4bnode 4.1.3 → 4.1.4

package/lib/codegen.js

@@ -419,7 +419,28 @@ export function securityWiring(features) {
 
   if (has("helmet")) {
     imports.push("import helmet from 'helmet';");
-    beforeRoutesParts.push("// ── Security headers ──\napp.use(helmet());");
+    beforeRoutesParts.push(
+      `// ── Security headers ──
+// helmet() defaults to a strict Content-Security-Policy (script-src 'self',
+// etc.) that blocks CDN-loaded scripts, inline <script> blocks, and cross-origin
+// assets. We widen the policy so a typical frontend/docs page works while keeping
+// the rest of helmet's protections. Tighten these directives for production.
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false,
+  // Allow other origins (e.g. a separate frontend host) to load assets served
+  // by this app. Default is 'same-origin'. Tighten to 'same-site' for production.
+  crossOriginResourcePolicy: { policy: 'cross-origin' },
+}));`
+    );
   }
   if (has("rateLimit")) {
     imports.push("import rateLimit from 'express-rate-limit';");

package/lib/codegen.test.js

@@ -140,7 +140,8 @@ test("securityWiring composes imports + insertion blocks", () => {
   assert.ok(w.imports.includes("import helmet from 'helmet';"));
   assert.ok(w.imports.includes("import rateLimit from 'express-rate-limit';"));
   assert.ok(w.imports.some((i) => i.includes("errorHandler.js")));
-  assert.ok(w.beforeRoutes.includes("app.use(helmet())"));
+  assert.ok(w.beforeRoutes.includes("app.use(helmet("));
+  assert.ok(w.beforeRoutes.includes("contentSecurityPolicy:"));
   assert.ok(w.beforeRoutes.includes("rateLimit({"));
   assert.ok(w.beforeListen.includes("app.use(notFound)"));
   assert.ok(w.beforeListen.includes("app.use(errorHandler)"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/.4bnode/codegen.js

@@ -419,7 +419,28 @@ export function securityWiring(features) {
 
   if (has("helmet")) {
     imports.push("import helmet from 'helmet';");
-    beforeRoutesParts.push("// ── Security headers ──\napp.use(helmet());");
+    beforeRoutesParts.push(
+      `// ── Security headers ──
+// helmet() defaults to a strict Content-Security-Policy (script-src 'self',
+// etc.) that blocks CDN-loaded scripts, inline <script> blocks, and cross-origin
+// assets. We widen the policy so a typical frontend/docs page works while keeping
+// the rest of helmet's protections. Tighten these directives for production.
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false,
+  // Allow other origins (e.g. a separate frontend host) to load assets served
+  // by this app. Default is 'same-origin'. Tighten to 'same-site' for production.
+  crossOriginResourcePolicy: { policy: 'cross-origin' },
+}));`
+    );
   }
   if (has("rateLimit")) {
     imports.push("import rateLimit from 'express-rate-limit';");