@djangocfg/nextjs 2.1.470 → 2.1.472

package/dist/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.470",
+      version: "2.1.472",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -154,6 +154,7 @@ var require_package = __commonJS({
         clean: "rm -rf dist",
         lint: "eslint .",
         check: "tsc --noEmit",
+        test: "tsx --test src/**/*.test.ts",
         "ai-docs": "tsx src/ai/cli.ts"
       },
       peerDependencies: {
@@ -1669,38 +1670,57 @@ function createBaseNextConfig(options = {}) {
       ];
       const hasIframeAllowlist = !!options.allowIframeFrom && options.allowIframeFrom.length > 0;
       const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
+      const cspDisabled = options.csp === false;
+      const cspExtra = typeof options.csp === "object" ? options.csp : void 0;
       const stripeScript = options.stripe ? " https://js.stripe.com" : "";
       const stripeConnect = options.stripe ? " https://api.stripe.com" : "";
       const stripeFrame = options.stripe ? " https://js.stripe.com https://checkout.stripe.com" : "";
-      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}` : `connect-src 'self' https: wss:${stripeConnect}`;
-      const imgSrc = isDev ? "img-src 'self' data: blob: http: https:" : "img-src 'self' data: blob: https:";
-      const cspDirectives = [
-        "default-src 'self'",
-        // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
-        "style-src 'self' 'unsafe-inline'",
-        imgSrc,
-        "font-src 'self' data:",
-        // API/websocket calls go cross-origin to Django/Centrifugo.
-        connectSrc,
-        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
-        `frame-src 'self'${stripeFrame}`,
-        "object-src 'none'",
-        "base-uri 'self'",
-        "form-action 'self'",
-        `frame-ancestors ${frameAncestors}`
-      ];
-      headers.push({
-        source: "/:path*",
-        headers: [
-          { key: "X-Content-Type-Options", value: "nosniff" },
-          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
-          { key: "Content-Security-Policy", value: cspDirectives.join("; ") },
-          // X-Frame-Options for older browsers. Omitted when a wildcard iframe
-          // allowlist is set (browsers then rely on CSP frame-ancestors).
-          ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
-        ]
-      });
+      const extraScript = cspExtra?.scriptSrc?.length ? " " + cspExtra.scriptSrc.join(" ") : "";
+      const extraConnect = cspExtra?.connectSrc?.length ? " " + cspExtra.connectSrc.join(" ") : "";
+      const extraFrame = cspExtra?.frameSrc?.length ? " " + cspExtra.frameSrc.join(" ") : "";
+      const extraImg = cspExtra?.imgSrc?.length ? " " + cspExtra.imgSrc.join(" ") : "";
+      const extraFont = cspExtra?.fontSrc?.length ? " " + cspExtra.fontSrc.join(" ") : "";
+      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}${extraConnect}` : `connect-src 'self' https: wss:${stripeConnect}${extraConnect}`;
+      const imgSrc = isDev ? `img-src 'self' data: blob: http: https:${extraImg}` : `img-src 'self' data: blob: https:${extraImg}`;
+      if (!cspDisabled) {
+        const cspDirectives = [
+          "default-src 'self'",
+          // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
+          `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}${extraScript}`,
+          "style-src 'self' 'unsafe-inline'",
+          imgSrc,
+          `font-src 'self' data:${extraFont}`,
+          // API/websocket calls go cross-origin to Django/Centrifugo.
+          connectSrc,
+          // Stripe Elements/Checkout and any app-declared trusted origins
+          // (options.csp.frameSrc) mount iframes; add their hosts when enabled.
+          `frame-src 'self'${stripeFrame}${extraFrame}`,
+          "object-src 'none'",
+          "base-uri 'self'",
+          "form-action 'self'",
+          `frame-ancestors ${frameAncestors}`
+        ];
+        headers.push({
+          source: "/:path*",
+          headers: [
+            { key: "X-Content-Type-Options", value: "nosniff" },
+            { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+            { key: "Content-Security-Policy", value: cspDirectives.join("; ") },
+            // X-Frame-Options for older browsers. Omitted when a wildcard iframe
+            // allowlist is set (browsers then rely on CSP frame-ancestors).
+            ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
+          ]
+        });
+      } else {
+        headers.push({
+          source: "/:path*",
+          headers: [
+            { key: "X-Content-Type-Options", value: "nosniff" },
+            { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+            ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
+          ]
+        });
+      }
       const userHeaders = options.headers ? await options.headers() : [];
       return [...headers, ...userHeaders];
     },