ddidderr
acb0c20b59
The page depended on the externally hosted miniquad bundle, which violates a same-origin `script-src 'self'` policy and makes the game depend on a third party at runtime. Vendor the current official loader alongside the web assets and move the WASM `load` call into a local bootstrap script, preserving plugin registration order without inline JavaScript. Document the CSP requirement for WebAssembly compilation and same-origin connections. The vendored bundle is the current response from the official Macroquad loader URL and was syntax-checked before committing. Test Plan: - `just web-build` -- passed - `node --check web/mq_js_bundle.js web/storage.js web/bootstrap.js` -- passed - `prettier --check web/storage.js web/bootstrap.js` -- passed - Browser smoke test with `script-src 'self' 'wasm-unsafe-eval'` and `connect-src 'self'` -- passed; 640x460 canvas and no CSP/script errors - `git diff --cached --check` -- passed
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# TDK Pinball Machine web build
|
|
|
|
Build and serve the browser version from this directory with:
|
|
|
|
```sh
|
|
just web-serve
|
|
```
|
|
|
|
The game is compiled for `wasm32-unknown-unknown` and loaded into a fixed
|
|
640x460 canvas centered on the black page by `index.html`. Browser settings and
|
|
a fallback copy of the high-score table are saved in `localStorage`; native
|
|
builds continue to use their normal per-user save file.
|
|
|
|
The page includes the official Macroquad browser loader locally. The WASM
|
|
bootstrap is local as well, so the page does not require inline or third-party
|
|
JavaScript. The web page must be served over HTTP rather than opened directly
|
|
from a `file:` URL.
|
|
|
|
For a strict Content Security Policy, allow `script-src 'self'
|
|
'wasm-unsafe-eval'` for the browser's WebAssembly compilation and
|
|
`connect-src 'self'` for the local WASM and optional high-score API requests.
|
|
|
|
When the same-origin `/api/highscores` endpoint is available, the browser loads
|
|
and submits the shared top-ten table there. The small Axum service and an nginx
|
|
proxy example are in [highscore-server](../highscore-server/).
|