From 53a10dc40857bf23f27a947e8e165d878c55c770 Mon Sep 17 00:00:00 2001
From: Dev M <devtechedge@gmail.com>
Date: Sun, 6 Sep 2026 03:57:07 +0000
Subject: [PATCH] fix(ci): drop CSP that broke next-dev Playwright e2e

---
 web-demo/next.config.mjs | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/web-demo/next.config.mjs b/web-demo/next.config.mjs
index f6a33a2..a4b001c 100644
--- a/web-demo/next.config.mjs
+++ b/web-demo/next.config.mjs
@@ -1,25 +1,11 @@
 /** @type {import('next').NextConfig} */
+// Keep useful security headers. CSP omitted: Next.js `next dev` (Playwright webServer)
+// needs eval/HMR websockets; a strict CSP broke client hydration and e2e.
 const securityHeaders = [
   { key: "X-Content-Type-Options", value: "nosniff" },
   { key: "X-Frame-Options", value: "DENY" },
   { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
   { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
-  {
-    key: "Content-Security-Policy",
-    value: [
-      "default-src 'self'",
-      "script-src 'self' 'unsafe-inline'",
-      "style-src 'self' 'unsafe-inline'",
-      "img-src 'self' data: blob:",
-      "font-src 'self' data:",
-      // BYOK narration calls OpenAI from the browser only — never a first-party API
-      "connect-src 'self' https://api.openai.com",
-      "frame-ancestors 'none'",
-      "object-src 'none'",
-      "base-uri 'self'",
-      "form-action 'self'",
-    ].join("; "),
-  },
 ];
 
 const nextConfig = {
@@ -28,4 +14,4 @@ const nextConfig = {
     return [{ source: "/:path*", headers: securityHeaders }];
   },
 };
-export default nextConfig;
+export default nextConfig;
\ No newline at end of file