From 889497b7ead1e44bdbb712bab5f25a77a4162706 Mon Sep 17 00:00:00 2001
From: Alexander Alemayhu <alexander@alemayhu.com>
Date: Sat, 16 May 2026 00:40:06 +0200
Subject: [PATCH] fix: allow Google Picker scripts in CSP script-src
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds https://apis.google.com and https://accounts.google.com to the CSP
meta tag's script-src directive so the Google Drive upload tab from #2306
can actually load gapi/Picker and Google Identity Services. Without this,
"Choose from Google Drive" throws "Couldn't load Google Drive" because the
two <script> tags injected by useGooglePicker are blocked at the browser
boundary.

Verified in prod browser console — both scripts were blocked with the
exact CSP violation message before this change.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 web/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/index.html b/web/index.html
index 87fa1f13d..bd5c75382 100644
--- a/web/index.html
+++ b/web/index.html
@@ -8,7 +8,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="theme-color" content="#000000" />
   <meta http-equiv="Content-Security-Policy"
-    content="script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://static.hotjar.com https://script.hotjar.com https://www.dropbox.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self';">
+    content="script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://static.hotjar.com https://script.hotjar.com https://www.dropbox.com https://apis.google.com https://accounts.google.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self';">
   <link rel="apple-touch-icon" href="/logo192.png" />
   <!--
       Notice the use of  in the tags above.