Extract content-security-policy generation logic, add support for Mak…

…eswift builder (#1159)

core/lib/content-security-policy.js

@@ -0,0 +1,36 @@
+// @ts-check
+const makeswiftEnabled = !!process.env.MAKESWIFT_SITE_API_KEY;
+
+const makeswiftBaseUrl = process.env.MAKESWIFT_BASE_URL || 'https://app.makeswift.com';
+
+const frameAncestors = makeswiftEnabled ? makeswiftBaseUrl : 'none';
+
+const builder = require('content-security-policy-builder');
+
+// customize the directives as needed
+const cspHeader = builder({
+  directives: {
+    baseUri: ['self'],
+    formAction: ['self'],
+    frameAncestors: [frameAncestors],
+    // defaultSrc: ['self'],
+    // scriptSrc: ['self'],
+    // styleSrc: ['self'],
+    // imgSrc: ['self'],
+    // connectSrc: ['self'],
+    // fontSrc: ['self'],
+    // objectSrc: ['none'],
+    // mediaSrc: ['self'],
+    // frameSrc: ['self'],
+    // childSrc: ['self'],
+    // manifestSrc: ['self'],
+    // workerSrc: ['self'],
+    // prefetchSrc: ['self'],
+    // navigateTo: ['self'],
+    // reportUri: ['none'],
+  },
+});
+
+module.exports = {
+  cspHeader,
+};

core/next.config.js

@@ -3,11 +3,7 @@ const createNextIntlPlugin = require('next-intl/plugin');
 
 const withNextIntl = createNextIntlPlugin();
 
-const cspHeader = `
-  base-uri 'self';
-  form-action 'self';
-  frame-ancestors 'none';
-`;
+const { cspHeader } = require('./lib/content-security-policy');
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {

core/package.json

@@ -32,6 +32,7 @@
     "@vercel/speed-insights": "^1.0.12",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.1",
+    "content-security-policy-builder": "^2.2.0",
     "embla-carousel-react": "8.1.6",
     "focus-trap-react": "^10.2.3",
     "gql.tada": "^1.8.2",