diff --git a/Backend/index.ts b/Backend/index.ts index e085974..62528f2 100644 --- a/Backend/index.ts +++ b/Backend/index.ts @@ -31,6 +31,32 @@ const trustedOrigins = process.env.BETTER_AUTH_TRUSTED_ORIGINS ? process.env.BETTER_AUTH_TRUSTED_ORIGINS.split(',').map((origin) => origin.trim()).filter(Boolean) : []; +const buildMinioConnectOrigin = (): string | null => { + const endpoint = process.env.MINIO_ENDPOINT?.trim(); + if (!endpoint) { + return null; + } + + if (endpoint.startsWith('http://') || endpoint.startsWith('https://')) { + try { + return new URL(endpoint).origin; + } catch { + return null; + } + } + + const useSSL = (process.env.MINIO_USE_SSL ?? 'false').toLowerCase() === 'true'; + const port = Number(process.env.MINIO_PORT ?? (useSSL ? 443 : 80)); + const scheme = useSSL ? 'https' : 'http'; + const includePort = !(useSSL && port === 443) && !(!useSSL && port === 80); + + return `${scheme}://${endpoint}${includePort ? `:${port}` : ''}`; +}; + +const minioConnectOrigin = buildMinioConnectOrigin(); +const connectSrcDirectives = ["'self'", 'cdn.jsdelivr.net', ...(minioConnectOrigin ? [minioConnectOrigin] : [])]; +const mediaSrcDirectives = ["'self'", 'blob:', 'data:', ...(minioConnectOrigin ? [minioConnectOrigin] : [])]; + app.get('/', (_req, res) => { res.send('API is running'); }); @@ -55,7 +81,8 @@ app.use( "script-src": ["'self'", "'unsafe-inline'", "cdn.jsdelivr.net", "cdn.tailwindcss.com"], "style-src": ["'self'", "'unsafe-inline'", "cdn.jsdelivr.net", "fonts.googleapis.com"], "font-src": ["'self'", "fonts.gstatic.com"], - "connect-src": ["'self'", "cdn.jsdelivr.net"], + "connect-src": connectSrcDirectives, + "media-src": mediaSrcDirectives, "img-src": ["'self'", "data:", "blob:"], }, }, diff --git a/Backend/public/mobile-sim.html b/Backend/public/mobile-sim.html index 07a1cff..1226772 100644 --- a/Backend/public/mobile-sim.html +++ b/Backend/public/mobile-sim.html @@ -208,17 +208,6 @@