Tests for CSP and route handlers pulled from Nexus

[david-crespo]

While doing #3400, I realized I wanted a way to test the CSP from Nexus against our actual production bundle. I decide that because CSP is enforced in the browser, we don't need Nexus for this at all, we just need the CSP string. So all we have to do is use regex to extract that from the pinned Omicron commit, and then we can test the CSP with vite preview and a Playwright test. I was able to confirm the test fails when it's supposed to: on the #3400 branch, if I comment out the step that moves React Router's inline bootstrap scripts into separate files, the app never renders and the test fails with the browser's CSP errors:

Error: expect(received).toEqual(expected) // deep equality
- Array []
+ Array [
+   "Executing inline script violates the following Content Security Policy directive 'default-src 'self''. [...] The action has been blocked.",
+   [3 more of those]
+   "CSP violation: script-src-elem inline",
+   "CSP violation: script-src-elem inline",

Once I had that in place, I thought about what else we might want to test about the contract with Nexus, and I remembered that I have sometimes forgotten to add a new route handler on the Nexus side when we added a new top-level route prefix in the console. So I added a test that similarly extracts the console routes from Nexus and makes sure all the client-side routes are covered by those handlers. That immediately turned up a bug (go to https://oxide.sys.r3.oxide-preview.com/images, click an image, and then refresh — 404), which is fixed in
oxidecomputer/omicron#11467. So the test will fail until that is merged and omicron is bumped.

This is nice and neat because #3402 pulls out the setup.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
console	Ready	Preview	Oct 9, 2026 7:29pm UTC