From e380c6687e261371e6ea3aaa0c9ccc3cc67076cf Mon Sep 17 00:00:00 2001
From: tvongaza <tys.von.gaza@aeon.health>
Date: Sun, 24 Mar 2024 19:33:04 -0600
Subject: [PATCH 1/2] Vite 5.2 meta tag to support new csp nounce tagging

---
 docs/src/guide/rails.md                  | 8 ++++++++
 test/helper_test.rb                      | 4 ++++
 vite_rails/lib/vite_rails/tag_helpers.rb | 6 ++++++
 3 files changed, 18 insertions(+)

diff --git a/docs/src/guide/rails.md b/docs/src/guide/rails.md
index 39c90cf5..00e0f05b 100644
--- a/docs/src/guide/rails.md
+++ b/docs/src/guide/rails.md
@@ -48,6 +48,7 @@ templates, you can using the following helpers:
 - <kbd>[vite_javascript_tag][helpers]</kbd>: Renders a `<script>` tag referencing a JavaScript file
 - <kbd>[vite_typescript_tag][helpers]</kbd>: Renders a `<script>` tag referencing a TypeScript file
 - <kbd>[vite_stylesheet_tag][helpers]</kbd>: Renders a `<link>` tag referencing a CSS file
+- <kbd>[vite_csp_meta_tag][helpers]</kbd>: Renders a `<meta>` tag with the Content Security Policy nonce in a format vite expects (https://vitejs.dev/guide/features.html#content-security-policy-csp).
 
 You can pass any options supported by <kbd>javascript_include_tag</kbd> and <kbd>stylesheet_link_tag</kbd>.
 
@@ -56,6 +57,7 @@ You can pass any options supported by <kbd>javascript_include_tag</kbd> and <kbd
   <title>Example</title>
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
+  <%= vite_csp_meta_tag >
   <%= vite_client_tag %>
 
   <%= vite_javascript_tag 'application' %>
@@ -143,3 +145,9 @@ When running the development server, these tags are omitted, as Vite will load t
 ```erb
 <script src="/vite/assets/application.js" type="module" crossorigin="anonymous"/>
 ```
+
+### Content Security Policy - Vite CSP nonce tagging (Vite >= 5.2)
+
+In non-build environments with hot reloading (usually the development and test environments), Vite will automatically add a nonce to the script and style tags it generates pulling the nonce value from a meta tag. To support this, you should call `<%= vite_csp_meta_tag %>` in your layout or template which renders your `head` element. This will render a `<meta>` tag with the Content Security Policy nonce in a format that Vite expects. This is a slightly modified version of the `csp_meta_tag` helper provided by Rails which is not compatible with Vite CSP nonce tagging.
+
+For more information on how Vite handles Content Security Policy, see the [Vite documentation](https://vitejs.dev/guide/features.html#content-security-policy-csp).
diff --git a/test/helper_test.rb b/test/helper_test.rb
index cc1004c4..a8bed163 100644
--- a/test/helper_test.rb
+++ b/test/helper_test.rb
@@ -181,6 +181,10 @@ def test_vite_image_tag
     }
   end
 
+  def test_vite_csp_meta_tag
+    assert_equal %(<meta property="csp-nonce" nonce="#{ content_security_policy_nonce }" />), vite_csp_meta_tag
+  end
+
   if Rails.gem_version >= Gem::Version.new('7.1.0')
     def test_vite_picture_tag
       assert_equal <<~HTML.gsub(/\n\s*/, ''), vite_picture_tag('images/logo.svg', 'images/logo.png', class: 'test', image: { alt: 'Logo' })
diff --git a/vite_rails/lib/vite_rails/tag_helpers.rb b/vite_rails/lib/vite_rails/tag_helpers.rb
index f6f5e9cc..ba22465e 100644
--- a/vite_rails/lib/vite_rails/tag_helpers.rb
+++ b/vite_rails/lib/vite_rails/tag_helpers.rb
@@ -92,6 +92,12 @@ def vite_picture_tag(*sources, &block)
     picture_tag(*vite_sources, options, &block)
   end
 
+  # Public: Renders a meta tag with the Vite content security policy nonce.
+  def vite_csp_meta_tag
+    tag("meta", {property: "csp-nonce", nonce: content_security_policy_nonce})
+  end
+
+  
 private
 
   # Internal: Returns the current manifest loaded by Vite Ruby.

From 202dd23f1a44397906066f1799f449fe6fccbcba Mon Sep 17 00:00:00 2001
From: tvongaza <tys.von.gaza@aeon.health>
Date: Tue, 26 Mar 2024 09:17:08 -0700
Subject: [PATCH 2/2] fix rubocop errors

---
 vite_rails/lib/vite_rails/tag_helpers.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/vite_rails/lib/vite_rails/tag_helpers.rb b/vite_rails/lib/vite_rails/tag_helpers.rb
index ba22465e..c00bf1e1 100644
--- a/vite_rails/lib/vite_rails/tag_helpers.rb
+++ b/vite_rails/lib/vite_rails/tag_helpers.rb
@@ -94,10 +94,9 @@ def vite_picture_tag(*sources, &block)
 
   # Public: Renders a meta tag with the Vite content security policy nonce.
   def vite_csp_meta_tag
-    tag("meta", {property: "csp-nonce", nonce: content_security_policy_nonce})
+    tag('meta', { property: 'csp-nonce', nonce: content_security_policy_nonce })
   end
 
-  
 private
 
   # Internal: Returns the current manifest loaded by Vite Ruby.