fix(csp): allow the private S3 bucket origin in connect-src (uploads died on CSP-serving domains) - #322
Conversation
The app CSP never allowed the direct-to-S3 multipart PUT the composer performs, so every attachment upload died in the browser with 'The file could not reach storage' on any surface serving the header (pr-*.previews.dev.thingtime.com, dev, staging - and production once the policy ships there). Bucket CORS was already correct; only the page policy blocked the connection. connect-src now carries the exact bucket origin derived from THINGTIME_PRIVATE_S3_BUCKET/_REGION at build time, with a regional wildcard fallback when the env is absent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🧹 Develop S3 preview removedThe PR-specific alias and every workflow-created develop deployment were removed when this PR closed. The ordinary generated Vercel Preview remains available on the shared development runtime. |
|
🤖 Promotion conflict resolution was queued automatically for Conflicted source paths: The trusted worker will reconstruct, verify, publish, and attest the review branch; no manual branch update is needed. |
|
✅ The trusted promotion worker opened #324 for Review the exact resolved paths and immutable snapshot in the promotion PR comment. Workflow run. |
|
🤖 Verified automatic promotion resolution for This marker is inert until the live remote branch equals the attested head. Workflow run. |
Thingtime-Promotion-Source-PR: 322 Thingtime-Promotion-Base-Ref: main Thingtime-Promotion-Base-SHA: 440c30d Thingtime-Promotion-Branch: promote/pr-322-csp-allow-s3-uploads--to-main Thingtime-Promotion-Source-Tip-SHA: c73565d Thingtime-Promotion-Source-Start-SHA: dfca890 Thingtime-Promotion-Source-End-SHA: c73565d Thingtime-Promotion-Source-Lineage: verified Thingtime-Promotion-Plan-Hash: 8cc9adfd69e3162cf56abae635a546219281ef65db7fcd93f8caa0d340682f64 Thingtime-Promotion-Patch-ID: 6794355390a1e7988f5dbd1024e5104817f044ac Resolved by the promotion worker: https://github.com/lopugit/thingtime/actions/runs/32222553788
1 participant
Why uploads die on pr-*.previews.dev.thingtime.com (and will die on prod when the CSP ships)
Lopu hit 'The file could not reach storage. Check your connection and retry.' on every upload at pr-312.previews.dev.thingtime.com. Diagnosis:
connect-srcis only'self' https://cdn.jsdelivr.net— the browser kills the PUT tohttps://<bucket>.s3.<region>.amazonaws.combefore it leaves, which surfaces as exactly that upload-phase error.Access-Control-Allow-Originfor the preview origins (verified for bothpr-312.previews.dev.thingtime.comand the*.vercel.appalias).*.vercel.apppreviews carry no CSP header at all, which is why uploads work there today.Fix
csp.mjs(single source of truth consumed by patch-vercel-output / verify-vercel-output / vite dev headers) now adds the private bucket origin toconnect-src: exacthttps://$BUCKET.s3.$REGION.amazonaws.comderived fromTHINGTIME_PRIVATE_S3_BUCKET/_REGIONat build time, falling back to the regional wildcardhttps://*.s3.ap-southeast-2.amazonaws.comwhen the env is absent (local dev, env-less builds).Verified: both env modes produce the expected policy; lint clean; changelog entry added under [Unreleased].
Note: separately, fresh accounts on that environment 403 at upload prepare — that's the #309 upload-permission gate working as designed, not this bug.
🤖 Generated with Claude Code