From 43670a58249a920d37b7465cfda6724f644a92f7 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Mon, 27 Jul 2026 13:08:06 +0200 Subject: [PATCH] fix: serve engine modules with JavaScript MIME --- .env.example | 4 +-- Containerfile.release | 4 +-- README.md | 43 ++++++++++++++++--------------- compose.example.yaml | 2 +- compose.yaml | 6 ++--- deploy/nginx.conf | 7 +++++ package-lock.json | 4 +-- package.json | 2 +- public/SOURCE.md | 4 +-- release/toolbox.lock.example.json | 10 +++---- release/toolbox.lock.json | 10 +++---- scripts/assembler.test.ts | 2 +- scripts/deployment.test.ts | 12 +++++++++ src/App.tsx | 4 +-- src/test/fixtures.ts | 2 +- 15 files changed, 68 insertions(+), 48 deletions(-) diff --git a/.env.example b/.env.example index 31a68f1..4de151f 100644 --- a/.env.example +++ b/.env.example @@ -4,5 +4,5 @@ TRAEFIK_NETWORK=internal TRAEFIK_CERT_RESOLVER=netcup # Keep these two values paired when deploying a newer published toolbox release. -TOOLBOX_RELEASE_VERSION=0.9.0 -TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c +TOOLBOX_RELEASE_VERSION=0.9.1 +TOOLBOX_RELEASE_SHA256=e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062 diff --git a/Containerfile.release b/Containerfile.release index 2fcc717..37bcce4 100644 --- a/Containerfile.release +++ b/Containerfile.release @@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3 FROM ${NGINX_IMAGE} AS release -ARG TOOLBOX_RELEASE_VERSION=0.9.0 -ARG TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c +ARG TOOLBOX_RELEASE_VERSION=0.9.1 +ARG TOOLBOX_RELEASE_SHA256=e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/zemion/toolbox-portal/releases/download RUN set -eu; \ diff --git a/README.md b/README.md index 1d0c7a4..119e903 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # add·ideas Toolbox Portal `toolbox-portal` is the static launcher and release assembler for the add·ideas -browser toolbox. Version `0.2.8` reads one same-origin catalogue, shows each app +browser toolbox. Version `0.2.9` reads one same-origin catalogue, shows each app as a compact launch tile, and keeps personal pins, drag-and-drop ordering, visibility, and appearance in the current browser. Pinned tools have their own section; search, category, and clickable tag filters stay close to the tool @@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported ## Production deployment behind Traefik The committed `compose.yaml` is the shortest production path. Its release -container downloads the immutable Toolbox 0.9.0 ZIP during the image build, +container downloads the immutable Toolbox 0.9.1 ZIP during the image build, verifies SHA-256 before extracting it, and then copies only the verified static files into the pinned unprivileged nginx image. Node.js and a local portal assembly are not required on the deployment host. @@ -121,9 +121,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest must declare the pinned reverse-DNS id and version. Application and portal versions are independent. -`release/toolbox.lock.json` is the reviewed v0.9.0 lock. Its URLs and checksums +`release/toolbox.lock.json` is the reviewed v0.9.1 lock. Its URLs and checksums pin the published PDF Tools 0.4.3, XSLT Tools 0.4.2, OneNote Tools 0.3.3, -Audio & Video Tools 0.2.0, and Regex Tools 0.4.0 release bytes. Use +Audio & Video Tools 0.2.0, and Regex Tools 0.4.1 release bytes. Use `release/toolbox.lock.example.json` as the template for a future release and verify every downloaded asset before committing updated values. Artifacts may be: @@ -144,7 +144,7 @@ npm run assemble -- \ --lock release/toolbox.lock.json \ --portal-dist dist \ --output build/toolbox \ - --archive build/add-ideas-toolbox-0.9.0.zip + --archive build/add-ideas-toolbox-0.9.1.zip ``` Existing output is refused. Pass `--force` only when replacing those exact @@ -166,8 +166,8 @@ build/toolbox/ ├── av/ └── regex/ -build/add-ideas-toolbox-0.9.0.zip -build/add-ideas-toolbox-0.9.0.zip.sha256 +build/add-ideas-toolbox-0.9.1.zip +build/add-ideas-toolbox-0.9.1.zip.sha256 ``` The assembler verifies SHA-256 before opening an artifact, validates every app @@ -188,7 +188,7 @@ directory separately: ```sh npm run package:static -- \ --input build/toolbox \ - --output artifacts/add-ideas-toolbox-0.9.0.zip + --output artifacts/add-ideas-toolbox-0.9.1.zip ``` This also emits a `.sha256` sidecar. @@ -196,7 +196,8 @@ This also emits a `.sha256` sidecar. ## Local assembled container and publication `Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, explicit -`application/wasm`, immutable caching only for Vite-hashed assets and narrowly +`application/javascript` for `.mjs` engine modules and `application/wasm`, +immutable caching only for Vite-hashed assets and narrowly matched semver-versioned FFmpeg core files, and revalidation for all other files. Assemble first, then: @@ -206,9 +207,9 @@ normal local XML/XSLT transformations do not require that permission. ```sh podman build -f Containerfile \ - -t git.add-ideas.de/zemion/toolbox:0.9.0 . + -t git.add-ideas.de/zemion/toolbox:0.9.1 . podman run --rm -p 8080:8080 \ - git.add-ideas.de/zemion/toolbox:0.9.0 + git.add-ideas.de/zemion/toolbox:0.9.1 ``` For a direct-port local deployment after assembly, use the separate example: @@ -225,7 +226,7 @@ docker login git.add-ideas.de docker buildx build \ --platform linux/amd64,linux/arm64 \ --file Containerfile.release \ - --tag git.add-ideas.de/zemion/toolbox:0.9.0 \ + --tag git.add-ideas.de/zemion/toolbox:0.9.1 \ --tag git.add-ideas.de/zemion/toolbox:0.9 \ --push . ``` @@ -251,8 +252,8 @@ needs permission to push code, releases, and container packages to all five apps, switch between them, and confirm the encoded `toolbox` context. 5. Verify the distribution with - `(cd build && sha256sum -c add-ideas-toolbox-0.9.0.zip.sha256)`. -6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.0`), and + `(cd build && sha256sum -c add-ideas-toolbox-0.9.1.zip.sha256)`. +6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.1`), and push the branch and tag to Gitea. 7. In Gitea, open **Releases → New release**, select the tag, and upload the static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a @@ -267,13 +268,13 @@ must not re-resolve app versions or substitute a newer release. ## Existing tools -| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | -| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` | -| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` | -| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity | -| **`av-tools`** | Existing local-first v0.2.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable | -| **`regex-tools`** | Current local-first v0.4.0 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics | +| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | +| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` | +| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` | +| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity | +| **`av-tools`** | Existing local-first v0.2.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable | +| **`regex-tools`** | Current local-first v0.4.1 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics | ## Planned tools diff --git a/compose.example.yaml b/compose.example.yaml index a0835df..2143bcb 100644 --- a/compose.example.yaml +++ b/compose.example.yaml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Containerfile - image: git.add-ideas.de/zemion/toolbox:0.9.0 + image: git.add-ideas.de/zemion/toolbox:0.9.1 restart: unless-stopped read_only: true ports: diff --git a/compose.yaml b/compose.yaml index e52aacc..55243d3 100644 --- a/compose.yaml +++ b/compose.yaml @@ -6,9 +6,9 @@ services: context: . dockerfile: Containerfile.release args: - TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.0}" - TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c}" - image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.0}" + TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.1}" + TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062}" + image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.1}" restart: unless-stopped read_only: true tmpfs: diff --git a/deploy/nginx.conf b/deploy/nginx.conf index ca585b2..4dde2b5 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -40,6 +40,13 @@ server { try_files $uri =404; } + location ~* \.mjs$ { + types { + application/javascript mjs; + } + try_files $uri =404; + } + location ~* \.(?:css|js|mjs|woff2?|png|jpe?g|gif|webp|svg|ico|webmanifest)$ { try_files $uri =404; } diff --git a/package-lock.json b/package-lock.json index 2892708..2015a74 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.8", + "version": "0.2.9", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@add-ideas/toolbox-portal", - "version": "0.2.8", + "version": "0.2.9", "license": "AGPL-3.0-only", "dependencies": { "@add-ideas/toolbox-contract": "^0.2.2", diff --git a/package.json b/package.json index bf14fe7..ff3165b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.8", + "version": "0.2.9", "license": "AGPL-3.0-only", "private": true, "type": "module", diff --git a/public/SOURCE.md b/public/SOURCE.md index 184984b..926b038 100644 --- a/public/SOURCE.md +++ b/public/SOURCE.md @@ -1,8 +1,8 @@ # Corresponding source -The source code corresponding to add·ideas Toolbox Portal 0.2.8 is available at: +The source code corresponding to add·ideas Toolbox Portal 0.2.9 is available at: -https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.0 +https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.1 Each bundled application contains its own `SOURCE.md`, license, and third-party license materials. The application sources are also linked from the portal. diff --git a/release/toolbox.lock.example.json b/release/toolbox.lock.example.json index dcb373b..53d1c3f 100644 --- a/release/toolbox.lock.example.json +++ b/release/toolbox.lock.example.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.9.0", - "portalVersion": "0.2.8", + "releaseVersion": "0.9.1", + "portalVersion": "0.2.9", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -43,9 +43,9 @@ }, { "id": "de.add-ideas.regex-tools", - "version": "0.4.0", - "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip", - "sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4", + "version": "0.4.1", + "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.1/regex-tools-0.4.1.zip", + "sha256": "a298d0c578ee5f3e80c036b1c6be308f0277052e770c000fdda8505e5a305815", "target": "regex" } ] diff --git a/release/toolbox.lock.json b/release/toolbox.lock.json index dcb373b..53d1c3f 100644 --- a/release/toolbox.lock.json +++ b/release/toolbox.lock.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.9.0", - "portalVersion": "0.2.8", + "releaseVersion": "0.9.1", + "portalVersion": "0.2.9", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -43,9 +43,9 @@ }, { "id": "de.add-ideas.regex-tools", - "version": "0.4.0", - "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip", - "sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4", + "version": "0.4.1", + "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.1/regex-tools-0.4.1.zip", + "sha256": "a298d0c578ee5f3e80c036b1c6be308f0277052e770c000fdda8505e5a305815", "target": "regex" } ] diff --git a/scripts/assembler.test.ts b/scripts/assembler.test.ts index 487c218..84522d4 100644 --- a/scripts/assembler.test.ts +++ b/scripts/assembler.test.ts @@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) { return { schemaVersion: 1, releaseVersion: '0.1.0', - portalVersion: '0.2.8', + portalVersion: '0.2.9', catalogue: { id: 'de.add-ideas.toolbox', name: 'Test Toolbox', diff --git a/scripts/deployment.test.ts b/scripts/deployment.test.ts index dbf1a35..4768a86 100644 --- a/scripts/deployment.test.ts +++ b/scripts/deployment.test.ts @@ -196,6 +196,18 @@ describe('production deployment', () => { ); }); + it('serves ES modules as JavaScript before the broad static location', () => { + const moduleLocation = + /location ~\* \\\.mjs\$\s*\{\s*types\s*\{\s*application\/javascript mjs;\s*\}\s*try_files \$uri =404;\s*\}/mu; + const moduleLocationIndex = nginxConfig.search(moduleLocation); + const staticLocationIndex = nginxConfig.search( + /location ~\* \\\.\(\?:css\|js\|mjs\|/u + ); + + expect(moduleLocationIndex).toBeGreaterThanOrEqual(0); + expect(staticLocationIndex).toBeGreaterThan(moduleLocationIndex); + }); + it('allows same-origin WebAssembly workers and local blob media previews', () => { expect(nginxConfig).toContain("script-src 'self' 'wasm-unsafe-eval'"); expect(nginxConfig).toContain("worker-src 'self' blob:"); diff --git a/src/App.tsx b/src/App.tsx index c27da29..43d3a7f 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -489,9 +489,9 @@ export default function App() {

- Portal v0.2.8 ·{' '} + Portal v0.2.9 ·{' '} diff --git a/src/test/fixtures.ts b/src/test/fixtures.ts index b02fe1a..a5f842f 100644 --- a/src/test/fixtures.ts +++ b/src/test/fixtures.ts @@ -69,7 +69,7 @@ export const regexManifest: ToolboxAppManifest = { ...pdfManifest, id: 'de.add-ideas.regex-tools', name: 'Regex Tools', - version: '0.4.0', + version: '0.4.1', description: 'Develop, explain, test and apply regular expressions locally in the browser.', icon: './regex.svg',