From 3a23e7e56643a29205369d84eb19d60d778418fd Mon Sep 17 00:00:00 2001
From: rafaelDev0ps <devops@rafaelmattos.com>
Date: Tue, 14 Jan 2025 21:32:18 -0300
Subject: [PATCH] Add CSP nonce. Resolves: #69

---
 framework/h/render.go   | 6 ++++++
 framework/h/renderer.go | 8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/framework/h/render.go b/framework/h/render.go
index bad3b35..e19558b 100644
--- a/framework/h/render.go
+++ b/framework/h/render.go
@@ -20,6 +20,12 @@ func WithDocType() RenderOpt {
 	}
 }
 
+func WithNonce(nonce string) RenderOpt {
+	return func(context *RenderContext, opt *RenderOptions) {
+		context.nonce = nonce
+	}
+}
+
 // Render renders the given node recursively, and returns the resulting string.
 func Render(node Ren, opts ...RenderOpt) string {
 	builder := &strings.Builder{}
diff --git a/framework/h/renderer.go b/framework/h/renderer.go
index b0969a9..d0b2b1c 100644
--- a/framework/h/renderer.go
+++ b/framework/h/renderer.go
@@ -2,10 +2,11 @@ package h
 
 import (
 	"fmt"
-	"github.com/maddalax/htmgo/framework/hx"
 	"html"
 	"html/template"
 	"strings"
+
+	"github.com/maddalax/htmgo/framework/hx"
 )
 
 type CustomElement = string
@@ -44,16 +45,17 @@ type RenderContext struct {
 	builder        *strings.Builder
 	scripts        []ScriptEntry
 	currentElement *Element
+	nonce          string
 }
 
 func (ctx *RenderContext) AddScript(funcName string, body string) {
 	script := fmt.Sprintf(`
-	<script id="%s">
+	<script id="%s" nonce="%s">
 		function %s(self, event) {
 				let e = event;
 				%s
 		}
-	</script>`, funcName, funcName, body)
+	</script>`, funcName, ctx.nonce, funcName, body)
 
 	ctx.scripts = append(ctx.scripts, ScriptEntry{
 		Body:    script,