@wopr-network/platform-ui-core 1.1.9 → 1.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/proxy.ts +9 -4
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@wopr-network/platform-ui-core",
3
- "version": "1.1.9",
3
+ "version": "1.1.10",
4
4
  "description": "Brand-agnostic AI agent platform UI — deploy as any brand via env vars",
5
5
  "repository": {
6
6
  "type": "git",
package/src/proxy.ts CHANGED
@@ -9,7 +9,11 @@ const apiOrigin = process.env.NEXT_PUBLIC_API_URL
9
9
  ? new URL(process.env.NEXT_PUBLIC_API_URL).origin
10
10
  : "";
11
11
 
12
- const isSecureOrigin = process.env.NODE_ENV === "production";
12
+ /**
13
+ * Only add upgrade-insecure-requests when actually serving over HTTPS.
14
+ * Checking NODE_ENV breaks local dev in Docker (NODE_ENV=production but no TLS).
15
+ * Computed per-request in buildCsp() from the request URL protocol.
16
+ */
13
17
 
14
18
  /**
15
19
  * Nonce-based style-src toggle.
@@ -21,7 +25,8 @@ const isSecureOrigin = process.env.NODE_ENV === "production";
21
25
  const NONCE_STYLES_ENABLED = true;
22
26
 
23
27
  /** Build the CSP header value with a per-request nonce. */
24
- function buildCsp(nonce: string): string {
28
+ function buildCsp(nonce: string, requestUrl?: string): string {
29
+ const isHttps = requestUrl ? requestUrl.startsWith("https://") : false;
25
30
  return [
26
31
  "default-src 'self'",
27
32
  `script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https://js.stripe.com`,
@@ -36,7 +41,7 @@ function buildCsp(nonce: string): string {
36
41
  "base-uri 'self'",
37
42
  "form-action 'self'",
38
43
  "object-src 'none'",
39
- ...(isSecureOrigin ? ["upgrade-insecure-requests"] : []),
44
+ ...(isHttps ? ["upgrade-insecure-requests"] : []),
40
45
  ].join("; ");
41
46
  }
42
47
 
@@ -160,7 +165,7 @@ export default async function middleware(request: NextRequest) {
160
165
 
161
166
  // Generate a per-request nonce for CSP
162
167
  const nonce = crypto.randomUUID();
163
- const cspHeaderValue = buildCsp(nonce);
168
+ const cspHeaderValue = buildCsp(nonce, request.url);
164
169
 
165
170
  /** Apply CSP and cache-busting headers to any response before returning it. */
166
171
  function withCsp(response: NextResponse): NextResponse {