feat: widgets and ai chat

apps/dashboard/src/routes/csp-report/+server.ts

@@ -1,26 +1,19 @@
 import type { RequestHandler } from './$types';
 
+/**
+ * Accepts browser CSP violation reports (report-only policy `report-uri`).
+ * Must stay public — no session — so POST is not redirected to /login.
+ */
 export const POST: RequestHandler = async ({ request }) => {
   try {
-    const report = await request.json();
-
-    // Log the CSP violation for monitoring
-    // console.warn('CSP Violation Report:', {
-    //   timestamp: new Date().toISOString(),
-    //   documentURI: report['document-uri'],
-    //   violatedDirective: report['violated-directive'],
-    //   blockedURI: report['blocked-uri'],
-    //   effectiveDirective: report['effective-directive'],
-    //   originalPolicy: report['original-policy'],
-    //   sourceFile: report['source-file'],
-    //   lineNumber: report['line-number'],
-    //   columnNumber: report['column-number'],
-    //   userAgent: request.headers.get('user-agent')
-    // });
-
-    return new Response('OK', { status: 200 });
+    const raw = await request.text();
+    if (raw) {
+      JSON.parse(raw);
+      // Optional: log parsed report for monitoring (shape varies by directive)
+    }
   } catch (error) {
-    console.error('Error processing CSP report:', error);
-    return new Response('Bad Request', { status: 400 });
+    console.error('csp-report: invalid JSON body', error);
   }
+
+  return new Response(null, { status: 204 });
 };