@djangocfg/nextjs 2.1.448 → 2.1.450

package/dist/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.448",
+      version: "2.1.450",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -1669,17 +1669,22 @@ function createBaseNextConfig(options = {}) {
       ];
       const hasIframeAllowlist = !!options.allowIframeFrom && options.allowIframeFrom.length > 0;
       const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
-      const connectSrc = isDev ? "connect-src 'self' http: https: ws: wss:" : "connect-src 'self' https: wss:";
+      const stripeScript = options.stripe ? " https://js.stripe.com" : "";
+      const stripeConnect = options.stripe ? " https://api.stripe.com" : "";
+      const stripeFrame = options.stripe ? " https://js.stripe.com https://checkout.stripe.com" : "";
+      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}` : `connect-src 'self' https: wss:${stripeConnect}`;
       const imgSrc = isDev ? "img-src 'self' data: blob: http: https:" : "img-src 'self' data: blob: https:";
       const cspDirectives = [
         "default-src 'self'",
         // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
         "style-src 'self' 'unsafe-inline'",
         imgSrc,
         "font-src 'self' data:",
         // API/websocket calls go cross-origin to Django/Centrifugo.
         connectSrc,
+        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
+        `frame-src 'self'${stripeFrame}`,
         "object-src 'none'",
         "base-uri 'self'",
         "form-action 'self'",
@@ -1798,6 +1803,7 @@ function createBaseNextConfig(options = {}) {
     autoInstall,
     allowIframeFrom,
     dpop,
+    stripe,
     ...nextConfigOptions
   } = options;
   let finalConfig = deepMerge(baseConfig, nextConfigOptions);