fix: CSP policy missing front components like icons, nextui color mode, wasm

test/security_headers_test.go

@@ -1,6 +1,7 @@
 package test
 
 import (
+	"RenewCMS/api/handlers/frontend"
 	"RenewCMS/api/middleware"
 	"net/http"
 	"net/http/httptest"
@@ -38,7 +39,7 @@ func TestSecurityHeadersContentSecurityPolicy(t *testing.T) {
 
 	for _, directive := range []string{
 		"default-src 'self'",
-		"script-src 'self';",
+		"script-src 'self' 'wasm-unsafe-eval';",
 		"object-src 'none'",
 		"base-uri 'self'",
 		"frame-ancestors 'none'",
@@ -47,11 +48,34 @@ func TestSecurityHeadersContentSecurityPolicy(t *testing.T) {
 			t.Errorf("expected CSP to contain %q, got %q", directive, csp)
 		}
 	}
-	if strings.Contains(csp, "script-src 'self' 'unsafe") {
+	if strings.Contains(csp, "'unsafe-eval'") || strings.Contains(csp, "script-src 'self' 'unsafe-inline'") {
 		t.Errorf("script-src must not allow unsafe sources, got %q", csp)
 	}
 }
 
+func TestAllowInlineScriptsHashesOnlyInlineScripts(t *testing.T) {
+	policy := "default-src 'self'; script-src 'self'; object-src 'none'"
+	html := []byte(`<html><head><script>var a=1</script><script type="module" src="/a.js"></script><script> </script></head></html>`)
+
+	got := frontend.AllowInlineScripts(policy, html)
+
+	if !strings.Contains(got, "script-src 'self' 'sha256-") || strings.Count(got, "sha256-") != 1 {
+		t.Errorf("expected exactly one inline hash in script-src, got %q", got)
+	}
+	if !strings.Contains(got, "; object-src 'none'") {
+		t.Errorf("expected other directives untouched, got %q", got)
+	}
+}
+
+func TestAllowInlineScriptsLeavesPolicyWithoutInlineScripts(t *testing.T) {
+	policy := "script-src 'self'"
+	html := []byte(`<script type="module" src="/a.js"></script>`)
+
+	if got := frontend.AllowInlineScripts(policy, html); got != policy {
+		t.Errorf("expected policy unchanged, got %q", got)
+	}
+}
+
 func TestSecurityHeadersHSTSOnlyWhenEnabled(t *testing.T) {
 	if got := serveWithSecurityHeaders(false).Get("Strict-Transport-Security"); got != "" {
 		t.Errorf("expected no HSTS header, got %q", got)