From 54490f610ce16a508c5ca788e54bca9ecf1990ab Mon Sep 17 00:00:00 2001
From: brysonbw <brysonward77@gmail.com>
Date: Sun, 25 Jan 2026 19:09:20 -0700
Subject: [PATCH] chore(csp): update csp

---
 .gitignore                   |   2 +
 eslint.config.js             |   1 +
 package-lock.json            |  20 +------
 package.json                 |   5 +-
 src/utils/helperFunctions.ts |  10 ----
 vite.config.js               | 106 ++++++++++++++++++-----------------
 6 files changed, 63 insertions(+), 81 deletions(-)
 delete mode 100644 src/utils/helperFunctions.ts

diff --git a/.gitignore b/.gitignore
index 2246662..ed9f9d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,5 @@ dist-ssr
 .firebaserc
 firebase.json
 .firebase
+
+ssl
diff --git a/eslint.config.js b/eslint.config.js
index 60dd32d..1b13b2b 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -18,6 +18,7 @@ export default [
       ecmaVersion: 'latest',
       sourceType: 'module',
       globals: {
+        process: 'readonly',
         ...globals.browser,
       },
     },
diff --git a/package-lock.json b/package-lock.json
index b2f0afb..e7ef7ea 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,20 +1,19 @@
 {
   "name": "codecause.dev",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codecause.dev",
-      "version": "1.0.2",
+      "version": "1.0.3",
       "dependencies": {
         "@lit-labs/router": "^0.1.4",
         "@lit/task": "^1.0.3",
         "lit": "^3.3.2",
         "three": "^0.182.0",
         "three-stdlib": "^2.36.1",
-        "urlpattern-polyfill": "^10.1.0",
-        "uuid": "^13.0.0"
+        "urlpattern-polyfill": "^10.1.0"
       },
       "devDependencies": {
         "@types/three": "^0.182.0",
@@ -6009,19 +6008,6 @@
       "integrity": "sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==",
       "license": "MIT"
     },
-    "node_modules/uuid": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
-      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
     "node_modules/vite": {
       "version": "7.3.1",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
diff --git a/package.json b/package.json
index f097db8..c566b4a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "codecause.dev",
   "private": true,
-  "version": "1.0.2",
+  "version": "1.0.3",
   "type": "module",
   "engines": {
     "node": ">=24",
@@ -20,8 +20,7 @@
     "lit": "^3.3.2",
     "three": "^0.182.0",
     "three-stdlib": "^2.36.1",
-    "urlpattern-polyfill": "^10.1.0",
-    "uuid": "^13.0.0"
+    "urlpattern-polyfill": "^10.1.0"
   },
   "devDependencies": {
     "@types/three": "^0.182.0",
diff --git a/src/utils/helperFunctions.ts b/src/utils/helperFunctions.ts
deleted file mode 100644
index 550311b..0000000
--- a/src/utils/helperFunctions.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { v4 as uuidv4 } from 'uuid';
-
-/** Get UUIDv4 */
-export function UUIDv4(): string {
-  if (crypto && typeof crypto?.randomUUID === 'function') {
-    return crypto.randomUUID();
-  }
-  // Fallback
-  return uuidv4();
-}
diff --git a/vite.config.js b/vite.config.js
index fa154f7..6c161a0 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -1,60 +1,64 @@
 /* eslint-disable @typescript-eslint/explicit-function-return-type */
-import { defineConfig } from 'vite';
+import fs from 'fs';
+
+import { defineConfig, loadEnv } from 'vite';
 import eslint from 'vite-plugin-eslint';
 import legacy from '@vitejs/plugin-legacy';
-import { UUIDv4 } from './src/utils/helperFunctions';
 
-export default defineConfig({
-  plugins: [
-    eslint(),
-    legacy({
-      targets: ['defaults', 'not IE 11'],
-    }),
-    {
-      name: 'csp',
-      transformIndexHtml(html) {
-        const NONCE = UUIDv4();
-        const csp = `object-src 'none'; media-src 'none'; base-uri 'none'; script-src 'self' 'nonce-${NONCE}'; style-src 'self' 'nonce-${NONCE}'; style-src-attr 'nonce-${NONCE}'; img-src 'self' 'nonce-${NONCE}';`;
-        html = html.replace(/<style>/g, `<style nonce="${NONCE}">`);
-        html = html.replace(
-          /<script\s+/g,
-          `<script nonce="${NONCE}" type="module"`
-        );
-        html = html.replace(
-          /<link\s+rel="stylesheet"/g,
-          `<link rel="stylesheet" nonce="${NONCE}"`
-        );
-        html = html.replace(
-          /<head>/,
-          `<head>\n<meta http-equiv="Content-Security-Policy" content="${csp}">`
-        );
-        return html;
-      },
-    },
-  ],
-  build: {
-    outDir: 'dist/browser',
-    rollupOptions: {
-      output: {
-        entryFileNames: '[name].[hash].js',
-        chunkFileNames: '[name].[hash].js',
-        assetFileNames: '[name].[hash].[ext]',
-      },
-    },
-    sourcemap: false,
-    minify: 'terser',
-    terserOptions: {
-      format: {
-        comments: false,
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), '');
+  const isDevHTTPSEnabled =
+    typeof env.HTTPS_CERT === 'string' && typeof env.HTTPS_KEY === 'string';
+  return {
+    server: isDevHTTPSEnabled
+      ? {
+          https: {
+            key: fs.readFileSync(env.HTTPS_KEY),
+            cert: fs.readFileSync(env.HTTPS_CERT),
+          },
+        }
+      : undefined,
+    plugins: [
+      eslint(),
+      legacy({
+        targets: ['defaults', 'not IE 11'],
+      }),
+      {
+        name: 'csp',
+        transformIndexHtml(html) {
+          const csp = `default-src 'none'; script-src 'self'; connect-src 'self' https://api.github.com; img-src 'self'; style-src 'self'; form-action 'self'; object-src 'none'; media-src 'self'; base-uri 'none'; upgrade-insecure-requests;`;
+          html = html.replace(
+            /<head>/,
+            `<head>\n<meta http-equiv="Content-Security-Policy" content="${csp}">`
+          );
+          return html;
+        },
       },
-      parse: {
-        html5_comments: false,
+    ],
+    build: {
+      outDir: 'dist/browser',
+      rollupOptions: {
+        output: {
+          entryFileNames: '[name].[hash].js',
+          chunkFileNames: '[name].[hash].js',
+          assetFileNames: '[name].[hash].[ext]',
+        },
       },
-      sourceMap: false,
-      compress: {
-        drop_console: true,
-        drop_debugger: true,
+      sourcemap: false,
+      minify: 'terser',
+      terserOptions: {
+        format: {
+          comments: false,
+        },
+        parse: {
+          html5_comments: false,
+        },
+        sourceMap: false,
+        compress: {
+          drop_console: true,
+          drop_debugger: true,
+        },
       },
     },
-  },
+  };
 });