Function csp 

pub fn csp() -> &'static str

The Content-Security-Policy the page is served with: the pinned CDN files (whose integrity the page also names) and the one inline script, by its digest; requests to this server alone; no frame may embed it. The page shares an origin with every write route, so a script it did not ship must not run on it.

use majordomus_cli::http::swagger;
let policy = swagger::csp();
assert!(policy.starts_with("default-src 'none'"));
assert!(policy.contains("frame-ancestors 'none'"));
assert!(policy.contains("script-src https://unpkg.com/swagger-ui-dist@"));
assert!(!policy.contains("unsafe-eval"));