generated from nhcarrigan/template
hikari
7d8c6bf21c
## Summary - Allows `fonts.googleapis.com` in `style-src` and `fonts.gstatic.com` in `font-src` so the browser can load Google Fonts - Adds preconnect hints and the Google Fonts import (Griffy, Kalam, Creepster, Henny Penny) to `index.html` - Sets the body font to Kalam and heading font to Griffy, with utility classes for Creepster and Henny Penny - Disables Angular's `inlineCritical` optimisation, which was causing the stylesheet to be deferred via `onload="this.media='all'"` — an inline event handler blocked by the strict `script-src` CSP, preventing the heading font rules from ever applying to screen media ## Test plan - [ ] Rebuild and reload the app - [ ] Verify headings render in Griffy - [ ] Verify body text renders in Kalam - [ ] Check DevTools Styles tab confirms the `h1-h6` font-family rule is matched ✨ This PR was created with help from Hikari~ 🌸 Reviewed-on: #77 Co-authored-by: Hikari <hikari@nhcarrigan.com> Co-committed-by: Hikari <hikari@nhcarrigan.com>
46 lines
1.3 KiB
TypeScript
46 lines
1.3 KiB
TypeScript
/**
|
|
* @copyright 2026 NHCarrigan
|
|
* @license Naomi's Public License
|
|
* @author Naomi Carrigan
|
|
*/
|
|
|
|
import { FastifyPluginAsync } from "fastify";
|
|
import fastifyPlugin from "fastify-plugin";
|
|
import fastifyHelmet from "@fastify/helmet";
|
|
|
|
const helmetPlugin: FastifyPluginAsync = async (app) => {
|
|
await app.register(fastifyHelmet, {
|
|
contentSecurityPolicy: {
|
|
directives: {
|
|
defaultSrc: ["'self'"],
|
|
// Angular uses inline styles for component encapsulation, so we need to allow them
|
|
styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
|
|
imgSrc: ["'self'", "data:", "https:"],
|
|
scriptSrc: ["'self'"],
|
|
connectSrc: ["'self'", process.env.FRONTEND_URL ?? "http://localhost:4200"],
|
|
fontSrc: ["'self'", "data:", "https://fonts.gstatic.com"],
|
|
objectSrc: ["'none'"],
|
|
baseUri: ["'self'"],
|
|
formAction: ["'self'"],
|
|
frameAncestors: ["'none'"],
|
|
},
|
|
},
|
|
crossOriginEmbedderPolicy: false,
|
|
crossOriginResourcePolicy: { policy: "cross-origin" },
|
|
// Add additional security headers
|
|
hsts: {
|
|
maxAge: 31536000, // 1 year
|
|
includeSubDomains: true,
|
|
preload: true,
|
|
},
|
|
frameguard: {
|
|
action: "deny",
|
|
},
|
|
referrerPolicy: {
|
|
policy: "strict-origin-when-cross-origin",
|
|
},
|
|
});
|
|
};
|
|
|
|
export default fastifyPlugin(helmetPlugin);
|