jonny/jonnybarnes.uk
Watch
1
0
Fork
You've already forked jonnybarnes.uk
 0
Code Issues 11 Pull requests Projects Releases 38 Packages Wiki Activity Actions

Load the early theme script from a file so the CSP allows it

Browse source 
Production's Content-Security-Policy has no script-src, so it falls
back to default-src 'self' and blocks inline scripts. The inline head
script that applied the saved theme never ran on prod, leaving the
page on the system theme while the selector showed the saved choice.

Move it to resources/js/theme-init.js, built by esbuild alongside
app.js into a minified, source-mapped file loaded as a blocking script
in the head. ThemeSelector now also applies the saved colour scheme,
so the page and buttons can't disagree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jonny Barnes 2026-11-07 15:33:13 +00:00
commit 7dbf4a3311
Signed by: jonny
SSH key fingerprint: SHA256:CTuSlns5U7qlD9jqHvtnVmfYV3Zwl2Z7WnJ4/dqOaL8
1 changed files with 31 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

11
resources/views/master.blade.php
View file

@ -25,15 +25,8 @@
<link rel="pgpkey" href="{{ config('app.url')}}/gpg.key">
@endif
@stack('head')
<script>
{{-- Apply a saved theme choice before first paint to avoid a flash of the system theme --}}
try {
const theme = localStorage.getItem('theme');
if (theme === 'light' || theme === 'dark') {
document.documentElement.style.setProperty('color-scheme', theme);
}
} catch {}
</script>
{{-- Blocking on purpose: applies a saved theme before first paint. Must stay external to satisfy the CSP --}}
<script src="/assets/js/theme-init.js"></script>
</head>
<body>
<header>