From 59d19f0550a1ac88762e35ce7069160b6fd23eb1 Mon Sep 17 00:00:00 2001
From: Anthony Williams <anthony.williams@sagebase.org>
Date: Tue, 6 Oct 2026 12:52:01 -0700
Subject: [PATCH 1/2] Add the local repo-services origin to connect-src

---
 src/main/webapp/Portal.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/webapp/Portal.html b/src/main/webapp/Portal.html
index 78bd856f4e..e30b28d7d7 100644
--- a/src/main/webapp/Portal.html
+++ b/src/main/webapp/Portal.html
@@ -10,7 +10,7 @@
 
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.synapse.org *.sagebase.org *.googleapis.com *.gstatic.com *.googletagmanager.com cdn.statuspage.io s3.amazonaws.com www.google-analytics.com kh896k90gyvg.statuspage.io *.youtube.com *.rstudio.com *.google.com *.shinyapps.io *.smartsheet.com sagebionetworks.jira.com 127.0.0.1:9876 localhost:5173 googleads.g.doubleclick.net www.googleadservices.com *.contentsquare.net airtable.com *.airtable.com; frame-ancestors 'self' https://*.synapse.org localhost; img-src * data: blob:; connect-src https://* http://127.0.0.1:8888 http://localhost:5173 ws://localhost:5173 wss://*.execute-api.us-east-1.amazonaws.com"
+      content="default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.synapse.org *.sagebase.org *.googleapis.com *.gstatic.com *.googletagmanager.com cdn.statuspage.io s3.amazonaws.com www.google-analytics.com kh896k90gyvg.statuspage.io *.youtube.com *.rstudio.com *.google.com *.shinyapps.io *.smartsheet.com sagebionetworks.jira.com 127.0.0.1:9876 localhost:5173 googleads.g.doubleclick.net www.googleadservices.com *.contentsquare.net airtable.com *.airtable.com; frame-ancestors 'self' https://*.synapse.org localhost; img-src * data: blob:; connect-src https://* http://127.0.0.1:8888 http://localhost:5173 http://localhost:8080 http://127.0.0.1:8080 ws://localhost:5173 wss://*.execute-api.us-east-1.amazonaws.com"
     />
     <meta
       name="google-site-verification"

From 70b089431dfa58b0371cf8c2f381d0a5e26b1076 Mon Sep 17 00:00:00 2001
From: Anthony Williams <anthony.williams@sagebase.org>
Date: Tue, 6 Oct 2026 12:54:01 -0700
Subject: [PATCH 2/2] remove trailing / from repo endpoint

---
 .../web/client/GlobalApplicationStateImpl.java            | 8 ++++++--
 .../web/unitclient/GlobalApplicationStateImplTest.java    | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/sagebionetworks/web/client/GlobalApplicationStateImpl.java b/src/main/java/org/sagebionetworks/web/client/GlobalApplicationStateImpl.java
index 4012e2986f..a35dac4bbf 100644
--- a/src/main/java/org/sagebionetworks/web/client/GlobalApplicationStateImpl.java
+++ b/src/main/java/org/sagebionetworks/web/client/GlobalApplicationStateImpl.java
@@ -599,8 +599,12 @@ public void initSRCEndpoints() {
     String repoServiceUrl = synapseProperties.getSynapseProperty(
       REPO_SERVICE_URL_KEY
     );
-    String repoUrl =
-      repoServiceUrl.substring(0, repoServiceUrl.indexOf("/repo/")) + "/";
+    // SRC's path constants already begin with a slash (e.g. "/repo/v1"), so the
+    // endpoint must not end with one.
+    String repoUrl = repoServiceUrl.substring(
+      0,
+      repoServiceUrl.indexOf("/repo/")
+    );
     String portalUrl = gwt.getHostPrefix();
     if (!portalUrl.endsWith("/")) {
       portalUrl += "/";
diff --git a/src/test/java/org/sagebionetworks/web/unitclient/GlobalApplicationStateImplTest.java b/src/test/java/org/sagebionetworks/web/unitclient/GlobalApplicationStateImplTest.java
index 8408a4d6e5..56e26a1236 100644
--- a/src/test/java/org/sagebionetworks/web/unitclient/GlobalApplicationStateImplTest.java
+++ b/src/test/java/org/sagebionetworks/web/unitclient/GlobalApplicationStateImplTest.java
@@ -123,7 +123,7 @@ public class GlobalApplicationStateImplTest {
   Runnable mockRunnable;
 
   public static final String REPO_ENDPOINT =
-    "https://repo-staging.prod.sagebase.org/";
+    "https://repo-staging.prod.sagebase.org";
   public static final String SWC_ENDPOINT = "https://staging.synapse.org/";
 
   @Before
@@ -154,7 +154,7 @@ public void before() {
     globalApplicationState.setPlaceController(mockPlaceController);
     globalApplicationState.setAppPlaceHistoryMapper(mockAppPlaceHistoryMapper);
     when(mockSynapseProperties.getSynapseProperty(REPO_SERVICE_URL_KEY))
-      .thenReturn(REPO_ENDPOINT + "repo/v1");
+      .thenReturn(REPO_ENDPOINT + "/repo/v1");
     when(mockGWT.getHostPrefix()).thenReturn(SWC_ENDPOINT);
   }