Function generateRuntimeCSP

apps/sim/lib/core/security/csp.ts:191–220

()

 * deployments where build-time values may be stale placeholders.
 */
export function generateRuntimeCSP(): string {
  const appUrl = getEnv('NEXT_PUBLIC_APP_URL') || ''

  const socketUrl = getEnv('NEXT_PUBLIC_SOCKET_URL') || (isDev ? DEFAULT_SOCKET_URL : '')
  const socketWsUrl = socketUrl ? toWebSocketUrl(socketUrl) : ''
  const ollamaUrl = getEnv('OLLAMA_URL') || (isDev ? DEFAULT_OLLAMA_URL : '')

  const brandLogoDomains = getHostnameFromUrl(getEnv('NEXT_PUBLIC_BRAND_LOGO_URL'))
  const privacyDomains = getHostnameFromUrl(getEnv('NEXT_PUBLIC_PRIVACY_URL'))
  const termsDomains = getHostnameFromUrl(getEnv('NEXT_PUBLIC_TERMS_URL'))

  const runtimeDirectives: CSPDirectives = {
    ...buildTimeCSPDirectives,

    'img-src': [...STATIC_IMG_SRC],

    'connect-src': [
      ...STATIC_CONNECT_SRC,
      appUrl,
      ollamaUrl,
      socketUrl,
      socketWsUrl,
      ...brandLogoDomains,
      ...privacyDomains,
      ...termsDomains,
    ],
  }

  return buildCSPString(runtimeDirectives)
}

/**
 * Get the main CSP policy string (build-time)