From c4c173129b2aac374b59c9744d699c63148da743 Mon Sep 17 00:00:00 2001
From: Illia Nykonchuk <notawril@gmail.com>
Date: Thu, 20 Aug 2026 11:09:27 +0200
Subject: [PATCH] fix(realm): allow the AI assistant CDN and the hydration
 script in the CSP

Add `https://cdn.redocly.com` to `script-src`. The AI assistant web
component playground loads the widget bundle from that host, and the
`srcdoc` preview iframe inherits this policy, so the bundle was blocked
and the playground rendered nothing.

Add the hash of the react-router hydration script. That script is on
every page and was blocked site-wide.
---
 redocly.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/redocly.yaml b/redocly.yaml
index 777b0ba2c..62789692b 100644
--- a/redocly.yaml
+++ b/redocly.yaml
@@ -205,6 +205,7 @@ responseHeaders:
           https://js.hs-analytics.net
           https://js.hs-banner.com
           https://cdn.jsdelivr.net
+          https://cdn.redocly.com
           'sha256-M28mypAFwwpIwIF9e1/A6867PQiwVvOrdqFSTFSa8/U=' 
           'sha256-Ed6Lei7deBSXT1iYYw0V36YZXaA4v7OsRknNjmNl/9c='
           'sha256-uDN+KkW4ljf+D4DbsWP5KpxyfG/7h+LNmZxMzbz/+1E='
@@ -220,7 +221,8 @@ responseHeaders:
           'sha256-+Ozb/ItuZAdaQgJd2RebN2rKWj1XkBuXVaV6/lT4Juo='
           'sha256-9qgU5FDrauEgF+e1iJWvsh46OwsIkNOLjkXggr/02jk='
           'sha256-v7ddZtWCUr5oF3kgrlEot4fG861CKDXUt0aTaNaIk6Q='
-          'sha256-+t5Z3fJi7uJxARWEzFEVaSRgtaAn0r97XkxpJNbQiK0=';
+          'sha256-+t5Z3fJi7uJxARWEzFEVaSRgtaAn0r97XkxpJNbQiK0='
+          'sha256-gOx3nRh8znDQR7T1VkI+fFXDgsNzf5enQqdi7NP11Vk=';
         object-src 'none'; 
         base-uri 'self'; 
         connect-src