fix: remove broken createNonceGetter() (v1.0.1)

[Enalmada]

Summary

Removes broken createNonceGetter() function and updates documentation with official TanStack Router pattern.

Changes

Breaking Change

• Removed: createNonceGetter() function (had critical AsyncLocalStorage bug)
• Why: The createIsomorphicFn() wrapper broke AsyncLocalStorage context chain
• Migration: See docs/MIGRATION-1.0-to-1.0.1.md

Bug Fixes

• Fixed: CSP warnings by preventing 'unsafe-eval' from being copied to script-src-elem
• Fixed: Removed redundant directives ignored by 'strict-dynamic'
• Result: Zero browser console warnings

Documentation

• Updated: README with official TanStack pattern (direct context access)
• Updated: Security Model section to match actual implementation
• Added: Comprehensive migration guide
• Added: Deprecation notice in API docs

What Still Works

No changes to these (all work perfectly):

• ✅ createCspMiddleware() - Middleware nonce generation
• ✅ generateNonce() - Crypto-random nonce generation
• ✅ buildCspHeader() - CSP header building
• ✅ All security headers and CSP rules

Migration Path

Before (v1.0.0 - BROKEN):

import { createNonceGetter } from '@enalmada/start-secure';
const getNonce = createNonceGetter();
const router = createRouter({ ssr: { nonce: getNonce() } });

After (v1.0.1 - WORKING):

export async function getRouter() {
  let nonce: string | undefined;
  if (typeof window === 'undefined') {
    const { getStartContext } = await import('@tanstack/start-storage-context');
    nonce = getStartContext().contextAfterGlobalMiddlewares?.nonce;
  }
  return createRouter({ ssr: { nonce } });
}

Testing

• ✅ Built and tested in TanStarter integration
• ✅ Zero CSP violations
• ✅ Zero console warnings
• ✅ All quality checks passing

References

• Bug Analysis: CRITICAL-BUG.md
• Official TanStack Pattern: How to setup csp and global headers with tanstack start? TanStack/router#3028
• Changeset: .changeset/fix-remove-createNonceGetter-v1.0.1.md

[changeset-bot]

🦋 Changeset detected

Latest commit: 672a05b

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gemini-code-assist]

Summary of Changes

Hello @Enalmada, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the createNonceGetter() function that caused issues with AsyncLocalStorage context, leading to broken Content Security Policy (CSP) nonce application. The problematic function has been removed, and the library now adopts the official TanStack Router pattern for nonce retrieval. Additionally, CSP directives have been optimized to eliminate browser console warnings and improve the robustness of the security policy, ensuring a more stable and compliant implementation.

Highlights

• Breaking Change: createNonceGetter() Removal: The createNonceGetter() function has been removed due to a critical AsyncLocalStorage bug that prevented proper nonce access on the server-side. This is a breaking change, and users must migrate to a new pattern for nonce retrieval.
• Updated Nonce Retrieval Pattern: The recommended pattern for accessing nonces now aligns with the official TanStack Router approach, involving direct access to the contextAfterGlobalMiddlewares?.nonce within an async getRouter() function. A comprehensive migration guide has been added.
• CSP Directive Refinements: Content Security Policy (CSP) directives have been refined to prevent 'unsafe-eval' from being copied to script-src-elem (which caused browser warnings) and to remove redundant directives like 'self' and 'unsafe-inline' when 'strict-dynamic' is present, ensuring a cleaner and more effective CSP.
• Documentation Updates: The README and API documentation have been updated to reflect the changes, including the new nonce access pattern, deprecation notices, and detailed explanations of CSP behavior with strict-dynamic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request addresses a critical bug in createNonceGetter() by removing the function and aligning with the official TanStack Router pattern for nonce retrieval. The changes are thorough, covering not only the code fix but also significant improvements to the CSP generation logic and comprehensive updates to all documentation, including a new migration guide. The fix for CSP warnings by adjusting how 'strict-dynamic' and 'unsafe-eval' are handled is a great improvement for security and correctness. The documentation updates are excellent and will be very helpful for users migrating to the new version. I have one minor suggestion to improve the example code in the new migration guide for better debuggability.

[gemini-code-assist]

In the complete example, the try...catch block around getStartContext is a good defensive measure. However, silently catching the error and setting nonce to undefined might hide a fundamental setup problem from the developer. If getStartContext fails, it indicates a significant issue with the TanStack Start context. Logging the error would provide valuable debugging information if this unlikely scenario occurs.

Suggested change

	} catch (error) {
	// Context not available (shouldn't happen, but handle gracefully)
	nonce = undefined;
	}
	} catch (error) {
	// Context not available (shouldn't happen, but handle gracefully)
	console.error('[start-secure] Failed to get start context for nonce:', error);
	nonce = undefined;
	}