@djangocfg/nextjs 2.1.447 → 2.1.449

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.447",
+  "version": "2.1.449",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -143,9 +143,9 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/i18n": "^2.1.447",
-    "@djangocfg/monitor": "^2.1.447",
-    "@djangocfg/ui-core": "^2.1.447",
+    "@djangocfg/i18n": "^2.1.449",
+    "@djangocfg/monitor": "^2.1.449",
+    "@djangocfg/ui-core": "^2.1.449",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -167,11 +167,11 @@
     "serwist": "^9.2.3"
   },
   "devDependencies": {
-    "@djangocfg/i18n": "^2.1.447",
-    "@djangocfg/monitor": "^2.1.447",
-    "@djangocfg/ui-core": "^2.1.447",
-    "@djangocfg/layouts": "^2.1.447",
-    "@djangocfg/typescript-config": "^2.1.447",
+    "@djangocfg/i18n": "^2.1.449",
+    "@djangocfg/monitor": "^2.1.449",
+    "@djangocfg/ui-core": "^2.1.449",
+    "@djangocfg/layouts": "^2.1.449",
+    "@djangocfg/typescript-config": "^2.1.449",
     "@types/node": "^25.2.3",
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",

package/src/config/createNextConfig.ts

@@ -67,6 +67,17 @@ export interface BaseNextConfigOptions {
    * Inlines `NEXT_PUBLIC_DPOP_ENABLED='true'` so the generated auth.ts activates.
    */
   dpop?: boolean;
+  /**
+   * Loosen the baseline CSP just enough for Stripe.js / Stripe Checkout &
+   * Elements to work. When true, the required Stripe origins are added to
+   * `script-src` (js.stripe.com — loads the SDK), `frame-src`
+   * (js.stripe.com + checkout.stripe.com — Elements/Checkout mount iframes)
+   * and `connect-src` (api.stripe.com — tokenization/confirm XHR). Without
+   * this, the browser blocks Stripe.js and the payment form never renders.
+   * Enable ONLY on apps that actually mount Stripe (e.g. the billing
+   * dashboard), so every other app keeps the tighter default. Default: false.
+   */
+  stripe?: boolean;
   /**
    * PWA configuration options
    * Set to false to disable PWA, or provide custom options
@@ -201,9 +212,18 @@ export function createBaseNextConfig(
       // In dev the backend (Django, Centrifugo) is plain http/ws on localhost,
       // so connect/img must allow http:/ws:. Production stays strict (https/wss
       // only) to forbid downgrade/cleartext exfiltration.
+      // Stripe.js needs its SDK host in script-src, its iframe hosts in
+      // frame-src, and its API host in connect-src. Opt-in per app via
+      // `options.stripe` so non-payment apps keep the tighter baseline.
+      const stripeScript = options.stripe ? ' https://js.stripe.com' : '';
+      const stripeConnect = options.stripe ? ' https://api.stripe.com' : '';
+      const stripeFrame = options.stripe
+        ? ' https://js.stripe.com https://checkout.stripe.com'
+        : '';
+
       const connectSrc = isDev
-        ? "connect-src 'self' http: https: ws: wss:"
-        : "connect-src 'self' https: wss:";
+        ? `connect-src 'self' http: https: ws: wss:${stripeConnect}`
+        : `connect-src 'self' https: wss:${stripeConnect}`;
       const imgSrc = isDev
         ? "img-src 'self' data: blob: http: https:"
         : "img-src 'self' data: blob: https:";
@@ -211,12 +231,14 @@ export function createBaseNextConfig(
       const cspDirectives = [
         "default-src 'self'",
         // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
         "style-src 'self' 'unsafe-inline'",
         imgSrc,
         "font-src 'self' data:",
         // API/websocket calls go cross-origin to Django/Centrifugo.
         connectSrc,
+        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
+        `frame-src 'self'${stripeFrame}`,
         "object-src 'none'",
         "base-uri 'self'",
         "form-action 'self'",
@@ -360,6 +382,7 @@ export function createBaseNextConfig(
     autoInstall,
     allowIframeFrom,
     dpop,
+    stripe,
     ...nextConfigOptions
   } = options;