Skip to content

fix: scalability.js #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
khemssharma merged 1 commit into from
Jul 9, 2026
Merged

fix: scalability.js #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 33 additions & 5 deletions pipeline/scalability.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,11 +59,39 @@ const helmetMiddleware = helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
imgSrc: ["'self'", 'data:', 'https://res.cloudinary.com'],
scriptSrc: ["'self'", "'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"],
connectSrc: ["'self'", 'https://api.openrouter.ai'],
frameSrc: ["'none'"],
imgSrc: [
"'self'",
'data:',
'https://res.cloudinary.com',
'https://api.dicebear.com', // default avatar generator used throughout the UI
],
// 'script-src-elem' falls back to 'script-src' when unset, per the browser
// warning — setting both explicitly avoids relying on that fallback.
scriptSrc: [
"'self'",
"'unsafe-inline'",
'https://accounts.google.com', // Google Identity Services (Google login button)
'https://checkout.razorpay.com', // Razorpay checkout.js, loaded dynamically at payment time
],
scriptSrcElem: [
"'self'",
"'unsafe-inline'",
'https://accounts.google.com',
'https://checkout.razorpay.com',
],
styleSrc: ["'self'", "'unsafe-inline'"],
connectSrc: [
"'self'",
'https://api.openrouter.ai',
'https://api.razorpay.com', // Razorpay order/payment verification calls
'https://lumberjack.razorpay.com', // Razorpay SDK's own analytics beacon
],
// Google's sign-in flow and Razorpay's payment modal both render in an iframe.
frameSrc: [
'https://accounts.google.com',
'https://api.razorpay.com',
'https://checkout.razorpay.com',
],
},
},
crossOriginEmbedderPolicy: false,
Expand Down
12 changes: 11 additions & 1 deletion ui/.env.production
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
# Loaded automatically by Create React App during `npm run build`
# (react-scripts build always runs in production mode). These get baked
# into the compiled JS bundle at build time — CRA env vars are NOT read
# at runtime, so this file must be present (and correct) before building.
#
# All three of these are meant to be public/client-exposed:
# - REACT_APP_BASE_URL → your API's public URL, not a secret
# - REACT_APP_GOOGLE_CLIENT_ID → Google OAuth client IDs are public by design
# - REACT_APP_RAZORPAY_KEY → this is the publishable "key_id" (rzp_test_/rzp_live_),
# not the private "key_secret" — safe to ship client-side
REACT_APP_BASE_URL=https://studynotion-1-tgdh.onrender.com/api/v1
REACT_APP_GOOGLE_CLIENT_ID=134887287128-s3pbcfbsaq88dulema5h910uaak0sh6f.apps.googleusercontent.com
REACT_APP_RAZORPAY_KEY=rzp_test_bO9Ppf14nv2wW3
REACT_APP_RAZORPAY_KEY=rzp_test_bO9Ppf14nv2wW3
Loading