docs: add Tluma Ask AI widget to Docusaurus site

[thomhurst]

Summary

• Add Tluma Ask AI widget to the Docusaurus docs site
• Inject window.tlumaConfig via headTags with the provided source/theme/brand settings
• Load https://tluma.ai/widget.js asynchronously via the scripts option
• No existing Docusaurus configuration was removed; TypeScript Config types remain valid

Test plan

• cd docs && npm run build succeeds with no TypeScript errors
• cd docs && npm start serves the site locally with the Tluma launcher button visible in the bottom-right corner
• Clicking the launcher opens the Ask AI widget and it responds to queries against thomhurst/tunit

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[claude]

Code Review

The integration is clean and straightforward — using Docusaurus's built-in headTags and scripts options is the right approach here, and async: true correctly avoids blocking page load.

Security Concern: Missing Subresource Integrity (SRI)

The main issue is loading an external script without an SRI hash:

scripts: [
  {
    src: 'https://tluma.ai/widget.js',
    async: true,
    // Missing: integrity + crossOrigin
  },
],

Without an integrity attribute, if Tluma's CDN is ever compromised, malicious JavaScript would silently execute on the TUnit docs site with no browser-level protection. The fix:

scripts: [
  {
    src: 'https://tluma.ai/widget.js',
    async: true,
    integrity: 'sha384-<hash>',  // compute with: openssl dgst -sha384 -binary widget.js | openssl base64 -A
    crossOrigin: 'anonymous',
  },
],

Why this matters: Third-party supply-chain attacks on CDN-hosted scripts are a real and documented attack vector. For a project documentation site this risk is lower than for an e-commerce checkout, but the cost of adding an SRI hash is zero once computed.

Practical caveat: If Tluma ships updates to widget.js frequently without versioned URLs, SRI becomes maintenance overhead (every update breaks the hash). In that case, consider whether Tluma offers a versioned URL like widget@1.2.3.js, or whether the tradeoff is acceptable given the docs-site context.

Minor: Redundant attributes: {}

headTags: [
  {
    tagName: 'script',
    attributes: {},   // empty — can be omitted entirely
    innerHTML: `window.tlumaConfig = { ... }`,
  },
],

Docusaurus's HeadTag type makes attributes optional; the empty object is harmless but unnecessary noise.

Overall

The approach is idiomatic for Docusaurus and the configuration options look sensible (autoOpen: false, async: true). The SRI concern is worth addressing — whether by adding a hash or by explicitly acknowledging the trust decision — before merging.

[claude]

Code Review

The integration is clean and straightforward — using Docusaurus's built-in headTags and scripts options is the right approach here, and async: true correctly avoids blocking page load.

Security Concern: Missing Subresource Integrity (SRI)

The main issue is loading an external script without an SRI hash:

scripts: [
  {
    src: 'https://tluma.ai/widget.js',
    async: true,
    // Missing: integrity + crossOrigin
  },
],

Without an integrity attribute, if Tluma's CDN is ever compromised, malicious JavaScript would silently execute on the TUnit docs site with no browser-level protection. The fix:

scripts: [
  {
    src: 'https://tluma.ai/widget.js',
    async: true,
    integrity: 'sha384-<hash>',  // compute with: openssl dgst -sha384 -binary widget.js | openssl base64 -A
    crossOrigin: 'anonymous',
  },
],

Why this matters: Third-party supply-chain attacks on CDN-hosted scripts are a real and documented attack vector. For a project documentation site the risk is lower than for an e-commerce checkout, but the cost of adding an SRI hash is zero once computed.

Practical caveat: If Tluma ships updates to widget.js frequently without versioned URLs, SRI becomes maintenance overhead (every update breaks the hash). In that case, consider whether Tluma offers a versioned URL like widget@1.2.3.js, or whether the tradeoff is acceptable given the docs-site context.

Minor: Redundant attributes: {}

The attributes: {} in the headTags inline script entry is an empty object — Docusaurus makes it optional, so it can simply be omitted.

Overall

The approach is idiomatic for Docusaurus and the configuration options look sensible (autoOpen: false, async: true). The SRI concern is worth addressing — whether by adding a hash or by explicitly acknowledging the trust decision — before merging.