Jake
6fd38932ce
Review feedback: the original guard substring-searched the whole file after the first "csp" token, which (a) false-passes if any unrelated JSON value elsewhere in the config happens to contain a localhost URL and (b) false-fails if the CSP is ever re-serialised with escaped forward slashes. Switches to serde_json + a /app/security/csp pointer lookup, then splits the CSP on ';', finds the connect-src directive, tokenises its allow-list on whitespace, and requires an exact match for both http://127.0.0.1:* and ws://127.0.0.1:*. The error now also includes the current connect-src value so a developer who breaks it can see exactly what needs restoring.
68 lines
2.3 KiB
TOML
68 lines
2.3 KiB
TOML
[package]
|
|
name = "kon"
|
|
version = "0.1.0"
|
|
description = "Kon — Think out loud"
|
|
authors = ["CORBEL Ltd"]
|
|
edition = "2021"
|
|
|
|
[lib]
|
|
name = "kon_lib"
|
|
crate-type = ["staticlib", "cdylib", "rlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
# Used by the CSP regression guard in build.rs to parse tauri.conf.json
|
|
# and pull out app.security.csp rather than substring-matching the raw
|
|
# file. Keeps the guard robust against unrelated JSON values that
|
|
# happen to mention a localhost URL.
|
|
serde_json = "1"
|
|
|
|
[dependencies]
|
|
# Workspace crates
|
|
kon-core = { path = "../crates/core" }
|
|
kon-audio = { path = "../crates/audio" }
|
|
kon-transcription = { path = "../crates/transcription" }
|
|
kon-ai-formatting = { path = "../crates/ai-formatting" }
|
|
kon-storage = { path = "../crates/storage" }
|
|
kon-cloud-providers = { path = "../crates/cloud-providers" }
|
|
kon-hotkey = { path = "../crates/hotkey" }
|
|
kon-llm = { path = "../crates/llm" }
|
|
|
|
# Tauri
|
|
tauri = { version = "2", features = ["tray-icon"] }
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-global-shortcut = "2"
|
|
tauri-plugin-updater = "2"
|
|
tauri-plugin-window-state = "2"
|
|
|
|
# Serialisation
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Async runtime (spawn_blocking for inference)
|
|
tokio = { version = "1", features = ["rt", "sync"] }
|
|
arboard = "3.6.1"
|
|
|
|
# Runtime shared-library probe for the Vulkan loader (active compute
|
|
# device detection, brief item #1). We do not call any vulkan symbols
|
|
# — we only need to answer "is libvulkan resolvable from the loader's
|
|
# default search path right now?".
|
|
libloading = "0.8"
|
|
|
|
# SqlitePool is named directly from src-tauri/src/lib.rs (the AppState
|
|
# stores it). Must be unconditional, not Linux-only — naming a type from
|
|
# a transitive dep requires the dep be listed here too.
|
|
# See crates/storage/Cargo.toml — default-features = false drops macros /
|
|
# migrate / any / json which this crate doesn't use. Only names SqlitePool.
|
|
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite"] }
|
|
uuid = { version = "1", features = ["v4"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
webkit2gtk = "2.0"
|
|
# Needed for setting the preview overlay's WindowTypeHint to Utility via
|
|
# the Tauri gtk_window() escape hatch. Versions track what webkit2gtk 2.0
|
|
# transitively depends on (GTK 3).
|
|
gtk = "0.18"
|
|
gdk = "0.18"
|