frame: add profile url to iframe config

apps/web/middleware.ts

@@ -1,25 +1,34 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
+const ALLOWED_ORIGIN = 'https://fonteeboa.netlify.app';
+
 export function middleware(req: NextRequest) {
   const res = NextResponse.next();
+
+  res.headers.set('Access-Control-Allow-Origin', ALLOWED_ORIGIN);
+  res.headers.set('Access-Control-Allow-Credentials', 'true');
+  res.headers.set('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
+  res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
   res.headers.set('Referrer-Policy', 'no-referrer');
   res.headers.set('X-Content-Type-Options', 'nosniff');
-  res.headers.set('X-Frame-Options', 'DENY');
-  // Relaxed CSP to allow Next inline bootstrap scripts so hydration works.
-  // If we want strict nonce-based CSP later, we can wire Next's nonce helpers.
+  res.headers.set('X-Frame-Options', 'SAMEORIGIN');
+
   const csp = [
     "default-src 'self'",
-    "img-src 'self' https: data:",
+    "img-src 'self' data:",
     "style-src 'self' 'unsafe-inline'",
     "script-src 'self' 'unsafe-inline'",
     "connect-src 'self'",
-    "font-src 'self' data:"
+    "font-src 'self'",
+    `frame-ancestors 'self' ${ALLOWED_ORIGIN}`,
   ].join('; ');
+
   res.headers.set('Content-Security-Policy', csp);
+
   return res;
 }
 
 export const config = {
-  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)']
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };