[BUG] app_loader fails before Unity project can load. Discord CSP appears to block importmap because it's an inline script tag.

[SamNChiet]

Describe the bug
Given the default Dissonity template on Unity 6000.3.13f1, the app_loader will fail to launch the Unity project, because Discord's CSP prevents the importmap from running.

Reproduction

1. Create a blank Unity project.
2. Import Dissonity
3. Host the project
4. Run it in an Activity with the web console open

Expected behavior
The webpage finishes loading after the black screen.

Screenshots
Progress is arrested, with the following errors:

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval' 'nonce-MjI5LDMzLDIzMSwyMDcsNTQsMjIzLDI0OSwyMDI=' blob:”. Consider using a hash ('sha256-naHJ3iD8mbIyFIstpdyq4qddqB9sZHU1Vs4KA0OdbM8=') or a nonce.

Uncaught (in promise) TypeError: The specifier “dso_proxy_bridge/dissonity_hirpc.js” was a bare specifier, but was not remapped to anything. Relative module specifiers must start with “./”, “../” or “/”.

Platform
Web client + Desktop client

Additional context
Removing the importmap script tag from index.html and modifying lines 22 and 23 of app_loader.js appears to resolve the error.

// updated version
const proxyBridgeImport = "./.proxy/Bridge/";
const normalBridgeImport = "./Bridge/";

(That said, after fixing this issue... and this could be my fault, I'm at a loss, but it appears that Dissonity gets stuck initializing the RPC feature and never launches the app. The authentication in my server worked on the example app, the token request path is /api/token...

Really puzzling. Tried to smoke out if this had any thing to do with the importmap but I didn't come up with anything)

[SamNChiet]

Also I just wanna say despite these issues, this is one of the friendliest Unity libraries I've ever used. Really, really well-designed.

[SamNChiet]

For what it's worth, this is my ASP.NET server - again, worked totally fine to serve tokens for the official Getting Started Activities example, so I know at least that part isn't the problem.
And the game runs completely fine when I go to the page (whether on localhost or in the cloudflare-provided URL).

class Program
{
    const int port = 3001;
    static HttpClient http = new();

    static void Main(string[] args)
    {
        WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
        WebApplication app = builder.Build();

        // note: we're building uncompressed right now to rule issues out, so this is fine.
        var provider = new FileExtensionContentTypeProvider();
        provider.Mappings[".data"] = "application/octet-stream";
        provider.Mappings[".wasm"] = "application/wasm";
        app.UseStaticFiles(new StaticFileOptions()
        {
            ContentTypeProvider = provider,
        });
        app.UseRouting();

        app.MapPost("/api/token", POST_GetAccessToken);
        // note: hack to serve the main page
        string htmlPath = Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html");
        string html = File.ReadAllText(htmlPath);
        app.MapGet("/", async (HttpContext context) => {
            await context.Response.WriteAsync(html);
        });

        app.Run($"http://localhost:{port}"); // for now, runs on localhost + uses cloudflared
    }

    record AccessTokenRequest(string code);
    record AccessTokenResponse(string access_token);
    async static Task<IResult> POST_GetAccessToken(AccessTokenRequest req) {

        KeyValuePair<string, string>[] formArr =
        [
            new("client_id", DISCORD_CLIENT_ID),
            new("client_secret", DISCORD_CLIENT_SECRET),
            new("grant_type", "authorization_code"),
            new("code", req.code),
        ];

        var postContent = new FormUrlEncodedContent(formArr);
        postContent.Headers.ContentType = MediaTypeHeaderValue.Parse("application /x-www-form-urlencoded");

        var response = await http.PostAsync(
            "https://discord.com/api/oauth2/token",
            postContent
        );

        AccessTokenResponse? token = await response.Content.ReadFromJsonAsync<AccessTokenResponse>();

        if (!response.IsSuccessStatusCode || token?.access_token == null) { return Results.BadRequest(token); }
        return Results.Ok(token);
    }
}

Both the activity root URL and the OAuth URL point to the same server via cloudflared. The auth endpoint works on the example project and, for my main page, in a browser.

Maybe I'm stepping on a rake by using an OAuth scope that isn't permitted on Discord's side with the current config?

using Dissonity;
using Dissonity.Models;
using Dissonity.Models.Builders;

[DissonityConfig]
public class DissonityConfiguration : SdkConfiguration<ServerTokenRequest, ServerTokenResponse>
{
    // Standard configuration
    // Hover over properties for more information!

    // Initialization
    public override long ClientId => xxxx;
    public override string[] OauthScopes => new string[] { OauthScope.Identify, OauthScope.Guilds, OauthScope.ApplicationsCommands, /*, your-oauth-scopes*/ };
    public override string TokenRequestPath => "/api/token";

    // Logging
    public override bool DisableDissonityInfoLogs => false;
    
    // Patch Url Mappings
    public override MappingBuilder[] Mappings => new MappingBuilder[] {
        new()
        /*{
            Prefix = "/example",
            Target = "example.com"
        }*/
    };

    // Utils
    public override bool SynchronizeUser => false;
    public override bool SynchronizeGuildMemberRpc => false;

    // Resolution
    public override ScreenResolution DesktopResolution => ScreenResolution.Max;
    public override ScreenResolution MobileResolution => ScreenResolution.Max;
}

[Furnyr]

I'll take a deeper look at this when I have time. Hopefully it's just a configuration problem and not caused by any changes that Discord made on their end.

In any case, the whole initialization process is documented here if you want to look into it.

[SamNChiet]

Thank you so much!
I can share a sample repo (and share my Discord app settings) in case something got messed up project-side if it helps, though I haven't yet figured out what that could be. Could totally be something silly.
The only thing that jumps out at me reading through that doc is the error cites "missing a 'token' field" vs. the "access_token" field referenced elsewhere - but I assume that error is just on a data structure internal to hirpc. I'm also short on time to step through the unminified code this week sadly. Fingers crossed it's something small.