From 7aa99681dd34adcee83dd0c86d45209d966e4125 Mon Sep 17 00:00:00 2001 From: glass beadian Date: Tue, 13 Oct 2026 19:07:32 +0000 Subject: [PATCH] files: allow api.occupymedia.cc in the oCIS CSP connect-src MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The oCIS web fetches the OIDC discovery document from the Hub issuer in the browser — connect-src only allowed same-origin + blob, so the fetch was blocked and the web fell back to its own login. With the CSP fix + the external issuer flip, the full SSO chain works: Hub login -> authorize -> consent SPA -> code -> autoprovisioned personal drive. --- infra/occupymedia/files/csp.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/occupymedia/files/csp.yaml b/infra/occupymedia/files/csp.yaml index d4b05be..d637b21 100644 --- a/infra/occupymedia/files/csp.yaml +++ b/infra/occupymedia/files/csp.yaml @@ -2,7 +2,7 @@ directives: default-src: ["'none'"] child-src: ["'self'"] - connect-src: ["'self'", "blob:"] + connect-src: ["'self'", "blob:", "https://api.occupymedia.cc"] font-src: ["'self'", "data:"] # The Hub's in-app Drive view (app.occupymedia.cc/files/drive) frames oCIS web. frame-ancestors: ["'self'", "https://app.occupymedia.cc"]