Clients load no code from third-party hosts at runtime

[colinmegill]

Observable changes

• No runtime requests to third-party hosts from the report, admin or legacy participation pages, other than the deliberate ones listed below. Gone: d3js.org, cdn.plot.ly, maxcdn.bootstrapcdn.com, fonts.googleapis.com / fonts.gstatic.com, cdnjs.cloudflare.com (Twemoji images), cdn.jsdelivr.net. The same files now come from our own host.
• Pages look the same. A Delphi-backed report rendered on this branch with every non-local host blocked, against edge with internet: topicReport screenshots are byte-identical; report differs in 752 of 39.3M pixels and topicStats in 157 pixels, all in the page-header URL text (the local server port) and the export file names (the timestamp). Every chart is pixel-identical.
• Bundle sizes.
  • Report: report_bundle.*.js unchanged byte for byte (639,317 bytes, same content hash). index_report.html 1,085 → 977 bytes. New static files, byte-identical to what the CDNs served: d3 4.13.0 (221,957), d3-scale-chromatic 1.5.0 (19,831), Plotly 2.27.0 (3,598,158), each with a .gz sibling like the bundle has. The Font Awesome 4.4.0 stylesheet (26,711) is no longer loaded: nothing in the report uses its classes.
  • Admin: admin_bundle.*.js 248,663 → 248,740 bytes gzipped. New static files: Space Mono CSS (4,140), woff2 for latin, latin-ext and vietnamese in 400/700/400-italic (124,672), woff fallbacks (93,280), 15 Twemoji PNGs (11,949).
  • Legacy participation: bundles unchanged; js/jwt-decode-3.1.2.js (3,688 bytes, 1,365 gzipped) served.
• New static files have versioned paths and a one-year cache header, like the bundles.

No server, database, schema or route change. The participation path is untouched: the only participation-client change is where jwt_decode is loaded from.

What changed

client	was	now
report	d3js.org/d3.v4.min.js (4.13.0), d3js.org/d3-scale-chromatic.v1.min.js (1.5.0), cdn.plot.ly/plotly-2.27.0.min.js as window.d3 / window.Plotly	the same files from pinned npm packages (d3@4.13.0, d3-scale-chromatic@1.5.0 as aliases so the bundled d3 4.6 and d3-scale-chromatic 1.1 modules stay as they are; plotly.js-dist-min@2.27.0), copied unminified into the build and loaded by the same script tags in the same order
report	Font Awesome 4.4.0 CSS from maxcdn	removed (unused)
admin	Space Mono from Google Fonts	@fontsource/space-mono@5.3.0: same font version (1.003), all 225 latin glyph outlines and advance widths identical (checked with fontTools); same three styles, subsets and font-display: swap
admin	react-easy-emoji images from cdnjs (Twemoji 14.0.2)	the 15 images the pages use, byte-identical, shipped under public/twemoji/14.0.2/72x72, via a one-line wrapper that sets the base URL (credits Twemoji's CC-BY 4.0 in source)
legacy participation	cdn.jsdelivr.net/npm/jwt-decode@latest/... (resolved to 3.1.2)	jwt-decode@3.1.2 build/jwt-decode.js, same synchronous position

Deliberate third parties, unchanged, for a ruling

• Simple Analytics (scripts.simpleanalyticscdn.com, queue.simpleanalyticscdn.com): report, admin (production builds), legacy participation.
• Google Analytics (www.googletagmanager.com): legacy participation, only when GA_TRACKING_ID is set.
• Login provider: the OIDC issuer (Auth0 in production). The test OIDC simulator's sign-in page itself loads unpkg.com/tailwindcss and cdn.auth0.com/js/auth0/9.19.0.
• Embeds: /donate (donorbox.org iframe); /home2 (topic-map demo iframe from the polis-delphi S3 bucket); /embed, /embedReport and their preprod variants (hardcoded pol.is / preprod.pol.is).
• Delphi interactive visualizations (datamapplot HTML from S3, framed by commentsReport and topicsVizReport): the generated HTML loads unpkg.com (deck.gl@latest, apache-arrow@latest), Google Fonts and maxcdn. Fixing that is a change to how Delphi generates them, not to the clients.

The guard

e2e/cypress/e2e/self-contained/third-party-hosts.cy.js (npm run test:self-contained; also part of npm test): blocks every non-local request, clears and disables the browser cache (cached files never reach the network, so without this the check passed on edge once another page had loaded them), and loads every report view the server routes (including the topic and collective statement views), both participation clients, the signed-out admin pages and the signed-in conversation pages. It fails on any blocked request to a host other than Simple Analytics, any page error, or any of our own scripts, styles, fonts or images failing to load, and checks window.d3.version, window.Plotly.version, window.jwt_decode, the Space Mono faces and the emoji images. The report browser proof (ci/dynamo-removal/report-proof.cjs) now blocks non-local hosts the same way, so a CDN outage can no longer fail it. Each client has a unit test pinning its template and versions.

Found along the way (not changed)

• The alpha participation page reports a React hydration mismatch (minified error Show permission error for admin UI when not moderator #418) on first load, on edge and on this branch alike. The guard allows exactly that error on that page and logs it.
• e2e/cypress/support/e2e.js swallows every uncaught exception, so a broken page never failed the suite; the guard records exceptions itself.
• client-participation npm run lint reports 43 errors on edge and on this branch, none in changed files; no CI job runs it.

Checks run (local Docker stack, non-default ports)

• Guard on this branch: 17 of 17 pass. Guard on edge: 0 of 17. Each report view lists d3js.org (twice), cdn.plot.ly and maxcdn; legacy participation lists cdn.jsdelivr.net; admin pages list fonts.googleapis.com and cdnjs.cloudflare.com. The alpha page loads nothing third-party itself; its test fails on edge only through the admin page its sign-out step visits.
• bash scripts/test-dynamo-removal.sh on this branch: pass (report, topicStats and topicReport rendered with non-local hosts blocked; only Simple Analytics was blocked; 0 page errors). The same report proof on edge with hosts blocked fails: Cannot read properties of undefined (reading 'scaleLinear') plus the four CDN requests.
• client-report: npm install, npm test (18 suites, 94 tests), npm run lint, npm run build:prod.
• client-admin: npm ci, npm run test:coverage (29 suites, 324 tests), npm run lint, npm run build:prod.
• client-participation: npm ci, npm test (159 tests), npm run build:prod.
• e2e: npm run lint (0 errors). Existing specs client-report/*, client-admin/public-pages, client-admin/conversation, client-participation/anonymous-jwt-flow and alpha-client/votes pass; client-report/comment-report fails only on its hardcoded http://localhost/report/ (the local run used 127.0.0.1 on another port).
• Lockfiles: additions only; npm install leaves them unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s