Merge pull request #30 from Johnaverse/copilot/sub-pr-29

Harden CSP, bundle UI assets locally, add Node engines constraint, optimize countChainsByTag, add unit tests

Author: Johnaverse

dataService.js

@@ -1039,10 +1039,22 @@ export function getAllChains() {
  */
 export function countChainsByTag(chains) {
   const totalChains = chains.length;
-  const totalTestnets = chains.filter(c => c.tags?.includes('Testnet')).length;
-  const totalL2s = chains.filter(c => c.tags?.includes('L2')).length;
-  const totalBeacons = chains.filter(c => c.tags?.includes('Beacon')).length;
-  const totalMainnets = chains.filter(c => !c.tags?.includes('Testnet') && !c.tags?.includes('L2') && !c.tags?.includes('Beacon')).length;
+  let totalTestnets = 0;
+  let totalL2s = 0;
+  let totalBeacons = 0;
+  let totalMainnets = 0;
+
+  for (const chain of chains) {
+    const tags = chain.tags || [];
+    const isTestnet = tags.includes('Testnet');
+    const isL2 = tags.includes('L2');
+    const isBeacon = tags.includes('Beacon');
+
+    if (isTestnet) totalTestnets += 1;
+    if (isL2) totalL2s += 1;
+    if (isBeacon) totalBeacons += 1;
+    if (!isTestnet && !isL2 && !isBeacon) totalMainnets += 1;
+  }
 
   return { totalChains, totalMainnets, totalTestnets, totalL2s, totalBeacons };
 }

index.js

@@ -52,10 +52,10 @@ export async function buildApp(options = {}) {
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
-        scriptSrc: ["'self'", "https://unpkg.com"],
-        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-        fontSrc: ["'self'", "https://fonts.gstatic.com"],
-        connectSrc: ["'self'", "https://raw.githubusercontent.com"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'"],
+        fontSrc: ["'self'"],
+        connectSrc: ["'self'"],
         imgSrc: ["'self'", "data:"]
       }
     }

package-lock.json

@@ -28,6 +28,9 @@
     "url": "https://github.com/Johnaverse/chains-api/issues"
   },
   "homepage": "https://github.com/Johnaverse/chains-api#readme",
+  "engines": {
+    "node": ">=20"
+  },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",

package.json

@@ -233,13 +233,13 @@ function initUI() {
 
 async function fetchData() {
     try {
-        // Try local API first (/export), fall back to GitHub raw
+        // Try local API first (/export), fall back to bundled export.json
         let res;
         try {
             res = await fetch('/export');
             if (!res.ok) throw new Error('Local export unavailable');
         } catch {
-            res = await fetch('https://raw.githubusercontent.com/Johnaverse/chains-api/refs/heads/main/public/export.json');
+            res = await fetch('export.json');
         }
         const exportData = await res.json();