From 9fe7691f8d01953ec8e792b7263b83774c3d84d6 Mon Sep 17 00:00:00 2001
From: Rotimi Best <best@classroomio.com>
Date: Wed, 3 Dec 2025 10:10:08 +0100
Subject: [PATCH] fix: CSP configuration for API and media access

- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.
---
 apps/dashboard/svelte.config.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/apps/dashboard/svelte.config.js b/apps/dashboard/svelte.config.js
index 56f91370..d97912d9 100644
--- a/apps/dashboard/svelte.config.js
+++ b/apps/dashboard/svelte.config.js
@@ -44,15 +44,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.classroomio.com',
@@ -88,15 +91,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.supabase.co',