fix(cinny-web): CSP for mozilla.org discovery and TikTok oEmbed; featured communities (#18, #20, #21) #32

2026-10-18T02:37:40-04:00

jared commented

2026-10-18 02:37:40 -04:00

Fixes #18, #20 and #21: three small edits to what chat.lotusguild.org serves. Production change: merging redeploys the web config and CSP (LXC 106).

#21, mozilla.org login. connect-src gains https://www.mozilla.org. mozilla.org/.well-known/matrix/client 301s there, the CSP refused it, and choosing mozilla.org always said "Failed to connect".
#18, TikTok short links. connect-src gains https://www.tiktok.com, for the oEmbed lookup that resolves vm.tiktok.com/… and tiktok.com/t/… ids. The player was already allowed (frame-src https:).
#20, featured communities (your decision of 2026-10-04). config.json gets the same featuredCommunities as the desktop app: the Lotus Guild space, #homelab:codestorm.net, #jellyfin:matrix.org, and matrixrooms.info.

Verified

nginx -t passes in a harness using this repo's snippet, and the served CSP contains both new hosts.
The Lotus Guild space id resolves on production (room_summary → "Lotus Guild", v12).
www.tiktok.com/oembed answers 200.
config.json parses.

After deploy, please check: the browser console on Explore → Featured shows no CSP errors, and mozilla.org on the login screen gets past discovery. The issue notes the next-gen auth step may still fail there with "Dynamic registration failed"; that's a separate check.

Related: cinny-desktop #34. Its other question, allowCustomHomeservers (web false vs desktop true), is still open and isn't changed here.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Fixes #18, #20 and #21: three small edits to what chat.lotusguild.org serves. **Production change:** merging redeploys the web config and CSP (LXC 106). 1. **#21, mozilla.org login.** `connect-src` gains `https://www.mozilla.org`. `mozilla.org/.well-known/matrix/client` 301s there, the CSP refused it, and choosing mozilla.org always said "Failed to connect". 2. **#18, TikTok short links.** `connect-src` gains `https://www.tiktok.com`, for the oEmbed lookup that resolves `vm.tiktok.com/…` and `tiktok.com/t/…` ids. The player was already allowed (`frame-src https:`). 3. **#20, featured communities** (your decision of 2026-10-04). `config.json` gets the same `featuredCommunities` as the desktop app: the Lotus Guild space, `#homelab:codestorm.net`, `#jellyfin:matrix.org`, and `matrixrooms.info`. **Verified** - `nginx -t` passes in a harness using this repo's snippet, and the served CSP contains both new hosts. - The Lotus Guild space id resolves on production (`room_summary` → "Lotus Guild", v12). - `www.tiktok.com/oembed` answers 200. - `config.json` parses. **After deploy, please check:** the browser console on Explore → Featured shows no CSP errors, and mozilla.org on the login screen gets past discovery. The issue notes the next-gen auth step may still fail there with "Dynamic registration failed"; that's a separate check. Related: cinny-desktop #34. Its other question, `allowCustomHomeservers` (web `false` vs desktop `true`), is still open and isn't changed here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 3 commits 2026-10-18 02:37:41 -04:00

fix(cinny-web): allow www.mozilla.org in connect-src so mozilla.org login can discover its homeserver (#21 ) 93078858c1

mozilla.org/.well-known/matrix/client 301s to www.mozilla.org, which the
CSP refused, so choosing mozilla.org always said "Failed to connect".

Fixes #21

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

fix(cinny-web): allow the TikTok oEmbed lookup in connect-src (#18 ) be0ff3b854

TikTok short links (vm.tiktok.com/…, tiktok.com/t/…) resolve their video
id via https://www.tiktok.com/oembed, which the CSP refused, so their
cards always failed on the web. The player itself was already allowed
(frame-src https:).

Fixes #18

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

feat(cinny-web): featured communities on Explore, matching the desktop app (#20 )

Lint / JS (eslint) (push) Successful in 11s

Details

Lint / No secrets in webhook configs (push) Successful in 6s

Details

Lint / Landing page is rendered (matrix (push) Successful in 6s

Details

Lint / Python (ruff) (push) Successful in 16s

Details

Lint / Python deps (pip-audit) (push) Successful in 1m9s

Details

Lint / Secret scan (gitleaks) (push) Successful in 6s

Details

Lint / Shell (shellcheck) (pull_request) Successful in 15s

Details

Lint / JS (eslint) (pull_request) Successful in 14s

Details

Lint / No secrets in webhook configs (pull_request) Successful in 9s

Details

Lint / Landing page is rendered (matrix (pull_request) Successful in 10s

Details

Lint / Python (ruff) (pull_request) Successful in 11s

Details

Lint / Python deps (pip-audit) (pull_request) Successful in 1m7s

Details

Lint / Secret scan (gitleaks) (pull_request) Successful in 8s

Details

Lint / Shell (shellcheck) (push) Successful in 11s

Details

61ed3c64e3

chat.lotusguild.org's config.json has never had featuredCommunities, so
Explore → Featured was empty on the web while the desktop app showed the
Lotus Guild space, Homelab, Jellyfin and matrixrooms.info. Add the same
set (decided 2026-10-04).

Fixes #20

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared merged commit 0aa34123a8 into main

2026-10-18 19:45:53 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#32