ba-cafe

commit f3d93169779ff79d0a48c0807000eb1b230a3ba0
parent ab73cda833273399bb7267542fe5ffacab8d2940
Author: Sunny <122193933+Sunny-JP@users.noreply.github.com>
Date:   Sat, 31 Jan 2026 15:07:53 +0900

Merge pull request #41 from Sunny-JP/v4-sunny-dev

V4 sunny dev
Diffstat:
M
next.config.ts
 | 
53
+++++++++++++++++++++++++++++++++++++++++++++++++----
M
src/app/api/tap/route.ts
 | 
11
+++++++++++

2 files changed, 60 insertions(+), 4 deletions(-)
diff --git a/next.config.ts b/next.config.ts
@@ -1,8 +1,23 @@
 import type { NextConfig } from "next";
 import withPWAInit from "@ducanh2912/next-pwa";
 
+const cspHeader = `
+    default-src 'self';
+    script-src 'self' 'unsafe-eval' 'unsafe-inline' https://onesignal.com https://cdn.onesignal.com;
+    style-src 'self' 'unsafe-inline';
+    img-src 'self' blob: data: https://lh3.googleusercontent.com https://cdn.discordapp.com;
+    font-src 'self';
+    connect-src 'self' https://*.supabase.co wss://*.supabase.co https://onesignal.com;
+    object-src 'none';
+    base-uri 'self';
+    form-action 'self';
+    frame-ancestors 'none';
+    upgrade-insecure-requests;
+`.replace(/\s{2,}/g, " ").trim();
+
 const nextConfig: NextConfig = {
-  // domains を remotePatterns に変更
+  poweredByHeader: false,
+
   images: {
     remotePatterns: [
       {
@@ -13,8 +28,37 @@ const nextConfig: NextConfig = {
     unoptimized: true,
   },
 
-  // PWAプラグインとの競合エラーを消すための設定
-  // PWAプラグインがWebpack設定を注入するため、明示的にTurbopack設定(空でも可)を書く必要があります
+  async headers() {
+    return [
+      {
+        source: '/api/:path*',
+        headers: [
+          {
+            key: 'Access-Control-Allow-Origin',
+            value: 'https://rabbit1.cc', 
+          },
+          {
+            key: 'Access-Control-Allow-Methods',
+            value: 'GET,POST,OPTIONS,DELETE,PATCH',
+          },
+          {
+            key: 'Access-Control-Allow-Headers',
+            value: 'X-CSRF-Token, X-Requested-With, Accept, Content-Type, Authorization',
+          },
+        ],
+      },
+      {
+        source: '/(.*)',
+        headers: [
+          { key: 'Content-Security-Policy', value: cspHeader },
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          { key: 'Referrer-Policy', value: 'origin-when-cross-origin' },
+        ],
+      },
+    ];
+  },
+
   turbopack: {}, 
 };
 
@@ -29,4 +73,4 @@ const withPWA = withPWAInit({
   },
 });
 
-export default withPWA(nextConfig);
+export default withPWA(nextConfig);+
\ No newline at end of file
diff --git a/src/app/api/tap/route.ts b/src/app/api/tap/route.ts
@@ -5,6 +5,17 @@ import { shouldScheduleNotification } from '@/lib/timeUtils';
 
 export const runtime = 'edge';
 
+export async function OPTIONS() {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': 'https://rabbit1.cc',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    },
+  });
+}
+
 export async function POST(request: Request) {
   try {
     const body = await request.json();