Removed proxy and added api calls, has gov gateway auth

2022-01-20 10:56:26 +00:00
parent 6f37064eba
commit 5a536e158c
127 changed files with 5829 additions and 3097 deletions
@@ -2,6 +2,7 @@ import Document, { Html, Head, Main, NextScript } from "next/document";
 import SkipLink from "../components/skiplink";
 import { Tracking, TrackingNoScript } from "../components/tracking";
 import basicAuthMiddleware from "nextjs-basic-auth-middleware";
+import { nanoid } from "nanoid";

 class MyDocument extends Document {
    static async getInitialProps(ctx) {
@@ -13,7 +14,7 @@ class MyDocument extends Document {
        let hasBasicAuth =
            typeof process.env.BASIC_AUTH_CREDENTIALS != "undefined";

-        console.log(hasBasicAuth);
+        console.log("hasbasicAuth:", hasBasicAuth);

        if (ctx.req && ctx.res) {
            hasBasicAuth &&
@@ -38,23 +39,47 @@ class MyDocument extends Document {
    render() {
        const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null;
        const { useGATracking } = this.props;
+
+        const generatedNonce = nanoid();
+
+        let csp = ``;
+        csp += `base-uri 'self';`;
+        csp += `form-action 'self';`;
+        csp += `object-src 'self' data:;`;
+        csp += `script-src 'self'  https://www.googletagmanager.com  'nonce-${generatedNonce}' ${
+            process.env.NODE_ENV != "production" ? " 'unsafe-eval';" : " ;"
+        }`;
+        csp += `img-src 'self' https://www.googletagmanager.com https://gov.wales https://www.google-analytics.com 'nonce-${generatedNonce}' data:;`;
+        csp += `style-src 'self' https://fonts.googleapis.com 'unsafe-inline' data:;`;
+
        return (
            <Html lang="en">
                <Head>
+                    <meta httpEquiv="Content-Security-Policy" content={csp} />
                    {useGATracking && (
-                        <Tracking googleTagManagerID={googleTagManagerID} />
+                        <Tracking
+                            googleTagManagerID={googleTagManagerID}
+                            nonce={generatedNonce}
+                        />
                    )}
                </Head>
                <body className="js-enabled">
                    {useGATracking && (
                        <TrackingNoScript
+                            nonce={generatedNonce}
                            googleTagManagerID={googleTagManagerID}
                        />
                    )}
                    {!process.browser && (
-                        <script>
-                            window.switchDomain = `{process.env.I18N_DOMAIN}`
-                        </script>
+                        <>
+                            <script nonce={generatedNonce}>
+                                window.switchDomain = `{process.env.I18N_DOMAIN}
+                                `
+                            </script>
+                            <script nonce={generatedNonce}>
+                                window.apiRoot = `{process.env.API_ROOT}`
+                            </script>
+                        </>
                    )}
                    <SkipLink />
                    <Main />