@djangocfg/nextjs 2.1.471 → 2.1.474

package/dist/config/index.d.mts

@@ -70,6 +70,42 @@ interface BaseNextConfigOptions {
      * dashboard), so every other app keeps the tighter default. Default: false.
      */
     stripe?: boolean;
+    /**
+     * Content-Security-Policy control.
+     *
+     * - `false` — do not emit the `Content-Security-Policy` header at all.
+     *   Use this on apps with no user auth/payment surface and unpredictable
+     *   third-party embeds (a pitch deck, a marketing microsite) where
+     *   naming every future embed's origin is not worth the maintenance —
+     *   `X-Content-Type-Options`/`Referrer-Policy`/`X-Frame-Options` below
+     *   still apply.
+     * - object — keep the baseline CSP but additively loosen specific
+     *   directives for named trusted origins (the pattern `stripe` above is
+     *   a hardcoded special case of). Every array is additive; omit a key to
+     *   leave that directive untouched.
+     * - omitted — tightest default (`frame-src 'self'`, etc.), same as today.
+     *
+     * @example
+     * ```ts
+     * // No CSP at all — simplest option for a low-risk app with ad hoc embeds
+     * createBaseNextConfig({ csp: false })
+     *
+     * // Keep CSP, just allow one trusted iframe origin
+     * createBaseNextConfig({ csp: { frameSrc: ['https://www.youtube-nocookie.com'] } })
+     * ```
+     */
+    csp?: false | {
+        /** Extra `frame-src` origins (iframes this app embeds). */
+        frameSrc?: string[];
+        /** Extra `script-src` origins (third-party SDK scripts). */
+        scriptSrc?: string[];
+        /** Extra `connect-src` origins (XHR/fetch/WebSocket to a third party). */
+        connectSrc?: string[];
+        /** Extra `img-src` origins (hotlinked third-party images). */
+        imgSrc?: string[];
+        /** Extra `font-src` origins (third-party web fonts). */
+        fontSrc?: string[];
+    };
     /**
      * PWA configuration options
      * Set to false to disable PWA, or provide custom options

package/dist/config/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.471",
+      version: "2.1.474",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -1396,45 +1396,81 @@ function createBaseNextConfig(options = {}) {
       ];
       const hasIframeAllowlist = !!options.allowIframeFrom && options.allowIframeFrom.length > 0;
       const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
+      const cspDisabled = options.csp === false;
+      const cspExtra = typeof options.csp === "object" ? options.csp : void 0;
       const stripeScript = options.stripe ? " https://js.stripe.com" : "";
       const stripeConnect = options.stripe ? " https://api.stripe.com" : "";
       const stripeFrame = options.stripe ? " https://js.stripe.com https://checkout.stripe.com" : "";
-      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}` : `connect-src 'self' https: wss:${stripeConnect}`;
-      const imgSrc = isDev ? "img-src 'self' data: blob: http: https:" : "img-src 'self' data: blob: https:";
-      const cspDirectives = [
-        "default-src 'self'",
-        // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
-        "style-src 'self' 'unsafe-inline'",
-        imgSrc,
-        "font-src 'self' data:",
-        // API/websocket calls go cross-origin to Django/Centrifugo.
-        connectSrc,
-        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
-        `frame-src 'self'${stripeFrame}`,
-        "object-src 'none'",
-        "base-uri 'self'",
-        "form-action 'self'",
-        `frame-ancestors ${frameAncestors}`
-      ];
-      headers.push({
-        source: "/:path*",
-        headers: [
-          { key: "X-Content-Type-Options", value: "nosniff" },
-          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
-          { key: "Content-Security-Policy", value: cspDirectives.join("; ") },
-          // X-Frame-Options for older browsers. Omitted when a wildcard iframe
-          // allowlist is set (browsers then rely on CSP frame-ancestors).
-          ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
-        ]
-      });
+      const extraScript = cspExtra?.scriptSrc?.length ? " " + cspExtra.scriptSrc.join(" ") : "";
+      const extraConnect = cspExtra?.connectSrc?.length ? " " + cspExtra.connectSrc.join(" ") : "";
+      const extraFrame = cspExtra?.frameSrc?.length ? " " + cspExtra.frameSrc.join(" ") : "";
+      const extraImg = cspExtra?.imgSrc?.length ? " " + cspExtra.imgSrc.join(" ") : "";
+      const extraFont = cspExtra?.fontSrc?.length ? " " + cspExtra.fontSrc.join(" ") : "";
+      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}${extraConnect}` : `connect-src 'self' https: wss:${stripeConnect}${extraConnect}`;
+      const imgSrc = isDev ? `img-src 'self' data: blob: http: https:${extraImg}` : `img-src 'self' data: blob: https:${extraImg}`;
+      if (!cspDisabled) {
+        const cspDirectives = [
+          "default-src 'self'",
+          // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
+          `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}${extraScript}`,
+          "style-src 'self' 'unsafe-inline'",
+          imgSrc,
+          `font-src 'self' data:${extraFont}`,
+          // API/websocket calls go cross-origin to Django/Centrifugo.
+          connectSrc,
+          // Stripe Elements/Checkout and any app-declared trusted origins
+          // (options.csp.frameSrc) mount iframes; add their hosts when enabled.
+          `frame-src 'self'${stripeFrame}${extraFrame}`,
+          "object-src 'none'",
+          "base-uri 'self'",
+          "form-action 'self'",
+          `frame-ancestors ${frameAncestors}`
+        ];
+        headers.push({
+          source: "/:path*",
+          headers: [
+            { key: "X-Content-Type-Options", value: "nosniff" },
+            { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+            { key: "Content-Security-Policy", value: cspDirectives.join("; ") },
+            // X-Frame-Options for older browsers. Omitted when a wildcard iframe
+            // allowlist is set (browsers then rely on CSP frame-ancestors).
+            ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
+          ]
+        });
+      } else {
+        headers.push({
+          source: "/:path*",
+          headers: [
+            { key: "X-Content-Type-Options", value: "nosniff" },
+            { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+            ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
+          ]
+        });
+      }
       const userHeaders = options.headers ? await options.headers() : [];
       return [...headers, ...userHeaders];
     },
-    // Rewrites (user-provided only)
-    ...options.rewrites && {
-      rewrites: options.rewrites
-    },
+    // Rewrites — first-party analytics ingest proxy, then user rewrites.
+    //
+    // @djangocfg/analytics POSTs to a RELATIVE /cfg/analytics/collect/ so the beacon
+    // stays same-origin (sendBeacon is unreliable cross-origin). On a split-domain
+    // deploy (Next on one host, Django on `apiUrl`) that same-origin path has no
+    // route here, so every beacon 404s and nothing is ingested — unless we proxy it.
+    // Same-domain and static builds keep apiUrl empty and need no proxy.
+    ...apiUrl && !isStaticBuild || options.rewrites ? {
+      async rewrites() {
+        const analyticsProxy = apiUrl && !isStaticBuild ? [{ source: "/cfg/analytics/:path*", destination: `${apiUrl}/cfg/analytics/:path*` }] : [];
+        const user = options.rewrites ? await options.rewrites() : [];
+        if (Array.isArray(user)) {
+          return { beforeFiles: analyticsProxy, afterFiles: user, fallback: [] };
+        }
+        return {
+          beforeFiles: [...analyticsProxy, ...user?.beforeFiles ?? []],
+          afterFiles: user?.afterFiles ?? [],
+          fallback: user?.fallback ?? []
+        };
+      }
+    } : {},
     // Redirects for URL normalization
     // Fixes "Failed to construct 'URL': Invalid URL" error with double slashes
     async redirects() {
@@ -1532,6 +1568,7 @@ function createBaseNextConfig(options = {}) {
     allowIframeFrom,
     dpop,
     stripe,
+    csp,
     ...nextConfigOptions
   } = options;
   let finalConfig = deepMerge(baseConfig, nextConfigOptions);