From 847a567c5202b41e00596a8ff986a6faaf02068e Mon Sep 17 00:00:00 2001
From: charlesgauthereau <charles.gauthereau@soluce-technologies.com>
Date: Sat, 26 Jul 2025 16:45:43 +0200
Subject: [PATCH] Working on bugs, add delete restore. Review the auth style.
 working on the RBAC.

---
 next.config.ts      | 74 ++++++++++++++++++++++-----------------------
 portabase.config.ts | 45 ++++++++++++++++++++++++---
 2 files changed, 77 insertions(+), 42 deletions(-)

diff --git a/next.config.ts b/next.config.ts
index 6e0c8fe3..ea10111f 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,9 +1,9 @@
-import type { NextConfig } from "next";
+import type {NextConfig} from "next";
 import {PORTABASE_DEFAULT_SETTINGS} from "./portabase.config";
 
 
 function buildCSPHeader(): string {
-    const { CSP } = PORTABASE_DEFAULT_SETTINGS.SECURITY;
+    const {CSP} = PORTABASE_DEFAULT_SETTINGS.SECURITY;
 
     const directives = [
         `default-src ${CSP.DEFAULT_SRC.join(" ")}`,
@@ -12,6 +12,7 @@ function buildCSPHeader(): string {
         `img-src ${CSP.IMG_SRC.join(" ")}`,
         `font-src ${CSP.FONT_SRC.join(" ")}`,
         `object-src ${CSP.OBJECT_SRC.join(" ")}`,
+        `connect-src ${CSP.CONNECT_SRC.join(" ")}`,
         `base-uri ${CSP.BASE_URI.join(" ")}`,
         `form-action ${CSP.FORM_ACTION.join(" ")}`,
         `frame-ancestors ${CSP.FRAME_ANCESTORS.join(" ")}`,
@@ -35,7 +36,6 @@ function buildPermissionsPolicy(): string {
 }
 
 
-
 const nextConfig: NextConfig = {
     output: "standalone",
     typescript: {
@@ -50,40 +50,40 @@ const nextConfig: NextConfig = {
     experimental: {
         nodeMiddleware: true,
     },
-    // async headers() {
-    //     return [
-    //         {
-    //             source: "/(.*)",
-    //             headers: [
-    //                 {
-    //                     key: "Content-Security-Policy",
-    //                     value: buildCSPHeader(),
-    //                 },
-    //                 {
-    //                     key: "Permissions-Policy",
-    //                     value: buildPermissionsPolicy(),
-    //                 },
-    //                 {
-    //                     key: 'X-Content-Type-Options',
-    //                     value: 'nosniff',
-    //                 },
-    //                 {
-    //                     key: 'X-Frame-Options',
-    //                     value: 'DENY',
-    //                 },
-    //                 {
-    //                     key: 'Referrer-Policy',
-    //                     value: 'strict-origin-when-cross-origin',
-    //                 },
-    //                 {
-    //                     key: 'Strict-Transport-Security',
-    //                     value: 'max-age=63072000; includeSubDomains; preload',
-    //                 }
-    //                 // ...other security headers
-    //             ],
-    //         },
-    //     ];
-    // },
+    async headers() {
+        return [
+            {
+                source: "/(.*)",
+                headers: [
+                    {
+                        key: "Content-Security-Policy",
+                        value: buildCSPHeader(),
+                    },
+                    {
+                        key: "Permissions-Policy",
+                        value: buildPermissionsPolicy(),
+                    },
+                    {
+                        key: 'X-Content-Type-Options',
+                        value: 'nosniff',
+                    },
+                    {
+                        key: 'X-Frame-Options',
+                        value: 'DENY',
+                    },
+                    {
+                        key: 'Referrer-Policy',
+                        value: 'strict-origin-when-cross-origin',
+                    },
+                    {
+                        key: 'Strict-Transport-Security',
+                        value: 'max-age=63072000; includeSubDomains; preload',
+                    }
+                    // ...other security headers
+                ],
+            },
+        ];
+    },
 };
 
 export default nextConfig;
diff --git a/portabase.config.ts b/portabase.config.ts
index 78d0f694..2e5e6d27 100644
--- a/portabase.config.ts
+++ b/portabase.config.ts
@@ -3,10 +3,45 @@ export const PORTABASE_DEFAULT_SETTINGS = {
     SECURITY: {
         CSP: {
             DEFAULT_SRC: ["'self'"],
-            SCRIPT_SRC: ["'self'", "'unsafe-eval'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://www.googletagmanager.com"],
-            STYLE_SRC: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-            IMG_SRC: ["'self'", "blob:", "data:", "https:"],
-            FONT_SRC: ["'self'"],
+            SCRIPT_SRC: [
+                "'self'",
+                "'unsafe-eval'",
+                "'unsafe-inline'",
+                "https://cdn.jsdelivr.net",
+                "https://www.googletagmanager.com",
+                "https://code.iconify.design",
+                "https://code.iconify.com",
+                "https://cdn.iconify.design",
+                "https://api.iconify.design",
+            ],
+            STYLE_SRC: [
+                "'self'",
+                "'unsafe-inline'",
+                "https://fonts.googleapis.com",
+                "https://code.iconify.design",
+                "https://cdn.iconify.design",
+                "https://code.iconify.com",
+            ],
+            IMG_SRC: [
+                "'self'",
+                "blob:",
+                "data:",
+                "https:",
+                "https://code.iconify.design",
+                "https://cdn.iconify.design",
+                "https://code.iconify.com",
+                "https://api.iconify.design",
+            ],
+            FONT_SRC: [
+                "'self'",
+                "https://fonts.gstatic.com",
+                "https://cdn.iconify.design",
+            ],
+            CONNECT_SRC: [
+                "'self'",
+                "https://api.iconify.design",
+                "https://code.iconify.design",
+            ],
             OBJECT_SRC: ["'none'"],
             BASE_URI: ["'self'"],
             FORM_ACTION: ["'self'"],
@@ -22,4 +57,4 @@ export const PORTABASE_DEFAULT_SETTINGS = {
             // ...other features
         },
     },
-};
\ No newline at end of file
+};