From 3e881e99388ab4c68daf0d7af340e68e07971fad Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Mon, 1 Jun 2026 18:24:45 -0400
Subject: [PATCH] fix(server): allow required CSP handoffs

Permit GitHub App manifest form posts and signed HTTPS VNC preview iframes while keeping the rest of the SPA CSP locked down. Mirror the policy in the split-web Caddy config.
---
 docker/split-web/Caddyfile.static  |  2 +-
 lib/crates/fabro-server/src/csp.rs | 19 +++++++++++++++----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/docker/split-web/Caddyfile.static b/docker/split-web/Caddyfile.static
index 2e1af9984..5f05003cf 100644
--- a/docker/split-web/Caddyfile.static
+++ b/docker/split-web/Caddyfile.static
@@ -9,7 +9,7 @@
 		Cross-Origin-Opener-Policy same-origin
 		Cross-Origin-Resource-Policy same-origin
 		Permissions-Policy "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), web-share=(), xr-spatial-tracking=()"
-		Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://avatars.githubusercontent.com; connect-src 'self' ws: wss:; worker-src 'self' blob:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://avatars.githubusercontent.com; connect-src 'self' ws: wss:; worker-src 'self' blob:; frame-src 'self' https:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://github.com; object-src 'none'"
 	}
 
 	@sourceMaps path *.map
diff --git a/lib/crates/fabro-server/src/csp.rs b/lib/crates/fabro-server/src/csp.rs
index d41324fde..bfed99e37 100644
--- a/lib/crates/fabro-server/src/csp.rs
+++ b/lib/crates/fabro-server/src/csp.rs
@@ -2,8 +2,7 @@
 //!
 //! The policy is built once at server startup from the embedded SPA
 //! `index.html` so any inline `<script>` hashes don't drift from the
-//! template. Third-party sources are enumerated explicitly — the only
-//! outside origins the UI depends on today are Google Fonts.
+//! template. Third-party sources are enumerated explicitly.
 
 use std::sync::OnceLock;
 
@@ -91,7 +90,10 @@ fn build_policy_with_hashes(script_hashes: &[String]) -> String {
     // interactions. The meaningful XSS protection still comes from the
     // script-src restrictions above. `ws:`/`wss:` keep the same-origin
     // terminal WebSocket working across browsers that do not treat `'self'`
-    // as matching WebSocket schemes for connect-src.
+    // as matching WebSocket schemes for connect-src. `frame-src https:`
+    // allows signed sandbox VNC preview iframes from dynamic Daytona preview
+    // hosts. `https://github.com` in form-action allows the install-mode
+    // GitHub App manifest POST handoff.
     format!(
         "default-src 'self'; \
          script-src 'self'{inline_script_sources} 'wasm-unsafe-eval'; \
@@ -100,10 +102,11 @@ fn build_policy_with_hashes(script_hashes: &[String]) -> String {
          img-src 'self' data: blob: https://avatars.githubusercontent.com; \
          connect-src 'self' ws: wss:; \
          worker-src 'self' blob:; \
+         frame-src 'self' https:; \
          manifest-src 'self'; \
          frame-ancestors 'none'; \
          base-uri 'self'; \
-         form-action 'self'; \
+         form-action 'self' https://github.com; \
          object-src 'none'"
     )
 }
@@ -165,6 +168,14 @@ mod tests {
         assert!(policy.contains("font-src 'self' https://fonts.gstatic.com"));
         assert!(policy.contains("style-src 'self' https://fonts.googleapis.com 'unsafe-inline'"));
         assert!(policy.contains("connect-src 'self' ws: wss:"));
+        assert!(
+            policy.contains("frame-src 'self' https:"),
+            "signed sandbox VNC previews are embedded from dynamic HTTPS origins"
+        );
+        assert!(
+            policy.contains("form-action 'self' https://github.com"),
+            "GitHub App manifest creation posts directly to github.com"
+        );
         assert!(policy.contains("frame-ancestors 'none'"));
         assert!(policy.contains("object-src 'none'"));
     }