fix(web): allow Cloudflare RUM reporting

Author: thonatos

apps/web/app/lib/security-headers.ts

@@ -61,7 +61,11 @@ export function buildContentSecurityPolicy(
   env: RuntimeEnv = process.env,
 ): string {
   const apiOrigin = origin(env.CNODE_API_BASE_URL || "https://api.cnodejs.org");
-  const connectSources = ["'self'", "https://challenges.cloudflare.com"];
+  const connectSources = [
+    "'self'",
+    "https://challenges.cloudflare.com",
+    "https://cloudflareinsights.com",
+  ];
   if (apiOrigin && !connectSources.includes(apiOrigin)) connectSources.push(apiOrigin);
 
   // Arbitrary HTTPS images are existing user-content behavior; scripts remain nonce-restricted.

apps/web/tests/SecurityHeaders.test.ts

@@ -96,7 +96,9 @@ describe("Web document security headers", () => {
     const policy = buildContentSecurityPolicy("nonce", {
       CNODE_API_BASE_URL: "https://api.example.com/v1",
     });
-    expect(policy).toContain("connect-src 'self' https://challenges.cloudflare.com https://api.example.com");
+    expect(policy).toContain(
+      "connect-src 'self' https://challenges.cloudflare.com https://cloudflareinsights.com https://api.example.com",
+    );
     expect(policy).toContain("frame-src https://challenges.cloudflare.com");
     expect(policy).toContain("img-src 'self' data: blob: https:");
     expect(policy).toContain("report-uri /__csp-report");