External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add privacy policy page and fix CSP blocking API docs

Browse Source 
Add a privacy policy page accessible at /privacy (public, no auth required).
Relax Content-Security-Policy for /api/docs route to allow Scalar's inline
script initialization, fixing blank docs page in production.
This commit is contained in:
Siddharth Kumar Sah
2026-03-29 23:57:08 +08:00
parent d7a917b995
commit 7f17cb98ce
4 changed files with 101 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/index.ts
+4 -4
View File
@@ -53,10 +53,10 @@ app.addHook("onSend", async (_request, reply) => {
reply.header("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
if (process.env.NODE_ENV === "production") {
reply.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
reply.header(
"Content-Security-Policy",
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
);
const csp = _request.url.startsWith("/api/docs")
? "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; font-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'"
: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'";
reply.header("Content-Security-Policy", csp);
}
});