From bda23aeee6d8a9e5a786cd337324619f2f31aaa5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Victor?=
 <69174195+fonteeboa@users.noreply.github.com>
Date: Fri, 14 Nov 2025 08:57:38 -0300
Subject: [PATCH] frame: add profile url to iframe config

---
 apps/web/middleware.ts | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index 06dcb4a..3456145 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -1,25 +1,34 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
+const ALLOWED_ORIGIN = 'https://fonteeboa.netlify.app';
+
 export function middleware(req: NextRequest) {
   const res = NextResponse.next();
+
+  res.headers.set('Access-Control-Allow-Origin', ALLOWED_ORIGIN);
+  res.headers.set('Access-Control-Allow-Credentials', 'true');
+  res.headers.set('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
+  res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
   res.headers.set('Referrer-Policy', 'no-referrer');
   res.headers.set('X-Content-Type-Options', 'nosniff');
-  res.headers.set('X-Frame-Options', 'DENY');
-  // Relaxed CSP to allow Next inline bootstrap scripts so hydration works.
-  // If we want strict nonce-based CSP later, we can wire Next's nonce helpers.
+  res.headers.set('X-Frame-Options', 'SAMEORIGIN');
+
   const csp = [
     "default-src 'self'",
-    "img-src 'self' https: data:",
+    "img-src 'self' data:",
     "style-src 'self' 'unsafe-inline'",
     "script-src 'self' 'unsafe-inline'",
     "connect-src 'self'",
-    "font-src 'self' data:"
+    "font-src 'self'",
+    `frame-ancestors 'self' ${ALLOWED_ORIGIN}`,
   ].join('; ');
+
   res.headers.set('Content-Security-Policy', csp);
+
   return res;
 }
 
 export const config = {
-  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)']
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };