Skip to content

Commit d12712e

Browse files
release: v1.2.1 — Flow CSP-safe styles and widget fixes
- Serve GET /_resuma/flow.css and add flow_styles_link() - Add flow_execution_panel_auth() without inline styles for dynamic panels - Apply CSP nonce to flow_styles() during SSR - Stop graph refresh noise after completion; dedupe widget mounts per graph_id - Return application/javascript for missing handler chunks (fixes import MIME errors) Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 89178be commit d12712e

14 files changed

Lines changed: 347 additions & 193 deletions

File tree

CHANGELOG.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,21 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
66

77
## [Unreleased]
88

9+
## [1.2.1] - 2026-07-11
10+
11+
### Added
12+
13+
- **`GET /_resuma/flow.css`** — static Flow widget stylesheet (CSP-safe alternative to inline `flow_styles()` on dynamically injected panels).
14+
- **`flow_styles_link()`**`<link rel="stylesheet" href="/_resuma/flow.css">` for pages that mount Flow HTML after load.
15+
- **`flow_execution_panel_auth`** — execution panel without embedded styles (pair with `flow_styles_link()` or layout `flow_styles()`).
16+
17+
### Fixed
18+
19+
- **Flow `flow_styles()` CSP** — inline `<style>` tags now receive the per-request CSP nonce during SSR.
20+
- **Flow graph 401 noise** — terminal graphs show “Graph finished.” instead of token errors; completed graphs skip refresh polling.
21+
- **Flow widget remounts**`initFlowWidgets` dedupes graph/stream/panel mounts per `graph_id` to prevent duplicate SSE replays.
22+
- **Handler chunk 404 MIME** — missing `/_resuma/handler/{chunk}.js` returns `application/javascript` so dynamic `import()` fails with a clear error instead of a MIME block.
23+
924
## [1.2.0] - 2026-07-09
1025

1126
### Fixed

Cargo.toml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ members = [
1313
]
1414

1515
[workspace.package]
16-
version = "1.2.0"
16+
version = "1.2.1"
1717
edition = "2021"
1818
rust-version = "1.91"
1919
authors = ["Resuma Contributors"]
@@ -27,9 +27,9 @@ categories = ["web-programming", "asynchronous"]
2727
readme = "README.md"
2828

2929
[workspace.dependencies]
30-
resuma-macros = { path = "crates/resuma-macros", version = "1.2.0" }
31-
resuma = { path = "crates/resuma", version = "1.2.0" }
32-
resuma-flow = { path = "crates/resuma-flow", version = "1.2.0" }
30+
resuma-macros = { path = "crates/resuma-macros", version = "1.2.1" }
31+
resuma = { path = "crates/resuma", version = "1.2.1" }
32+
resuma-flow = { path = "crates/resuma-flow", version = "1.2.1" }
3333

3434
# 3rd-party
3535
serde = { version = "1", features = ["derive"] }

crates/resuma-flow/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ categories.workspace = true
1414
keywords = ["web", "framework", "ssr", "flow", "workers"]
1515

1616
[dependencies]
17-
resuma = { path = "../resuma", version = "1.2.0" }
17+
resuma = { path = "../resuma", version = "1.2.1" }
1818
serde = { workspace = true }
1919
serde_json = { workspace = true }
2020

crates/resuma-flow/src/components/flow_execution.rs

Lines changed: 89 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,95 @@ pub fn flow_execution_auth(
1717
graph_id: impl Into<String>,
1818
live: bool,
1919
access_token: Option<String>,
20+
) -> View {
21+
flow_execution_auth_opts(graph_id, live, access_token, true)
22+
}
23+
24+
/// Same as [`flow_execution_auth`] but omits embedded [`flow_styles`] (for dynamic HTML injection).
25+
///
26+
/// Include [`super::flow_styles_link`] once on the page, or call `flow_styles()` in the layout.
27+
pub fn flow_execution_panel_auth(
28+
graph_id: impl Into<String>,
29+
live: bool,
30+
access_token: Option<String>,
31+
) -> View {
32+
flow_execution_auth_opts(graph_id, live, access_token, false)
33+
}
34+
35+
fn flow_execution_auth_opts(
36+
graph_id: impl Into<String>,
37+
live: bool,
38+
access_token: Option<String>,
39+
include_styles: bool,
2040
) -> View {
2141
let id = graph_id.into();
42+
let mut children = Vec::new();
43+
if include_styles {
44+
children.push(Child::View(flow_styles()));
45+
}
46+
children.extend([
47+
Child::View(View::Element(Element {
48+
tag: "div".into(),
49+
attrs: vec![Attr {
50+
name: "class".into(),
51+
value: AttrValue::Static("r-flow-exec__panel".into()),
52+
}],
53+
children: vec![
54+
Child::View(View::Element(Element {
55+
tag: "h3".into(),
56+
attrs: vec![],
57+
children: vec![Child::Text("Execution graph".into())],
58+
dom_id: None,
59+
})),
60+
Child::View(flow_graph_auth(id.clone(), live, access_token.clone())),
61+
],
62+
dom_id: None,
63+
})),
64+
Child::View(View::Element(Element {
65+
tag: "aside".into(),
66+
attrs: vec![Attr {
67+
name: "class".into(),
68+
value: AttrValue::Static("r-flow-exec__side".into()),
69+
}],
70+
children: vec![
71+
Child::View(View::Element(Element {
72+
tag: "div".into(),
73+
attrs: vec![Attr {
74+
name: "class".into(),
75+
value: AttrValue::Static("r-flow-exec__panel".into()),
76+
}],
77+
children: vec![
78+
Child::View(View::Element(Element {
79+
tag: "h3".into(),
80+
attrs: vec![],
81+
children: vec![Child::Text("Controls".into())],
82+
dom_id: None,
83+
})),
84+
Child::View(worker_panel_auth(id.clone(), access_token.clone())),
85+
],
86+
dom_id: None,
87+
})),
88+
Child::View(View::Element(Element {
89+
tag: "div".into(),
90+
attrs: vec![Attr {
91+
name: "class".into(),
92+
value: AttrValue::Static("r-flow-exec__panel".into()),
93+
}],
94+
children: vec![
95+
Child::View(View::Element(Element {
96+
tag: "h3".into(),
97+
attrs: vec![],
98+
children: vec![Child::Text("Event stream".into())],
99+
dom_id: None,
100+
})),
101+
Child::View(event_stream_auth(id.clone(), access_token)),
102+
],
103+
dom_id: None,
104+
})),
105+
],
106+
dom_id: None,
107+
})),
108+
]);
22109
View::Element(Element {
23110
tag: "div".into(),
24111
attrs: vec![
@@ -28,73 +115,10 @@ pub fn flow_execution_auth(
28115
},
29116
Attr {
30117
name: "data-r-flow-execution".into(),
31-
value: AttrValue::Static(id.clone()),
118+
value: AttrValue::Static(id),
32119
},
33120
],
34-
children: vec![
35-
Child::View(flow_styles()),
36-
Child::View(View::Element(Element {
37-
tag: "div".into(),
38-
attrs: vec![Attr {
39-
name: "class".into(),
40-
value: AttrValue::Static("r-flow-exec__panel".into()),
41-
}],
42-
children: vec![
43-
Child::View(View::Element(Element {
44-
tag: "h3".into(),
45-
attrs: vec![],
46-
children: vec![Child::Text("Execution graph".into())],
47-
dom_id: None,
48-
})),
49-
Child::View(flow_graph_auth(id.clone(), live, access_token.clone())),
50-
],
51-
dom_id: None,
52-
})),
53-
Child::View(View::Element(Element {
54-
tag: "aside".into(),
55-
attrs: vec![Attr {
56-
name: "class".into(),
57-
value: AttrValue::Static("r-flow-exec__side".into()),
58-
}],
59-
children: vec![
60-
Child::View(View::Element(Element {
61-
tag: "div".into(),
62-
attrs: vec![Attr {
63-
name: "class".into(),
64-
value: AttrValue::Static("r-flow-exec__panel".into()),
65-
}],
66-
children: vec![
67-
Child::View(View::Element(Element {
68-
tag: "h3".into(),
69-
attrs: vec![],
70-
children: vec![Child::Text("Controls".into())],
71-
dom_id: None,
72-
})),
73-
Child::View(worker_panel_auth(id.clone(), access_token.clone())),
74-
],
75-
dom_id: None,
76-
})),
77-
Child::View(View::Element(Element {
78-
tag: "div".into(),
79-
attrs: vec![Attr {
80-
name: "class".into(),
81-
value: AttrValue::Static("r-flow-exec__panel".into()),
82-
}],
83-
children: vec![
84-
Child::View(View::Element(Element {
85-
tag: "h3".into(),
86-
attrs: vec![],
87-
children: vec![Child::Text("Event stream".into())],
88-
dom_id: None,
89-
})),
90-
Child::View(event_stream_auth(id, access_token)),
91-
],
92-
dom_id: None,
93-
})),
94-
],
95-
dom_id: None,
96-
})),
97-
],
121+
children,
98122
dom_id: None,
99123
})
100124
}

crates/resuma-flow/src/components/mod.rs

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ mod worker_panel;
99

1010
pub use event_stream::{event_stream, event_stream_auth};
1111
pub use flow_dashboard::{flow_dashboard, flow_dashboard_live, flow_dashboard_poll};
12-
pub use flow_execution::{flow_execution, flow_execution_auth, flow_ops_page};
12+
pub use flow_execution::{
13+
flow_execution, flow_execution_auth, flow_execution_panel_auth, flow_ops_page,
14+
};
1315
pub use flow_graph::{flow_graph, flow_graph_auth};
14-
pub use styles::flow_styles;
16+
pub use styles::{flow_styles, flow_styles_link, FLOW_CSS};
1517
pub use worker_panel::{worker_panel, worker_panel_auth};
Lines changed: 43 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,54 @@
1-
//! Shared Flow dashboard styles (include once per page via [`flow_styles`]).
1+
//! Shared Flow dashboard styles (include once per page via [`flow_styles`] or [`flow_styles_link`]).
22
33
use resuma::core::view::{Attr, AttrValue, Child, Element, View};
44

5-
/// Inline stylesheet for Flow execution UI widgets.
6-
pub const FLOW_CSS: &str = r#"
7-
.r-flow-dash{font-family:system-ui,-apple-system,sans-serif;color:#e8eaed;background:linear-gradient(145deg,#0f1419 0%,#1a2332 100%);border:1px solid #2d3a4f;border-radius:12px;padding:1.25rem;margin:1rem 0}
8-
.r-flow-dash__header{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:.75rem;margin-bottom:1.25rem}
9-
.r-flow-dash__title{margin:0;font-size:1.1rem;font-weight:600;letter-spacing:-.02em}
10-
.r-flow-dash__badge{font-size:.7rem;padding:.2rem .55rem;border-radius:999px;background:#1e3a2f;color:#6ee7b7;border:1px solid #065f46}
11-
.r-flow-dash__badge--warn{background:#3d2e12;color:#fcd34d;border-color:#92400e}
12-
.r-flow-dash__badge--err{background:#3f1d1d;color:#fca5a5;border-color:#991b1b}
13-
.r-flow-dash__grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:.75rem;margin-bottom:1.25rem}
14-
.r-flow-dash__stat{background:#0b1020;border:1px solid #243044;border-radius:8px;padding:.85rem}
15-
.r-flow-dash__stat-label{font-size:.68rem;text-transform:uppercase;letter-spacing:.06em;color:#8b9cb3;margin:0 0 .35rem}
16-
.r-flow-dash__stat-value{font-size:1.5rem;font-weight:700;margin:0;line-height:1.1}
17-
.r-flow-dash__section{margin-top:1rem}
18-
.r-flow-dash__section h3{margin:0 0 .6rem;font-size:.8rem;text-transform:uppercase;letter-spacing:.05em;color:#8b9cb3}
19-
.r-flow-dash__chips{display:flex;flex-wrap:wrap;gap:.4rem}
20-
.r-flow-dash__chip{font-size:.75rem;padding:.25rem .55rem;border-radius:6px;background:#1e293b;border:1px solid #334155;color:#cbd5e1}
21-
.r-flow-dash__table{width:100%;border-collapse:collapse;font-size:.8rem}
22-
.r-flow-dash__table th,.r-flow-dash__table td{padding:.45rem .5rem;text-align:left;border-bottom:1px solid #243044}
23-
.r-flow-dash__table th{color:#8b9cb3;font-weight:500}
24-
.r-flow-dash__bar{height:6px;background:#1e293b;border-radius:3px;overflow:hidden;margin-top:.25rem}
25-
.r-flow-dash__bar svg{display:block;width:100%;height:6px}
26-
.r-flow-dash__bar-fill{fill:#6366f1;height:100%}
27-
.r-flow-exec{display:grid;grid-template-columns:1fr;gap:1.15rem;margin:1rem 0}
28-
@media(min-width:900px){.r-flow-exec{grid-template-columns:1.15fr .85fr;align-items:start}}
29-
.r-flow-exec__side{display:flex;flex-direction:column;gap:1rem;min-width:0}
30-
.r-flow-exec__panel{background:#0f1419;border:1px solid #2d3a4f;border-radius:14px;padding:1.15rem 1.2rem}
31-
.r-flow-exec__panel h3{margin:0 0 .85rem;font-size:.8rem;color:#8b9cb3;text-transform:uppercase;letter-spacing:.06em;font-weight:700}
32-
.r-flow-graph__track{display:flex;flex-wrap:wrap;align-items:center;gap:.55rem;min-height:2.75rem;padding:.15rem 0}
33-
.r-flow-graph__node{font-size:.78rem;padding:.4rem .7rem;border-radius:999px;border:1px solid #334155;background:#1e293b;white-space:nowrap}
34-
.r-flow-graph__node--running{border-color:#3b82f6;background:#172554;color:#93c5fd;animation:r-flow-pulse 1.5s ease-in-out infinite}
35-
.r-flow-graph__node--done{border-color:#059669;background:#052e16;color:#6ee7b7}
36-
.r-flow-graph__node--failed{border-color:#dc2626;background:#450a0a;color:#fca5a5}
37-
.r-flow-graph__node--paused{border-color:#d97706;background:#451a03;color:#fcd34d}
38-
.r-flow-graph__arrow{color:#475569;font-size:.7rem}
39-
.r-flow-graph__status{margin:.65rem 0 0;font-size:.74rem;color:#64748b;line-height:1.45}
40-
.r-event-stream{display:flex;flex-direction:column;min-height:0;gap:.5rem}
41-
.r-event-stream__viewport{
42-
min-height:12rem;max-height:min(42vh,22rem);overflow-x:hidden;overflow-y:auto;overflow-anchor:none;
43-
overscroll-behavior:contain;
44-
padding:.65rem .75rem;border-radius:12px;border:1px solid #243044;
45-
background:rgba(11,16,32,.55);scroll-behavior:smooth;
46-
-webkit-overflow-scrolling:touch;
47-
}
48-
.r-event-stream__viewport:empty::before,
49-
.r-event-stream__viewport:has(.r-event-stream-list:empty)::before{
50-
content:"Waiting for events…";display:block;padding:.5rem .25rem;color:#64748b;font-size:.75rem;font-style:italic;
51-
}
52-
.r-event-stream-list{list-style:none;margin:0;padding:0;font-family:ui-monospace,monospace;font-size:.72rem;line-height:1.45}
53-
.r-event-stream-list li{
54-
padding:.42rem .55rem .42rem .7rem;margin:0 0 .28rem;border-radius:8px;
55-
border:1px solid #1e293b;color:#94a3b8;background:rgba(15,23,42,.35);
56-
}
57-
.r-event-stream-list li:last-child{margin-bottom:0;overflow-anchor:auto}
58-
.r-worker-panel{display:flex;flex-direction:column;gap:.65rem;margin:.5rem 0 0}
59-
.r-worker-panel__actions{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.55rem}
60-
@media(min-width:520px){.r-worker-panel__actions{grid-template-columns:repeat(4,minmax(0,1fr))}}
61-
.r-worker-panel__status{margin:0;font-size:.75rem;color:#64748b;line-height:1.4;min-height:1.1rem}
62-
.r-flow-control{
63-
display:inline-flex;align-items:center;justify-content:center;width:100%;
64-
font:inherit;font-size:.78rem;font-weight:600;line-height:1.2;
65-
padding:.52rem .85rem;border-radius:999px;cursor:pointer;
66-
border:1px solid #475569;
67-
background:linear-gradient(145deg,#1e293b 0%,#334155 100%);
68-
color:#f8fafc;
69-
box-shadow:0 4px 16px rgba(15,23,42,.18),inset 0 1px 0 rgba(255,255,255,.12);
70-
transition:transform .15s ease,box-shadow .15s ease,background .15s ease;
71-
}
72-
.r-flow-control:hover:not(:disabled){transform:translateY(-1px);box-shadow:0 8px 22px rgba(15,23,42,.22),inset 0 1px 0 rgba(255,255,255,.18)}
73-
.r-flow-control:active:not(:disabled){transform:translateY(0)}
74-
.r-flow-control:disabled{opacity:.42;cursor:not-allowed;transform:none}
75-
.r-flow-control--ghost{
76-
background:rgba(30,41,59,.72);
77-
border-color:rgba(148,163,184,.45);
78-
color:#e2e8f0;
79-
}
80-
.r-flow-control--pause{border-color:rgba(96,165,250,.45)}
81-
.r-flow-control--resume{border-color:rgba(52,211,153,.45)}
82-
.r-flow-control--danger{
83-
border-color:rgba(248,113,113,.55);
84-
background:linear-gradient(145deg,#7f1d1d 0%,#991b1b 100%);
85-
color:#fff;
86-
}
87-
.r-flow-control--replay{border-color:rgba(196,181,253,.4)}
88-
@keyframes r-flow-pulse{0%,100%{opacity:1}50%{opacity:.65}}
89-
"#;
5+
/// Flow widget stylesheet (served at `GET /_resuma/flow.css` and inlined by [`flow_styles`]).
6+
pub const FLOW_CSS: &str = include_str!("../../../resuma/assets/flow.css");
907

91-
/// Emit Flow widget CSS once per page (place in layout or page head).
8+
/// Emit Flow widget CSS inline (place in layout or page head).
9+
///
10+
/// When CSP is enabled, the per-request nonce from [`resuma::server::page_csp_nonce`] is applied.
11+
/// For HTML injected after the initial page load, prefer [`flow_styles_link`] plus the static
12+
/// `/_resuma/flow.css` route so styles are not blocked by `style-src-elem`.
9213
pub fn flow_styles() -> View {
14+
let mut attrs = vec![Attr {
15+
name: "data-r-flow-styles".into(),
16+
value: AttrValue::Static("true".into()),
17+
}];
18+
let nonce = resuma::server::page_csp_nonce();
19+
if !nonce.is_empty() {
20+
attrs.push(Attr {
21+
name: "nonce".into(),
22+
value: AttrValue::Static(nonce),
23+
});
24+
}
9325
View::Element(Element {
9426
tag: "style".into(),
95-
attrs: vec![Attr {
96-
name: "data-r-flow-styles".into(),
97-
value: AttrValue::Static("true".into()),
98-
}],
27+
attrs,
9928
children: vec![Child::Text(FLOW_CSS.into())],
10029
dom_id: None,
10130
})
10231
}
32+
33+
/// Link to the static Flow stylesheet (CSP-safe for dynamically injected panels).
34+
pub fn flow_styles_link() -> View {
35+
View::Element(Element {
36+
tag: "link".into(),
37+
attrs: vec![
38+
Attr {
39+
name: "rel".into(),
40+
value: AttrValue::Static("stylesheet".into()),
41+
},
42+
Attr {
43+
name: "href".into(),
44+
value: AttrValue::Static("/_resuma/flow.css".into()),
45+
},
46+
Attr {
47+
name: "data-r-flow-styles".into(),
48+
value: AttrValue::Static("link".into()),
49+
},
50+
],
51+
children: vec![],
52+
dom_id: None,
53+
})
54+
}

0 commit comments

Comments
 (0)