Fixed builCsp.ts

dist/modules/security/buildCsp.d.ts

@@ -14,7 +14,7 @@ export type BuildCspArgs = {
     /** YouTube embeds — adds youtube to frame-src. */
     youtube?: boolean;
 };
-type CspDirective = 'base-uri' | 'connect-src' | 'default-src' | 'font-src' | 'form-action' | 'frame-ancestors' | 'frame-src' | 'img-src' | 'object-src' | 'script-src' | 'style-src';
+type CspDirective = 'base-uri' | 'connect-src' | 'default-src' | 'font-src' | 'form-action' | 'frame-ancestors' | 'frame-src' | 'img-src' | 'media-src' | 'object-src' | 'script-src' | 'style-src' | 'worker-src';
 /**
  * Builds a Content-Security-Policy string with the hard OWASP/Lighthouse-required
  * directives baked in, and opt-in sources for common third parties. Solves the

dist/modules/security/buildCsp.js

@@ -46,6 +46,7 @@
             'data:',
             'blob:'
         ],
+        'media-src': [],
         'script-src': [
             "'self'",
             "'unsafe-inline'"
@@ -55,6 +56,7 @@
             "'unsafe-inline'",
             'https://fonts.googleapis.com'
         ],
+        'worker-src': [],
         // HARD defaults (OWASP/Lighthouse) — always on, no reason to omit:
         'base-uri': [
             "'self'"

src/modules/security/buildCsp.ts

@@ -24,9 +24,11 @@ type CspDirective =
   | 'frame-ancestors'
   | 'frame-src'
   | 'img-src'
+  | 'media-src'
   | 'object-src'
   | 'script-src'
   | 'style-src'
+  | 'worker-src'
 
 /**
  * Builds a Content-Security-Policy string with the hard OWASP/Lighthouse-required
@@ -64,8 +66,10 @@ export function buildCsp(args: BuildCspArgs = {}): { key: string; value: string
     'form-action': ["'self'"],
     'frame-src': [],
     'img-src': ["'self'", 'data:', 'blob:'],
+    'media-src': [], // video/audio sources — filled via extra when needed
     'script-src': ["'self'", "'unsafe-inline'"],
     'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
+    'worker-src': [], // web workers — filled via extra when needed
     // HARD defaults (OWASP/Lighthouse) — always on, no reason to omit:
     'base-uri': ["'self'"], // block <base> hijacking
     'frame-ancestors': ["'none'"], // clickjacking protection (replaces X-Frame-Options)