inventory.json

@@ -19,7 +19,10 @@
         },
         "roles": {
           "default": {
-            "machines": ["minimal-inventory-machine"]
+            "machines": ["minimal-inventory-machine"],
+            "config": {
+              "packages": ["vim"]
+            }
           }
         },
         "machines": {

lib/inventory/build-inventory/default.nix

@@ -83,16 +83,23 @@ let
               else
                 throw "Module doesn't have role: '${role}'. Path: ${path} not found."
             ) inverseRoles.${machineName} or [ ];
+
+            roleServiceConfigs = builtins.map (
+              role: serviceConfig.roles.${role}.config or { }
+            ) inverseRoles.${machineName} or [ ];
           in
           if isInService then
             acc2
             ++ [
               {
                 imports = [ clan-core.clanModules.${moduleName} ] ++ roleModules;
-                config.clan.${moduleName} = lib.mkMerge [
-                  globalConfig
-                  machineServiceConfig
-                ];
+                config.clan.${moduleName} = lib.mkMerge (
+                  [
+                    globalConfig
+                    machineServiceConfig
+                  ]
+                  ++ roleServiceConfigs
+                );
               }
               {
                 config.clan.inventory.services.${moduleName}.${instanceName} = {

lib/inventory/build-inventory/interface.nix

@@ -94,6 +94,7 @@ in
                     apply = lib.unique;
                     type = t.listOf tagRef;
                   };
+                  options.config = moduleConfig;
                 }
               );
             };

pkgs/clan-app/README.md

@@ -14,6 +14,7 @@ Follow the instructions below to set up your development environment and start t
    Go to the `clan-core/pkgs/webview-ui/app` directory and start the web server by executing:
 
    ```bash
+   npm i
    vite
    ```
 
@@ -121,4 +122,4 @@ Here are some important documentation links related to the Clan App:
 
 > Error dialogs should be avoided where possible, since they are disruptive.
 >
-> For simple non-critical errors, toasts can be a good alternative.
+> For simple non-critical errors, toasts can be a good alternative.

pkgs/clan-app/clan_app/views/webview.py

@@ -205,6 +205,8 @@ class WebView:
         # settings.
         settings.set_property("enable-developer-extras", True)
         self.webview.set_settings(settings)
+        # Fixme. This filtering is incomplete, it only triggers if a user clicks a link
+        self.webview.connect("decide-policy", self.on_decide_policy)
 
         self.manager = self.webview.get_user_content_manager()
         # Can be called with: window.webkit.messageHandlers.gtk.postMessage("...")
@@ -213,11 +215,38 @@ class WebView:
         self.manager.connect("script-message-received", self.on_message_received)
 
         self.webview.load_uri(content_uri)
+        self.content_uri = content_uri
 
         # global mutex lock to ensure functions run sequentially
         self.mutex_lock = Lock()
         self.queue_size = 0
 
+    def on_decide_policy(
+        self,
+        webview: WebKit.WebView,
+        decision: WebKit.PolicyDecision,
+        decision_type: WebKit.PolicyDecisionType,
+    ) -> bool:
+        if decision_type != WebKit.PolicyDecisionType.NAVIGATION_ACTION:
+            return False  # Continue with the default handler
+
+        navigation_action = decision.get_navigation_action()
+        request = navigation_action.get_request()
+        uri = request.get_uri()
+        if self.content_uri.startswith("http://") and uri.startswith(self.content_uri):
+            log.debug(f"Allow navigation request: {uri}")
+            return False
+        elif self.content_uri.startswith("file://") and uri.startswith(
+            self.content_uri
+        ):
+            log.debug(f"Allow navigation request: {uri}")
+            return False
+        log.warning(
+            f"Do not allow navigation request: {uri}. Current content uri: {self.content_uri}"
+        )
+        decision.ignore()
+        return True  # Stop other handlers from being invoked
+
     def on_message_received(
         self, user_content_manager: WebKit.UserContentManager, message: Any
     ) -> None: