fix: remove csp headers in notion desktop

README.md

@@ -1,5 +1,5 @@
 # notion-enhancer/desktop
 
-an enhancer/customiser for the all-in-one productivity workspace notion.so (app)
+Customise the all-in-one productivity workspace Notion.
 
 [read the docs online](https://notion-enhancer.github.io/)

package.json

@@ -2,7 +2,7 @@
   "name": "notion-enhancer",
   "version": "0.11.1",
   "author": "dragonwocky <thedragonring.bod@gmail.com> (https://dragonwocky.me/)",
-  "description": "An enhancer/customiser for the all-in-one productivity workspace Notion",
+  "description": "Customise the all-in-one productivity workspace Notion.",
   "homepage": "https://notion-enhancer.github.io",
   "repository": "github:notion-enhancer/desktop",
   "bugs": "https://github.com/notion-enhancer/desktop/issues",

scripts/patch-desktop-app.mjs

@@ -36,6 +36,11 @@ const patches = {
         (content = replaceIfNotFound(
           { string: content, mode: "prepend" },
           ...args
+        )),
+      append = (...args) =>
+        (content = replaceIfNotFound(
+          { string: content, mode: "append" },
+          ...args
         ));
 
     // https://github.com/notion-enhancer/notion-enhancer/issues/160:
@@ -53,12 +58,17 @@ const patches = {
     // bypass webRequest filter to load enhancer menu
     replace(/(\w)\.top!==\w\?(\w)\(\{cancel:!0\}\)/, "$1.top!==$1?$2({})");
 
-    // https://github.com/notion-enhancer/desktop/issues/291
-    // bypass csp issues by intercepting the notion:// protocol
+    // serve enhancer sources over the notion:// protocol
     const protocolHandler = /try\{const \w=await \w\.assetCache\.handleRequest\(\w\);/,
       protocolInterceptor = `{const n="notion://www.notion.so/__notion-enhancer/";if(e.url.startsWith(n))return require("electron").net.fetch(\`file://\${require("path").join(__dirname,"..","..","node_modules","notion-enhancer",e.url.slice(n.length))}\`)}`;
     prepend(protocolHandler, protocolInterceptor);
-    
+
+    // disable csp entirely. risky? yes. necessary? also yes.
+    // potentially could extend default policy instead someday.
+    const headerHandler = /\.onHeadersReceived\(\(\((\w),\w\)=>{/,
+      cspDisabler = `{const responseHeaders=$1.responseHeaders;if(responseHeaders){delete responseHeaders["content-security-policy"];return t({responseHeaders})}}`
+    append(headerHandler, cspDisabler);
+
     // expose the app's config + cache + preferences to the global namespace
     // e.g. to enable development mode or check if keep in background is enabled
     prepend(/\w\.exports=JSON\.parse\('\{"env":"production"/, "globalThis.__notionConfig=");

src/core/mod.json

@@ -2,7 +2,7 @@
   "name": "notion-enhancer",
   "version": "0.11.1",
   "id": "0f0bf8b6-eae6-4273-b307-8fc43f2ee082",
-  "description": "an enhancer/customiser for the all-in-one productivity workspace notion.so",
+  "description": "Customise the all-in-one productivity workspace Notion.",
   "tags": ["core"],
   "authors": [
     {
@@ -73,7 +73,7 @@
       "key": "developerMode",
       "description": "Activates built-in debugging tools accessible through the application menu.",
       "platforms": ["linux", "win32", "darwin"],
-      "value": true
+      "value": false
     }
   ],
   "clientStyles": ["variables.css", "../vendor/@unocss-preflight-tailwind.css"],

src/manifest.json

@@ -3,7 +3,7 @@
   "name": "notion-enhancer",
   "version": "0.11.1",
   "author": "dragonwocky <thedragonring.bod@gmail.com> (https://dragonwocky.me/)",
-  "description": "An enhancer/customiser for the all-in-one productivity workspace Notion",
+  "description": "Customise the all-in-one productivity workspace Notion.",
   "homepage_url": "https://notion-enhancer.github.io",
   "content_scripts": [{ "matches": ["*://*.notion.so/*"], "js": ["/init.js"] }],
   "background": { "service_worker": "/worker.js" },