Maurice 2f71549413 fix(maps): let the imagery through the CSP, so the GL switch does something ...

The satellite toggle has worked on Leaflet for as long as it has existed and did
nothing at all on a GL map, which is the default renderer since the vector basemap
landed. Not for want of the layer: connect-src never named server.arcgisonline.com.

Leaflet asks for a tile as an <img>, and img-src waves every https: host through,
so the gap could sit there unnoticed for as long as Leaflet was the only renderer
that showed the imagery. A GL map reads the raster through fetch to hand it to
WebGL, and that lands on connect-src instead, where the host is missing. The
browser refuses it in the document, which is the worst shape a failure can take
here: the switch flips, the layer goes on, the source is there, and no tile ever
arrives. Nothing in the app can see it either, because a CSP refusal is not an
error the fetch can catch.

The prefetcher asks for the same tiles the same way, with mode 'no-cors', which
relaxes CORS and not CSP, so the imagery was never cached for offline use either.

Same shape as #2180, which added the other two raster presets for exactly this
reason and did not reach this host.

2026-09-09 16:57:10 +02:00

..

globalMiddleware.csp.test.ts

fix(maps): let the imagery through the CSP, so the GL switch does something

2026-09-09 16:57:10 +02:00

globalMiddleware.redaction.test.ts

fix(maps): let users and admins enter a CARTO API key (#2060)

2026-08-27 12:06:55 +02:00