

@ -62,8 +62,16 @@ capability-5 app, not the gallery index. 1440×900 is the viewport the SPA is ve
renders 11 rows there: 6 curated + 5 auto-discovered).
`security.csp` is `null` so the page inherits whatever it declares when served, matching CDN
behaviour. Do not tighten it without re-running the mount check: the bundles self-host `mapbox-gl`
from `public/assets/vendor/` (the no-CDN rule), so a naive `script-src` would break every map.
behaviour. Do not tighten it without re-running the mount check: the leaf pages load their map
engine from a **CDN** — `api.mapbox.com/mapbox-gl-js/…` for Mapbox and `cdn.jsdelivr.net/npm/
maplibre-gl@5/…` for MapLibre (see the `ENGINES` registry in
`library/composables/useMapInstance.js`). A naive `script-src 'self'` would break every map.
> **Corrected 2026-09-21.** This previously claimed the bundles "self-host `mapbox-gl` from
> `public/assets/vendor/` (the no-CDN rule)". That is **false** — measured: `vendor/` contains only
> `tabulator`, and the leaves carry `src="https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js"`.
> A CSP written from the old sentence would have been wrong in exactly the way that produces a
> blank map, so the error mattered.
## Commands