Jul 16 - Fill the gaps between Single-tenant mode and Multi-tenant mode - MT2

app/__init__.py

@@ -122,6 +122,11 @@ def create_app(config_name='default'):
     app.jinja_env.globals['sla_hours_remaining'] = sla_hours_remaining
     app.jinja_env.globals['SLA_HOURS']           = SLA_HOURS
 
+    # Photo URL resolver — routes through the active storage backend so templates
+    # work unchanged when the backend flips from local to R2 (see utils/storage.py).
+    from app.utils import storage as _storage
+    app.jinja_env.globals['media_url'] = _storage.media_url
+
     # ── Inject unread notification count into every template context ──────
     # This powers the red badge on the navbar bell icon without requiring
     # individual routes to pass the count manually.
@@ -275,6 +280,18 @@ def create_app(config_name='default'):
     # ── Security response headers ─────────────────────────────────────────
     # Applied to every response. Blocks clickjacking, MIME sniffing, and
     # obvious XSS vectors without breaking Bootstrap CDN / Google Fonts.
+    # Allow R2 presigned photo URLs in the CSP img-src when the s3 storage
+    # backend is configured. Derived from R2_ENDPOINT_URL (the presigned URL
+    # host is the same R2 account endpoint), so nothing is hardcoded and the
+    # local backend is unaffected.
+    _r2_img_src = ''
+    _r2_endpoint = app.config.get('R2_ENDPOINT_URL')
+    if _r2_endpoint:
+        from urllib.parse import urlparse
+        _r2_host = urlparse(_r2_endpoint).netloc
+        if _r2_host:
+            _r2_img_src = f' https://{_r2_host}'
+
     @app.after_request
     def set_security_headers(response):
         from flask import request as _request
@@ -287,7 +304,7 @@ def create_app(config_name='default'):
             "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
             "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; "
             "font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net; "
-            "img-src 'self' data: blob: https://maps.gstatic.com https://maps.googleapis.com; "
+            f"img-src 'self' data: blob: https://maps.gstatic.com https://maps.googleapis.com{_r2_img_src}; "
             "connect-src 'self' https://cdn.jsdelivr.net; "
             "frame-src https://maps.google.com https://www.google.com; "
             # Hardening directives that don't affect existing inline scripts/styles: