src/dashboard-csp.ts

Functions

None: it only declares types or values.

Imports

It imports src/security-headers.ts. Imported by src/portal-app.ts.

Source

1// The app's page CSP, in its own module so the Worker (src/portal-app.ts) and the app's
2// browser tests (dashboard/dev/mock-api.ts serves it under vite preview) read one string.
3// A browser test run without the Worker's CSP would pass code the Worker's page then refuses.
4//
5// Scripts and styles from this origin and nothing inline, so an injected tag in anything the
6// feed carries cannot run; nothing unlisted (denyUnlisted). The consent dialog's CSP is separate.
7// Violations go to the sink on the MCP host (REPORT_URL), the group Reporting-Endpoints names.
8import { buildContentSecurityPolicy } from "@dustinedwards/site-runtime/csp";
9import { REPORT_URL } from "./security-headers";
10
11export const DASHBOARD_CSP = buildContentSecurityPolicy({
12  sources: { img: ["data:"] },
13  denyUnlisted: true,
14  reportUri: REPORT_URL,
15  reportTo: "csp",
16}).value;