NationTech/harmony
3
0
Fork 2
Code Issues 38 Pull Requests 29 Actions Packages Projects Releases 1 Wiki Activity

fix(fleet-operator): dashboard UI bugs (mostly CSP-blocked inline JS) #323

Merged
johnride merged 1 commits from feat/fleet-operator-real-data into master 2026-06-02 09:45:01 +00:00
Conversation 0 Commits 1 Files Changed 5 +148 -233
johnride commented 2026-06-02 04:07:36 +00:00
Owner
Copy Link

The production CSP is script-src 'self' (no 'unsafe-inline'), so every
inline <script> / on*= handler was silently dead in prod (worked in dev,
which adds 'unsafe-inline'). Move that logic to app.js and HTMX.

  • Logs pop-out did nothing: the modal's inline showModal()/onclick/onclose
    were CSP-blocked. app.js now opens the dialog on htmx:afterSwap to
    #modal-root (backdrop-close, clear-on-close, autoscroll).
  • Device logs showed fabricated lines: the SSE handler now emits one
    honest "not implemented yet" notice instead of fake logs.
  • Sidebar doubled when opening a device from the dashboard: the attention
    rows swapped a full page into closest main; now target body like the
    list.
  • Both list action buttons just opened the device (their onclick
    stopPropagation was CSP-blocked): removed the redundant no-op/quick-log
    buttons + the unused checkbox column; rows simply navigate. Filter
    dropdowns used onchange — switched to hx-trigger="change".
  • Deployment Overview tab loaded the home page; switching tabs left the
    highlight on Overview: the handler returned the full page for
    ?tab=overview, and only the content swapped. Tabs now re-render as a
    unit (bar + content) so overview returns content and the active
    highlight follows. Same fix applied to device-detail tabs.
  • Removed the dead Reconcile/Pause/Rollback/Roll-out buttons; replaced the
    fabricated deployment "manifest" with the real fields we have.
The production CSP is `script-src 'self'` (no 'unsafe-inline'), so every inline <script> / on*= handler was silently dead in prod (worked in dev, which adds 'unsafe-inline'). Move that logic to app.js and HTMX. - Logs pop-out did nothing: the modal's inline showModal()/onclick/onclose were CSP-blocked. app.js now opens the dialog on htmx:afterSwap to #modal-root (backdrop-close, clear-on-close, autoscroll). - Device logs showed fabricated lines: the SSE handler now emits one honest "not implemented yet" notice instead of fake logs. - Sidebar doubled when opening a device from the dashboard: the attention rows swapped a full page into `closest main`; now target `body` like the list. - Both list action buttons just opened the device (their onclick stopPropagation was CSP-blocked): removed the redundant no-op/quick-log buttons + the unused checkbox column; rows simply navigate. Filter dropdowns used onchange — switched to hx-trigger="change". - Deployment Overview tab loaded the home page; switching tabs left the highlight on Overview: the handler returned the full page for ?tab=overview, and only the content swapped. Tabs now re-render as a unit (bar + content) so overview returns content and the active highlight follows. Same fix applied to device-detail tabs. - Removed the dead Reconcile/Pause/Rollback/Roll-out buttons; replaced the fabricated deployment "manifest" with the real fields we have.
johnride added 1 commit 2026-06-02 04:07:37 +00:00
fix(fleet-operator): dashboard UI bugs (mostly CSP-blocked inline JS)
All checks were successful
Run Check Script / check (pull_request) Successful in 2m15s
Details
97af299d07 
The production CSP is `script-src 'self'` (no 'unsafe-inline'), so every
inline <script> / on*= handler was silently dead in prod (worked in dev,
which adds 'unsafe-inline'). Move that logic to app.js and HTMX.

- Logs pop-out did nothing: the modal's inline showModal()/onclick/onclose
  were CSP-blocked. app.js now opens the dialog on htmx:afterSwap to
  #modal-root (backdrop-close, clear-on-close, autoscroll).
- Device logs showed fabricated lines: the SSE handler now emits one
  honest "not implemented yet" notice instead of fake logs.
- Sidebar doubled when opening a device from the dashboard: the attention
  rows swapped a full page into `closest main`; now target `body` like the
  list.
- Both list action buttons just opened the device (their onclick
  stopPropagation was CSP-blocked): removed the redundant no-op/quick-log
  buttons + the unused checkbox column; rows simply navigate. Filter
  dropdowns used onchange — switched to hx-trigger="change".
- Deployment Overview tab loaded the home page; switching tabs left the
  highlight on Overview: the handler returned the full page for
  ?tab=overview, and only the content swapped. Tabs now re-render as a
  unit (bar + content) so overview returns content and the active
  highlight follows. Same fix applied to device-detail tabs.
- Removed the dead Reconcile/Pause/Rollback/Roll-out buttons; replaced the
  fabricated deployment "manifest" with the real fields we have.
johnride merged commit 9bf087e7c9 into master 2026-06-02 09:45:01 +00:00
johnride deleted branch feat/fleet-operator-real-data 2026-06-02 09:45:02 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Architecture Decision Record
Good first issue
RFC
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
johnride jvtrudel reda stremblay
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: NationTech/harmony#323
No description provided.
Delete Branch "feat/fleet-operator-real-data"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?