Part of #200 (inline media embeds: remaining providers).
Vimeo live events now play inline.vimeo.com/event/{id}, and /event/{id}/{hash} for unlisted events, get the same click-to-play card as Vimeo videos. Clicking embeds Vimeo's live-event player: https://vimeo.com/event/{id}/embed[/{hash}]?autoplay=1&dnt=1.
The issue assumed this needed vimeo.com added to the CSP's frame-src. Production's frame-src is already 'self' https: (checked on chat.lotusguild.org), and desktop's is https: too, so no infra change is needed.
vimeo.com/event/{id}/embed sends no X-Frame-Options or frame-ancestors, so it can be framed.
Event URLs are parsed before ordinary videos. Other /event/… paths (e.g. /chat) and other hosts are ignored.
Verified
Unit tests: plain, unlisted, already-/embed/ URLs, /chat, a normal video and a foreign host (29/29 in the file).
Browser: a message with https://vimeo.com/event/4321567 showed the card, and clicking it loaded https://vimeo.com/event/4321567/embed?autoplay=1&dnt=1 inside the app. Vimeo shows "Sign into Vimeo" there because the id is made up.
A made-up event has no Synapse preview (Vimeo 404s), so the test supplied the preview. That's the same for every provider: no preview, no card.
A YouTube link on the same setup embedded as before.
Still open on #200: Bandcamp, which needs a small server helper or a Synapse change; I'll ask the owner.
Part of #200 (inline media embeds: remaining providers).
**Vimeo live events now play inline.** `vimeo.com/event/{id}`, and `/event/{id}/{hash}` for unlisted events, get the same click-to-play card as Vimeo videos. Clicking embeds Vimeo's live-event player: `https://vimeo.com/event/{id}/embed[/{hash}]?autoplay=1&dnt=1`.
- The issue assumed this needed `vimeo.com` added to the CSP's `frame-src`. Production's `frame-src` is already `'self' https:` (checked on chat.lotusguild.org), and desktop's is `https:` too, so **no infra change** is needed.
- `vimeo.com/event/{id}/embed` sends no `X-Frame-Options` or `frame-ancestors`, so it can be framed.
- Event URLs are parsed before ordinary videos. Other `/event/…` paths (e.g. `/chat`) and other hosts are ignored.
**Verified**
- Unit tests: plain, unlisted, already-`/embed/` URLs, `/chat`, a normal video and a foreign host (29/29 in the file).
- Browser: a message with `https://vimeo.com/event/4321567` showed the card, and clicking it loaded `https://vimeo.com/event/4321567/embed?autoplay=1&dnt=1` inside the app. Vimeo shows "Sign into Vimeo" there because the id is made up.
- A made-up event has no Synapse preview (Vimeo 404s), so the test supplied the preview. That's the same for every provider: no preview, no card.
- A YouTube link on the same setup embedded as before.
**Still open on #200:** Bandcamp, which needs a small server helper or a Synapse change; I'll ask the owner.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
vimeo.com/event/{id} (and /event/{id}/{hash} for unlisted events) now get
the same click-to-play card as Vimeo videos, embedding Vimeo's live-event
player (vimeo.com/event/{id}/embed[/{hash}], dnt=1). The issue assumed
this needed vimeo.com in the CSP, but frame-src is already https: on web
and desktop.
Refs #200
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #200 (inline media embeds: remaining providers).
Vimeo live events now play inline.
vimeo.com/event/{id}, and/event/{id}/{hash}for unlisted events, get the same click-to-play card as Vimeo videos. Clicking embeds Vimeo's live-event player:https://vimeo.com/event/{id}/embed[/{hash}]?autoplay=1&dnt=1.vimeo.comadded to the CSP'sframe-src. Production'sframe-srcis already'self' https:(checked on chat.lotusguild.org), and desktop's ishttps:too, so no infra change is needed.vimeo.com/event/{id}/embedsends noX-Frame-Optionsorframe-ancestors, so it can be framed./event/…paths (e.g./chat) and other hosts are ignored.Verified
/embed/URLs,/chat, a normal video and a foreign host (29/29 in the file).https://vimeo.com/event/4321567showed the card, and clicking it loadedhttps://vimeo.com/event/4321567/embed?autoplay=1&dnt=1inside the app. Vimeo shows "Sign into Vimeo" there because the id is made up.Still open on #200: Bandcamp, which needs a small server helper or a Synapse change; I'll ask the owner.
🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
vimeo.com/event/{id} (and /event/{id}/{hash} for unlisted events) now get the same click-to-play card as Vimeo videos, embedding Vimeo's live-event player (vimeo.com/event/{id}/embed[/{hash}], dnt=1). The issue assumed this needed vimeo.com in the CSP, but frame-src is already https: on web and desktop. Refs #200 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5