CSR refused to create a worker

đŸ’» Development
1

Hello Guys, With my application Agora, i got an issue than i cannot fix. If someone have idea and could help. main.ts:19 Refused to create a worker from ‘http://localhost/apps/agora/assets/inquiryWatcher.worker-B7QShuFn.js’ because it violates the following Content Security Policy directive: “script-src ‘nonce-c4LIiBLtXQm2fUfaYncTiDi3syKWOfYPJRk2ICv/gFM=’”. Note that ‘worker-src’ was not explicitly set, so ‘script-src’ is used as a fallback.
Thks in advance.
Regards

2

Hey,

unfortunately, there is no agora app published yet, so I do not know where the sources are published. Without the sources I can at best give you very rough ideas.

I suspect that there was a problem with how you define the loading of the JS worker code. Did you by chance use a <script> tag in your template?
If this worker was imported and packed using webpack, maybe you need the nounce to be registered in webpack (example in cookbook)?

3

Dear Christian, thanks a lot for your prompt reply and your cookbook. I will look at it asap. You can find the app on GitHub - vinimoz/agora: A decidim like application . I’ve begin the integration process into nextcloud last week. After this major issue has been fixed, i will be able to finalize the first stable version.

4

I cannot confirm this.

I had to update some packages and you do not have package-lock.json committed (thus npm ci fails). Maybe you want to do a installation from scratch to see if all files are correctly committed. Just a good advice.

Apart from that, it is a bit surprising that the worker is built to an /assets folder of your app. This sounds to me like a bug in your code (or more precisely a bad configuration of vite in some way). But I can open the app and play along with it. Public shareing seems broken at least partially but this is up to you.

So, we might need to go one step back again: Please start with a new clone of the project, prepare whatever you need to prepare (and document it). Then let’s see what the problem is. Sort of a classical expected/actual behavior bug report stuff.

Chris

5

Hi Chris,

Regarding the CSP issue, I’ve tried the cookbook but unfortunately it didn’t resolve the problem. Could it be related to the fact that the app is not yet on the App Store?

I’ve thoroughly tested the app on Nextcloud: activation, creation, support, messages, and even with an example dataset (300 inquiries). Everything works as expected, though of course more testing might still be needed.

The package-lock.json is now included, so npm ci runs without errors. I also prepared a short installation guide for a clean clone, along with a brief user guide.

Thanks again for your feedback,
Vincent

6

How did you try to install it? Did you create a tar all and installed that or used the git repo directly?

7

Sorry, it looks like in my local test environment make appstore was working fine, so I didn’t notice the issue.
On another environment, I found the problem: a leftover test directory (coming from Polls) was interfering during compilation. I have fixed it (and removed the directory to avoid future issues).

I also tested the app twice in clean Docker environments with Nextcloud 31 to make sure compilation and activation work properly.

Additionally, I have improved the setup so that file attachments work out of the box, and default parameters are created automatically (instead of requiring occ agora:db:init-default), since I need Groups for file sharing.

1 Like