mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-19 04:41:24 +02:00
f5ee3aae20
Create @manacore/shared-utils/security-headers with setSecurityHeaders() utility that sets standard security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). CSP includes stats.mana.how (Umami) and glitchtip.mana.how by default. Each app passes its own connectSrc origins (auth URL, backend URL, etc.). Previously only Calendar and Storage had CSP headers - now all 17 web apps have consistent security headers via the shared utility. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
28 lines
1.1 KiB
TypeScript
28 lines
1.1 KiB
TypeScript
import type { Handle } from '@sveltejs/kit';
|
|
import { injectUmamiAnalytics } from '@manacore/shared-utils/analytics-server';
|
|
import { setSecurityHeaders } from '@manacore/shared-utils/security-headers';
|
|
|
|
const PUBLIC_MANA_CORE_AUTH_URL_CLIENT =
|
|
process.env.PUBLIC_MANA_CORE_AUTH_URL_CLIENT || process.env.PUBLIC_MANA_CORE_AUTH_URL || '';
|
|
const PUBLIC_BACKEND_URL_CLIENT =
|
|
process.env.PUBLIC_BACKEND_URL_CLIENT || process.env.PUBLIC_BACKEND_URL || '';
|
|
const PUBLIC_GLITCHTIP_DSN = process.env.PUBLIC_GLITCHTIP_DSN || '';
|
|
|
|
export const handle: Handle = async ({ event, resolve }) => {
|
|
const response = await resolve(event, {
|
|
transformPageChunk: ({ html }) => {
|
|
const envScript = `<script>
|
|
window.__PUBLIC_MANA_CORE_AUTH_URL__ = "${PUBLIC_MANA_CORE_AUTH_URL_CLIENT}";
|
|
window.__PUBLIC_BACKEND_URL__ = "${PUBLIC_BACKEND_URL_CLIENT}";
|
|
window.__PUBLIC_GLITCHTIP_DSN__ = "${PUBLIC_GLITCHTIP_DSN}";
|
|
</script>`;
|
|
return injectUmamiAnalytics(html.replace('<head>', `<head>${envScript}`));
|
|
},
|
|
});
|
|
|
|
setSecurityHeaders(response, {
|
|
connectSrc: [PUBLIC_MANA_CORE_AUTH_URL_CLIENT, PUBLIC_BACKEND_URL_CLIENT],
|
|
});
|
|
|
|
return response;
|
|
};
|