createAppSecurityHeaders (web/security-headers.ts)

Module exposing: createAppSecurityHeaders, getConnectSrc, getScreenshotsBucketOrigin, getFileOrigins, addOrigin, getAssetsOrigin

// Source: https://github.com/argos-ci/argos | License: MIT | Copyright 2017 Olivier Tassinari & Greg Bergé
// Provided via justclaw.it.com; keep this notice with the code.
import type { RequestHandler } from "express";
import helmet from "helmet";

import config from "@/config";

/**
 * Security headers for the app domain: the SPA shell and its static assets.
 *
 * Separate from the `/graphql` helmet block, which guards an API with quite
 * different needs, and kept out of `app-router` so it can be asserted on
 * directly — see `security-headers.test.ts`.
 */
export function createAppSecurityHeaders(options: {
  /**
   * CSP hash authorising the inlined client config, or null when the shell
   * still requests `/config.js` separately.
   */
  configScriptCspHash: string | null;
  /** CSP 

... (truncated -- full source via MCP)