From e43631b5e34ffbf89287093f85e4bfe55a142db2 Mon Sep 17 00:00:00 2001
From: fab <fabrizio.salmi@gmail.com>
Date: Tue, 21 Jul 2026 13:18:53 +0200
Subject: [PATCH] review: keep the CSP to production builds and fix the comment
 language (#33)

Follow-up to review feedback on the privacy/CSP change already merged here:

- The comment inserted alongside the CSP was written in Italian while these
  configs are in English. It came from the script used to apply the change
  across many repositories. Rewritten in English.
- The meta CSP was emitted unconditionally, so it also applied under
  'vitepress dev'. Testing showed HMR still connects there, because the dev
  server is same-origin and connect-src 'self' covers its websocket - but it
  would break as soon as the dev server is not same-origin ('--host', or a
  custom server.hmr.port). It is now emitted for production builds only.
- Where footer.message had been left as two concatenated literals (an artefact
  of the mechanical rollout) it is collapsed into one.

Nothing changes for visitors: the built site still carries the CSP and the
privacy link.

Signed-off-by: Fabrizio Salmi <fabrizio.salmi@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/.vitepress/config.ts | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
index d771095..edab1cb 100644
--- a/docs/.vitepress/config.ts
+++ b/docs/.vitepress/config.ts
@@ -32,18 +32,25 @@ export default defineConfig({
     },
 
     head: [
-    // Tutto first-party. 'unsafe-inline' serve perche' VitePress emette
-    // uno script inline per il tema e stili inline.
-    [
-      'meta',
-      {
-        'http-equiv': 'Content-Security-Policy',
-        content:
-          "default-src 'self'; script-src 'self' 'unsafe-inline'; " +
-          "style-src 'self' 'unsafe-inline'; img-src 'self' data:; " +
-          "font-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self'",
-      },
-    ],
+    // Everything this site loads is first-party. 'unsafe-inline' is required
+    // because VitePress emits an inline appearance script and inline styles.
+    // Applied to the built site only: `vitepress dev` serves HMR over a
+    // websocket, which a strict connect-src would block as soon as the dev
+    // server is not same-origin (--host, or a custom server.hmr.port).
+    ...(process.env.NODE_ENV === 'production'
+      ? [
+          [
+            'meta',
+            {
+              'http-equiv': 'Content-Security-Policy',
+              content:
+                "default-src 'self'; script-src 'self' 'unsafe-inline'; " +
+                "style-src 'self' 'unsafe-inline'; img-src 'self' data:; " +
+                "font-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self'",
+            },
+          ] as [string, Record<string, string>],
+        ]
+      : []),
         ['link', { rel: 'icon', type: 'image/svg+xml', href: '/patterns/favicon.svg' }],
         ['meta', { name: 'theme-color', content: '#0071e3' }],
         ['meta', { name: 'apple-mobile-web-app-capable', content: 'yes' }],
@@ -110,7 +117,8 @@ export default defineConfig({
         ],
 
         footer: {
-            message: 'Released under the MIT License.' + ' · <a href="https://fabriziosalmi.github.io/privacy">Privacy &amp; legal</a>',
+            message: 
+        'Released under the MIT License. · <a href="https://fabriziosalmi.github.io/privacy">Privacy &amp; legal</a>',
             copyright: `Copyright © 2024–${new Date().getFullYear()} Fabrizio Salmi`
         },