From 6bd6ddd0311a93ed8593c2baf0d434be3ff0c19e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samy=20Pess=C3=A9?= <samypesse@gmail.com>
Date: Mon, 19 Feb 2024 16:32:33 +0100
Subject: [PATCH] Use an assetPrefix to serve all assets from same URLs (#172)

* Test an assetPrefix

* Fix condition

* Use the env instead

* Use it for CSP
---
 .github/workflows/ci.yaml |  2 ++
 next.config.js            |  3 +++
 src/lib/csp.ts            | 20 ++++++++++++--------
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1c7256da6..ba90cb8a3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -30,6 +30,8 @@ jobs:
             - name: Sets env vars for production
               run: |
                   echo "SENTRY_ENVIRONMENT=production" >> $GITHUB_ENV
+                  echo "GITBOOK_ASSETS_PREFIX=https://open.gitbook.com" >> $GITHUB_ENV
+              if: startsWith(github.ref, 'refs/tags/main')
             - name: Sets env vars for preview
               run: |
                   echo "SENTRY_ENVIRONMENT=preview" >> $GITHUB_ENV
diff --git a/next.config.js b/next.config.js
index 2cff33ce7..4a2dfd870 100644
--- a/next.config.js
+++ b/next.config.js
@@ -6,6 +6,7 @@ module.exports = withSentryConfig(
             BUILD_VERSION: (process.env.GITHUB_SHA ?? '').slice(0, 7),
             SENTRY_DSN: process.env.SENTRY_DSN ?? '',
             SENTRY_ENVIRONMENT: process.env.SENTRY_ENVIRONMENT ?? 'development',
+            GITBOOK_ASSETS_PREFIX: process.env.GITBOOK_ASSETS_PREFIX,
         },
 
         webpack(config) {
@@ -20,6 +21,8 @@ module.exports = withSentryConfig(
 
             return config;
         },
+
+        assetPrefix: process.env.GITBOOK_ASSETS_PREFIX,
     },
     {
         silent: true,
diff --git a/src/lib/csp.ts b/src/lib/csp.ts
index 6c8cb0379..aab465954 100644
--- a/src/lib/csp.ts
+++ b/src/lib/csp.ts
@@ -4,6 +4,10 @@ import { headers } from 'next/headers';
 
 import { filterOutNullable } from './typescript';
 
+const assetsDomain = process.env.GITBOOK_ASSETS_PREFIX
+    ? new URL(process.env.GITBOOK_ASSETS_PREFIX).host
+    : undefined;
+
 /**
  * Get the current nonce for the current request.
  */
@@ -34,16 +38,16 @@ export function getContentSecurityPolicy(scripts: SpaceIntegrationScript[], nonc
     //
     // Since I can't get the nonce to work for inline styles, we need to allow unsafe-inline
     const defaultCSP = `
-        default-src 'self';
-        script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' integrations.gitbook.com https://cdn.iframe.ly;
-        style-src 'self' fonts.googleapis.com 'unsafe-inline';
-        img-src * 'self' blob: data: files.gitbook.com;
-        connect-src * 'self' integrations.gitbook.com app.gitbook.com;
-        font-src 'self' fonts.gstatic.com;
+        default-src 'self' ${assetsDomain};
+        script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' ${assetsDomain} integrations.gitbook.com https://cdn.iframe.ly;
+        style-src 'self' ${assetsDomain} fonts.googleapis.com 'unsafe-inline';
+        img-src * 'self' blob: data: files.gitbook.com ${assetsDomain};
+        connect-src * 'self' integrations.gitbook.com app.gitbook.com ${assetsDomain};
+        font-src 'self' fonts.gstatic.com ${assetsDomain};
         frame-src *;
         object-src 'none';
-        base-uri 'self';
-        form-action 'self';
+        base-uri 'self' ${assetsDomain};
+        form-action 'self' ${assetsDomain};
         frame-ancestors 'none';
     `;