lotobo/toolbox-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

fix: serve engine modules with JavaScript MIME

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-27 13:08:06 +02:00
parent a50944e7cb
commit 43670a5824
15 changed files with 68 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.env.example
View File

@@ -4,5 +4,5 @@ TRAEFIK_NETWORK=internal
TRAEFIK_CERT_RESOLVER=netcup
# Keep these two values paired when deploying a newer published toolbox release.
TOOLBOX_RELEASE_VERSION=0.9.0
TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c
TOOLBOX_RELEASE_VERSION=0.9.1
TOOLBOX_RELEASE_SHA256=e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062

4
Containerfile.release
View File

@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3
FROM ${NGINX_IMAGE} AS release
ARG TOOLBOX_RELEASE_VERSION=0.9.0
ARG TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c
ARG TOOLBOX_RELEASE_VERSION=0.9.1
ARG TOOLBOX_RELEASE_SHA256=e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062
ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/zemion/toolbox-portal/releases/download
RUN set -eu; \

33
README.md
View File

@@ -1,7 +1,7 @@
# add·ideas Toolbox Portal
`toolbox-portal` is the static launcher and release assembler for the add·ideas
browser toolbox. Version `0.2.8` reads one same-origin catalogue, shows each app
browser toolbox. Version `0.2.9` reads one same-origin catalogue, shows each app
as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
visibility, and appearance in the current browser. Pinned tools have their own
section; search, category, and clickable tag filters stay close to the tool
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
## Production deployment behind Traefik
The committed `compose.yaml` is the shortest production path. Its release
container downloads the immutable Toolbox 0.9.0 ZIP during the image build,
container downloads the immutable Toolbox 0.9.1 ZIP during the image build,
verifies SHA-256 before extracting it, and then copies only the verified static
files into the pinned unprivileged nginx image. Node.js and a local portal
assembly are not required on the deployment host.
@@ -121,9 +121,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
must declare the pinned reverse-DNS id and version. Application and portal
versions are independent.
`release/toolbox.lock.json` is the reviewed v0.9.0 lock. Its URLs and checksums
`release/toolbox.lock.json` is the reviewed v0.9.1 lock. Its URLs and checksums
pin the published PDF Tools 0.4.3, XSLT Tools 0.4.2, OneNote Tools 0.3.3,
Audio & Video Tools 0.2.0, and Regex Tools 0.4.0 release bytes. Use
Audio & Video Tools 0.2.0, and Regex Tools 0.4.1 release bytes. Use
`release/toolbox.lock.example.json` as the template for a future release and
verify every downloaded asset before committing updated values. Artifacts may be:
@@ -144,7 +144,7 @@ npm run assemble -- \
--lock release/toolbox.lock.json \
--portal-dist dist \
--output build/toolbox \
--archive build/add-ideas-toolbox-0.9.0.zip
--archive build/add-ideas-toolbox-0.9.1.zip
```
Existing output is refused. Pass `--force` only when replacing those exact
@@ -166,8 +166,8 @@ build/toolbox/
├── av/
└── regex/
build/add-ideas-toolbox-0.9.0.zip
build/add-ideas-toolbox-0.9.0.zip.sha256
build/add-ideas-toolbox-0.9.1.zip
build/add-ideas-toolbox-0.9.1.zip.sha256
```
The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -188,7 +188,7 @@ directory separately:
```sh
npm run package:static -- \
--input build/toolbox \
--output artifacts/add-ideas-toolbox-0.9.0.zip
--output artifacts/add-ideas-toolbox-0.9.1.zip
```
This also emits a `.sha256` sidecar.
@@ -196,7 +196,8 @@ This also emits a `.sha256` sidecar.
## Local assembled container and publication
`Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, explicit
`application/wasm`, immutable caching only for Vite-hashed assets and narrowly
`application/javascript` for `.mjs` engine modules and `application/wasm`,
immutable caching only for Vite-hashed assets and narrowly
matched semver-versioned FFmpeg core files, and revalidation for all other
files. Assemble first, then:
@@ -206,9 +207,9 @@ normal local XML/XSLT transformations do not require that permission.
```sh
podman build -f Containerfile \
-t git.add-ideas.de/zemion/toolbox:0.9.0 .
-t git.add-ideas.de/zemion/toolbox:0.9.1 .
podman run --rm -p 8080:8080 \
git.add-ideas.de/zemion/toolbox:0.9.0
git.add-ideas.de/zemion/toolbox:0.9.1
```
For a direct-port local deployment after assembly, use the separate example:
@@ -225,7 +226,7 @@ docker login git.add-ideas.de
docker buildx build \
--platform linux/amd64,linux/arm64 \
--file Containerfile.release \
--tag git.add-ideas.de/zemion/toolbox:0.9.0 \
--tag git.add-ideas.de/zemion/toolbox:0.9.1 \
--tag git.add-ideas.de/zemion/toolbox:0.9 \
--push .
```
@@ -251,8 +252,8 @@ needs permission to push code, releases, and container packages to
all five apps, switch between them, and confirm the encoded `toolbox`
context.
5. Verify the distribution with
`(cd build && sha256sum -c add-ideas-toolbox-0.9.0.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.0`), and
`(cd build && sha256sum -c add-ideas-toolbox-0.9.1.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.1`), and
push the branch and tag to Gitea.
7. In Gitea, open **Releases → New release**, select the tag, and upload the
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -268,12 +269,12 @@ must not re-resolve app versions or substitute a newer release.
## Existing tools
| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations |
| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` |
| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` |
| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity |
| **`av-tools`** | Existing local-first v0.2.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable |
| **`regex-tools`** | Current local-first v0.4.0 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
| **`regex-tools`** | Current local-first v0.4.1 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
## Planned tools

2
compose.example.yaml
View File

@@ -3,7 +3,7 @@ services:
build:
context: .
dockerfile: Containerfile
image: git.add-ideas.de/zemion/toolbox:0.9.0
image: git.add-ideas.de/zemion/toolbox:0.9.1
restart: unless-stopped
read_only: true
ports:

6
compose.yaml
View File

@@ -6,9 +6,9 @@ services:
context: .
dockerfile: Containerfile.release
args:
TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.0}"
TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c}"
image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.0}"
TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.1}"
TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-e9dc6a949f1348694099baf62a7b86aa6fea1805bca794de7dfab5dd2040e062}"
image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.1}"
restart: unless-stopped
read_only: true
tmpfs:

7
deploy/nginx.conf
View File

@@ -40,6 +40,13 @@ server {
try_files $uri =404;
}
location ~* \.mjs$ {
types {
application/javascript mjs;
}
try_files $uri =404;
}
location ~* \.(?:css|js|mjs|woff2?|png|jpe?g|gif|webp|svg|ico|webmanifest)$ {
try_files $uri =404;
}

4
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{
"name": "@add-ideas/toolbox-portal",
"version": "0.2.8",
"version": "0.2.9",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@add-ideas/toolbox-portal",
"version": "0.2.8",
"version": "0.2.9",
"license": "AGPL-3.0-only",
"dependencies": {
"@add-ideas/toolbox-contract": "^0.2.2",

2
package.json
View File

@@ -1,6 +1,6 @@
{
"name": "@add-ideas/toolbox-portal",
"version": "0.2.8",
"version": "0.2.9",
"license": "AGPL-3.0-only",
"private": true,
"type": "module",

4
public/SOURCE.md
View File

@@ -1,8 +1,8 @@
# Corresponding source
The source code corresponding to add·ideas Toolbox Portal 0.2.8 is available at:
The source code corresponding to add·ideas Toolbox Portal 0.2.9 is available at:
https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.0
https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.1
Each bundled application contains its own `SOURCE.md`, license, and third-party
license materials. The application sources are also linked from the portal.

10
release/toolbox.lock.example.json
View File

@@ -1,8 +1,8 @@
{
"$schema": "./toolbox-release-lock.schema.json",
"schemaVersion": 1,
"releaseVersion": "0.9.0",
"portalVersion": "0.2.8",
"releaseVersion": "0.9.1",
"portalVersion": "0.2.9",
"catalogue": {
"id": "de.add-ideas.toolbox",
"name": "add·ideas Toolbox",
@@ -43,9 +43,9 @@
},
{
"id": "de.add-ideas.regex-tools",
"version": "0.4.0",
"artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip",
"sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4",
"version": "0.4.1",
"artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.1/regex-tools-0.4.1.zip",
"sha256": "a298d0c578ee5f3e80c036b1c6be308f0277052e770c000fdda8505e5a305815",
"target": "regex"
}
]

10
release/toolbox.lock.json
View File

@@ -1,8 +1,8 @@
{
"$schema": "./toolbox-release-lock.schema.json",
"schemaVersion": 1,
"releaseVersion": "0.9.0",
"portalVersion": "0.2.8",
"releaseVersion": "0.9.1",
"portalVersion": "0.2.9",
"catalogue": {
"id": "de.add-ideas.toolbox",
"name": "add·ideas Toolbox",
@@ -43,9 +43,9 @@
},
{
"id": "de.add-ideas.regex-tools",
"version": "0.4.0",
"artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip",
"sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4",
"version": "0.4.1",
"artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.1/regex-tools-0.4.1.zip",
"sha256": "a298d0c578ee5f3e80c036b1c6be308f0277052e770c000fdda8505e5a305815",
"target": "regex"
}
]

2
scripts/assembler.test.ts
View File

@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
return {
schemaVersion: 1,
releaseVersion: '0.1.0',
portalVersion: '0.2.8',
portalVersion: '0.2.9',
catalogue: {
id: 'de.add-ideas.toolbox',
name: 'Test Toolbox',

12
scripts/deployment.test.ts
View File

@@ -196,6 +196,18 @@ describe('production deployment', () => {
);
});
it('serves ES modules as JavaScript before the broad static location', () => {
const moduleLocation =
/location ~\* \\\.mjs\$\s*\{\s*types\s*\{\s*application\/javascript mjs;\s*\}\s*try_files \$uri =404;\s*\}/mu;
const moduleLocationIndex = nginxConfig.search(moduleLocation);
const staticLocationIndex = nginxConfig.search(
/location ~\* \\\.\(\?:css\|js\|mjs\|/u
);
expect(moduleLocationIndex).toBeGreaterThanOrEqual(0);
expect(staticLocationIndex).toBeGreaterThan(moduleLocationIndex);
});
it('allows same-origin WebAssembly workers and local blob media previews', () => {
expect(nginxConfig).toContain("script-src 'self' 'wasm-unsafe-eval'");
expect(nginxConfig).toContain("worker-src 'self' blob:");

4
src/App.tsx
View File

@@ -489,9 +489,9 @@ export default function App() {
</span>
</p>
<span>
Portal v0.2.8 ·{' '}
Portal v0.2.9 ·{' '}
<a
href="https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.0"
href="https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.1"
target="_blank"
rel="noopener noreferrer"
>

2
src/test/fixtures.ts
View File

@@ -69,7 +69,7 @@ export const regexManifest: ToolboxAppManifest = {
...pdfManifest,
id: 'de.add-ideas.regex-tools',
name: 'Regex Tools',
version: '0.4.0',
version: '0.4.1',
description:
'Develop, explain, test and apply regular expressions locally in the browser.',
icon: './regex.svg',