@djangocfg/nextjs 2.1.471 → 2.1.474

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.471",
+  "version": "2.1.474",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -144,9 +144,9 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/devtools": "^2.1.471",
-    "@djangocfg/i18n": "^2.1.471",
-    "@djangocfg/ui-core": "^2.1.471",
+    "@djangocfg/devtools": "^2.1.474",
+    "@djangocfg/i18n": "^2.1.474",
+    "@djangocfg/ui-core": "^2.1.474",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -168,11 +168,11 @@
     "serwist": "^9.5.11"
   },
   "devDependencies": {
-    "@djangocfg/devtools": "^2.1.471",
-    "@djangocfg/i18n": "^2.1.471",
-    "@djangocfg/layouts": "^2.1.471",
-    "@djangocfg/typescript-config": "^2.1.471",
-    "@djangocfg/ui-core": "^2.1.471",
+    "@djangocfg/devtools": "^2.1.474",
+    "@djangocfg/i18n": "^2.1.474",
+    "@djangocfg/layouts": "^2.1.474",
+    "@djangocfg/typescript-config": "^2.1.474",
+    "@djangocfg/ui-core": "^2.1.474",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",

package/src/config/createNextConfig.ts

@@ -78,6 +78,44 @@ export interface BaseNextConfigOptions {
    * dashboard), so every other app keeps the tighter default. Default: false.
    */
   stripe?: boolean;
+  /**
+   * Content-Security-Policy control.
+   *
+   * - `false` — do not emit the `Content-Security-Policy` header at all.
+   *   Use this on apps with no user auth/payment surface and unpredictable
+   *   third-party embeds (a pitch deck, a marketing microsite) where
+   *   naming every future embed's origin is not worth the maintenance —
+   *   `X-Content-Type-Options`/`Referrer-Policy`/`X-Frame-Options` below
+   *   still apply.
+   * - object — keep the baseline CSP but additively loosen specific
+   *   directives for named trusted origins (the pattern `stripe` above is
+   *   a hardcoded special case of). Every array is additive; omit a key to
+   *   leave that directive untouched.
+   * - omitted — tightest default (`frame-src 'self'`, etc.), same as today.
+   *
+   * @example
+   * ```ts
+   * // No CSP at all — simplest option for a low-risk app with ad hoc embeds
+   * createBaseNextConfig({ csp: false })
+   *
+   * // Keep CSP, just allow one trusted iframe origin
+   * createBaseNextConfig({ csp: { frameSrc: ['https://www.youtube-nocookie.com'] } })
+   * ```
+   */
+  csp?:
+    | false
+    | {
+        /** Extra `frame-src` origins (iframes this app embeds). */
+        frameSrc?: string[];
+        /** Extra `script-src` origins (third-party SDK scripts). */
+        scriptSrc?: string[];
+        /** Extra `connect-src` origins (XHR/fetch/WebSocket to a third party). */
+        connectSrc?: string[];
+        /** Extra `img-src` origins (hotlinked third-party images). */
+        imgSrc?: string[];
+        /** Extra `font-src` origins (third-party web fonts). */
+        fontSrc?: string[];
+      };
   /**
    * PWA configuration options
    * Set to false to disable PWA, or provide custom options
@@ -209,65 +247,115 @@ export function createBaseNextConfig(
             : `'self' ${options.allowIframeFrom!.join(' ')}`)
         : "'none'";
 
+      // `csp: false` opts an app out of the CSP header entirely (see the
+      // option's doc comment) — the other baseline headers still apply.
+      const cspDisabled = options.csp === false;
+      const cspExtra = typeof options.csp === 'object' ? options.csp : undefined;
+
       // In dev the backend (Django, Centrifugo) is plain http/ws on localhost,
       // so connect/img must allow http:/ws:. Production stays strict (https/wss
       // only) to forbid downgrade/cleartext exfiltration.
       // Stripe.js needs its SDK host in script-src, its iframe hosts in
       // frame-src, and its API host in connect-src. Opt-in per app via
-      // `options.stripe` so non-payment apps keep the tighter baseline.
+      // `options.stripe` — one hardcoded special case of the general
+      // `options.csp` additive-origin escape hatch below.
       const stripeScript = options.stripe ? ' https://js.stripe.com' : '';
       const stripeConnect = options.stripe ? ' https://api.stripe.com' : '';
       const stripeFrame = options.stripe
         ? ' https://js.stripe.com https://checkout.stripe.com'
         : '';
 
+      const extraScript = cspExtra?.scriptSrc?.length ? ' ' + cspExtra.scriptSrc.join(' ') : '';
+      const extraConnect = cspExtra?.connectSrc?.length ? ' ' + cspExtra.connectSrc.join(' ') : '';
+      const extraFrame = cspExtra?.frameSrc?.length ? ' ' + cspExtra.frameSrc.join(' ') : '';
+      const extraImg = cspExtra?.imgSrc?.length ? ' ' + cspExtra.imgSrc.join(' ') : '';
+      const extraFont = cspExtra?.fontSrc?.length ? ' ' + cspExtra.fontSrc.join(' ') : '';
+
       const connectSrc = isDev
-        ? `connect-src 'self' http: https: ws: wss:${stripeConnect}`
-        : `connect-src 'self' https: wss:${stripeConnect}`;
+        ? `connect-src 'self' http: https: ws: wss:${stripeConnect}${extraConnect}`
+        : `connect-src 'self' https: wss:${stripeConnect}${extraConnect}`;
       const imgSrc = isDev
-        ? "img-src 'self' data: blob: http: https:"
-        : "img-src 'self' data: blob: https:";
-
-      const cspDirectives = [
-        "default-src 'self'",
-        // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
-        "style-src 'self' 'unsafe-inline'",
-        imgSrc,
-        "font-src 'self' data:",
-        // API/websocket calls go cross-origin to Django/Centrifugo.
-        connectSrc,
-        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
-        `frame-src 'self'${stripeFrame}`,
-        "object-src 'none'",
-        "base-uri 'self'",
-        "form-action 'self'",
-        `frame-ancestors ${frameAncestors}`,
-      ];
-
-      headers.push({
-        source: '/:path*',
-        headers: [
-          { key: 'X-Content-Type-Options', value: 'nosniff' },
-          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-          { key: 'Content-Security-Policy', value: cspDirectives.join('; ') },
-          // X-Frame-Options for older browsers. Omitted when a wildcard iframe
-          // allowlist is set (browsers then rely on CSP frame-ancestors).
-          ...(hasIframeAllowlist && options.allowIframeFrom!.includes('*')
-            ? []
-            : [{ key: 'X-Frame-Options', value: hasIframeAllowlist ? 'SAMEORIGIN' : 'DENY' }]),
-        ],
-      });
+        ? `img-src 'self' data: blob: http: https:${extraImg}`
+        : `img-src 'self' data: blob: https:${extraImg}`;
+
+      if (!cspDisabled) {
+        const cspDirectives = [
+          "default-src 'self'",
+          // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
+          `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}${extraScript}`,
+          "style-src 'self' 'unsafe-inline'",
+          imgSrc,
+          `font-src 'self' data:${extraFont}`,
+          // API/websocket calls go cross-origin to Django/Centrifugo.
+          connectSrc,
+          // Stripe Elements/Checkout and any app-declared trusted origins
+          // (options.csp.frameSrc) mount iframes; add their hosts when enabled.
+          `frame-src 'self'${stripeFrame}${extraFrame}`,
+          "object-src 'none'",
+          "base-uri 'self'",
+          "form-action 'self'",
+          `frame-ancestors ${frameAncestors}`,
+        ];
+
+        headers.push({
+          source: '/:path*',
+          headers: [
+            { key: 'X-Content-Type-Options', value: 'nosniff' },
+            { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+            { key: 'Content-Security-Policy', value: cspDirectives.join('; ') },
+            // X-Frame-Options for older browsers. Omitted when a wildcard iframe
+            // allowlist is set (browsers then rely on CSP frame-ancestors).
+            ...(hasIframeAllowlist && options.allowIframeFrom!.includes('*')
+              ? []
+              : [{ key: 'X-Frame-Options', value: hasIframeAllowlist ? 'SAMEORIGIN' : 'DENY' }]),
+          ],
+        });
+      } else {
+        // Still ship the non-CSP baseline headers even with CSP disabled.
+        headers.push({
+          source: '/:path*',
+          headers: [
+            { key: 'X-Content-Type-Options', value: 'nosniff' },
+            { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+            ...(hasIframeAllowlist && options.allowIframeFrom!.includes('*')
+              ? []
+              : [{ key: 'X-Frame-Options', value: hasIframeAllowlist ? 'SAMEORIGIN' : 'DENY' }]),
+          ],
+        });
+      }
 
       // Merge with user-provided headers
       const userHeaders = options.headers ? await options.headers() : [];
       return [...headers, ...userHeaders];
     },
 
-    // Rewrites (user-provided only)
-    ...(options.rewrites && {
-      rewrites: options.rewrites,
-    }),
+    // Rewrites — first-party analytics ingest proxy, then user rewrites.
+    //
+    // @djangocfg/analytics POSTs to a RELATIVE /cfg/analytics/collect/ so the beacon
+    // stays same-origin (sendBeacon is unreliable cross-origin). On a split-domain
+    // deploy (Next on one host, Django on `apiUrl`) that same-origin path has no
+    // route here, so every beacon 404s and nothing is ingested — unless we proxy it.
+    // Same-domain and static builds keep apiUrl empty and need no proxy.
+    ...(((apiUrl && !isStaticBuild) || options.rewrites)
+      ? {
+          async rewrites() {
+            const analyticsProxy =
+              apiUrl && !isStaticBuild
+                ? [{ source: '/cfg/analytics/:path*', destination: `${apiUrl}/cfg/analytics/:path*` }]
+                : [];
+            const user = options.rewrites ? await options.rewrites() : [];
+            // Ingest must resolve before any page/filesystem route can shadow it.
+            if (Array.isArray(user)) {
+              return { beforeFiles: analyticsProxy, afterFiles: user, fallback: [] };
+            }
+            return {
+              beforeFiles: [...analyticsProxy, ...(user?.beforeFiles ?? [])],
+              afterFiles: user?.afterFiles ?? [],
+              fallback: user?.fallback ?? [],
+            };
+          },
+        }
+      : {}),
 
     // Redirects for URL normalization
     // Fixes "Failed to construct 'URL': Invalid URL" error with double slashes
@@ -388,6 +476,7 @@ export function createBaseNextConfig(
     allowIframeFrom,
     dpop,
     stripe,
+    csp,
     ...nextConfigOptions
   } = options;