mirror of
https://github.com/unslothai/unsloth.git
synced 2026-08-23 15:53:46 +00:00
0bedd17d9e
* Studio: serve Swagger UI and ReDoc from this origin, not a CDN FastAPI's built-in /docs and /redoc load ~2.3 MB of JavaScript from cdn.jsdelivr.net and start Swagger with an inline script, so #8042 had to add 'unsafe-inline' and that CDN to script-src for those paths. Those pages share an origin with the frontend, and localStorage is origin-scoped rather than path-scoped, so anything executing there can read the access and refresh tokens session.ts stores and call the API as that user. Vendor the pinned bundles under backend/assets/docs_ui and re-register both pages on FastAPI's own paths against them. Swagger's inline init runs off the per-response nonce main.py already plumbs for the bootstrap script, so script-src stays 'self'. The docs CSP branch now only relaxes style-src, font-src and worker-src, none of which execute script. The pages look and behave exactly as before, and now work with no network. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Match the Swagger init tag by what follows it, not by surrounding whitespace fastapi is unpinned, so a release that reflows the docs template or drops the comment above the init script would miss an exact-string marker and 500 the page. Anchor on the SwaggerUIBundle call instead. * Docs pages: honor root_path, and ship Swagger UI's NOTICE FastAPI's built-in docs routes prefix every URL they emit with the ASGI root_path; the replacements did not, so behind a path-stripping proxy the schema, bundles and OAuth redirect escaped the mapping. Apache-2.0 section 4(d) also requires the NOTICE file to travel with a redistributed Swagger UI, along with the extracted third-party banners its bundle names. * Keep the vendored docs bundles out of git's CRLF conversion The Windows cross-platform run failed the digest check on every text file in assets/docs_ui (the PNG was fine), which is core.autocrlf=true rewriting them on checkout. That both breaks the manifest and means a Windows install serves bytes that are not the reviewed release. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| chat_templates | ||
| configs | ||
| datasets | ||
| docs_ui | ||
| __init__.py | ||
| preview_page.html | ||