[build]
target = "index.html"
dist = "dist"
# Pinned so a bundle built on a laptop and a bundle built in CI are the same
# bundle. `wasm_bindgen` must match the `wasm-bindgen` crate version in
# Cargo.lock exactly, or trunk refuses the build.
[tools]
wasm_bindgen = "0.2.128"
wasm_opt = "version_123"
[serve]
addresses = ["127.0.0.1"]
port = 8090
# Trunk injects its own CSP by default, and its `style-src 'nonce-{{NONCE}}'`
# carries neither 'self' nor 'unsafe-inline' — an external stylesheet gets no
# nonce, so the console renders unstyled in dev while production is fine. This
# mirrors the policy gunnar-ui-server serves, so dev and prod fail identically.
#
# 'unsafe-inline' in style-src is deliberate and permanent: it also governs the
# `style=` attributes Leptos writes, which no nonce or hash can cover. The
# strict half that matters is script-src.
csp = [
"default-src 'none'",
"script-src 'self' 'wasm-unsafe-eval' 'nonce-{{NONCE}}'",
"style-src 'self' 'unsafe-inline'",
"connect-src 'self'",
"img-src 'self' data:",
"font-src 'self'",
"form-action 'none'",
"frame-ancestors 'none'",
]
# The BFF owns these paths. `/login` is on the list because it is a
# server-rendered page, not an SPA route: without the proxy trunk answers it
# with index.html and a silent 200, and the passkey ceremony is unreachable in a
# way that looks like a broken console rather than a missing proxy.
[[proxy]]
rewrite = "/api"
backend = "http://127.0.0.1:3210/api"
[[proxy]]
rewrite = "/auth"
backend = "http://127.0.0.1:3210/auth"
[[proxy]]
rewrite = "/login"
backend = "http://127.0.0.1:3210/login"
# The other server-rendered page, and it is on this list for the same reason
# `/login` is: without the proxy trunk answers it with index.html and a silent
# 200, so the return page a payment vendor sends somebody to would render as
# the console shell in dev and correctly in production — the failure that is
# hardest to notice.
[[proxy]]
rewrite = "/welcome"
backend = "http://127.0.0.1:3210/welcome"