From 53789ca56e9f969c1e392356e5bb373f17ccd768 Mon Sep 17 00:00:00 2001
From: neodk2004 <barac.daniel@gmail.com>
Date: Fri, 14 Aug 2026 07:11:30 +0200
Subject: [PATCH] fix(security): close remaining CSP report-only gaps, make
 Sentry sourcemap upload verbose for debugging

- connect-src: allow *.fastly.mux.com (Mux HLS chunks/manifests via Fastly
  edge, dynamic regional subdomains) and *.litix.io (Mux Data beacon uses
  inferred.litix.io, not covered by the exact litix.io entry)
- media-src: allow image.mux.com (storyboard.vtt thumbnail track)
- next.config.ts: silent:true -> silent:false + debug:true so the next
  Docker build surfaces what the Sentry/GlitchTip sourcemap upload plugin
  actually does (still minified stacktraces in GlitchTip despite the
  build-arg fix in b469389)
---
 next.config.ts |  9 ++++++---
 src/proxy.ts   | 10 +++++++++-
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/next.config.ts b/next.config.ts
index c738f19..f2106dc 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -44,9 +44,12 @@ export default withSentryConfig(withNextIntl(nextConfig), {
   org: process.env.SENTRY_ORG,
   project: process.env.SENTRY_PROJECT,
   authToken: process.env.SENTRY_AUTH_TOKEN,
-  silent: true,
-  // No auth token configured on this self-hosted deploy yet — skip
-  // source-map upload rather than failing the Docker build.
+  // Temporarily verbose (was silent: true) — GlitchTip still shows minified
+  // stacktraces after the build-arg fix in b469389, so the next deploy needs
+  // to surface the upload plugin's actual log instead of swallowing it.
+  // Revert to silent: true once a successful upload is confirmed.
+  silent: false,
+  debug: true,
   sourcemaps: { disable: !process.env.SENTRY_AUTH_TOKEN },
   disableLogger: true,
 });
diff --git a/src/proxy.ts b/src/proxy.ts
index 0881733..e949820 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -101,9 +101,17 @@ export default clerkMiddleware(
           "https://stream.mux.com",
           "https://image.mux.com",
           "https://litix.io",
+          "https://*.litix.io",
+          "https://*.fastly.mux.com",
           "https://storage.googleapis.com",
         ],
-        "media-src": ["self", "blob:", "https://stream.mux.com", "https://*.edgemv.mux.com"],
+        "media-src": [
+          "self",
+          "blob:",
+          "https://stream.mux.com",
+          "https://*.edgemv.mux.com",
+          "https://image.mux.com",
+        ],
         "font-src": ["self", "data:"],
         "frame-ancestors": ["none"],
         "object-src": ["none"],