mirror of
https://github.com/unslothai/unsloth.git
synced 2026-08-22 23:34:15 +00:00
0bedd17d9e
* Studio: serve Swagger UI and ReDoc from this origin, not a CDN FastAPI's built-in /docs and /redoc load ~2.3 MB of JavaScript from cdn.jsdelivr.net and start Swagger with an inline script, so #8042 had to add 'unsafe-inline' and that CDN to script-src for those paths. Those pages share an origin with the frontend, and localStorage is origin-scoped rather than path-scoped, so anything executing there can read the access and refresh tokens session.ts stores and call the API as that user. Vendor the pinned bundles under backend/assets/docs_ui and re-register both pages on FastAPI's own paths against them. Swagger's inline init runs off the per-response nonce main.py already plumbs for the bootstrap script, so script-src stays 'self'. The docs CSP branch now only relaxes style-src, font-src and worker-src, none of which execute script. The pages look and behave exactly as before, and now work with no network. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Match the Swagger init tag by what follows it, not by surrounding whitespace fastapi is unpinned, so a release that reflows the docs template or drops the comment above the init script would miss an exact-string marker and 500 the page. Anchor on the SwaggerUIBundle call instead. * Docs pages: honor root_path, and ship Swagger UI's NOTICE FastAPI's built-in docs routes prefix every URL they emit with the ASGI root_path; the replacements did not, so behind a path-stripping proxy the schema, bundles and OAuth redirect escaped the mapping. Apache-2.0 section 4(d) also requires the NOTICE file to travel with a redistributed Swagger UI, along with the extracted third-party banners its bundle names. * Keep the vendored docs bundles out of git's CRLF conversion The Windows cross-platform run failed the digest check on every text file in assets/docs_ui (the PNG was fine), which is core.autocrlf=true rewriting them on checkout. That both breaks the manifest and means a Windows install serves bytes that are not the reviewed release. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
20 lines
1.1 KiB
Text
20 lines
1.1 KiB
Text
# Normalize Python files to LF line endings
|
|
*.py text eol=lf
|
|
|
|
# Always check out shell scripts with LF endings. Without this rule a Windows
|
|
# clone (core.autocrlf=true) rewrites them to CRLF, and the trailing \r breaks
|
|
# them when run in WSL/Linux (e.g. `set -e` -> "set: Illegal option -").
|
|
*.sh text eol=lf
|
|
|
|
# The vendored Swagger UI / ReDoc bundles are pinned by sha256 in
|
|
# studio/backend/assets/docs_ui/docs_ui_manifest.json and must stay byte-identical to the
|
|
# releases they came from. Without this a Windows clone (core.autocrlf=true) rewrites the
|
|
# .js/.css/LICENSE files to CRLF, so every digest drifts and the bytes Studio serves are no
|
|
# longer the ones that were reviewed. -text disables conversion in both directions.
|
|
studio/backend/assets/docs_ui/** -text
|
|
|
|
# Normalize Unsloth frontend sources to LF. Scoped to the frontend tree (rather
|
|
# than repo-wide *.ts/*.tsx/... rules) so the policy can't force LF on files
|
|
# elsewhere. text=auto lets Git detect and leave binary assets (logos, fonts)
|
|
# untouched while text files (.ts/.tsx/.json/.html/.svg/...) are stored as LF.
|
|
studio/frontend/** text=auto eol=lf
|