fix: apply CSP nonce to Next scripts

2026-09-17 22:51:23 +12:00
parent 91a950a3b0
commit a6a4a9aa24
4 changed files with 9 additions and 4 deletions
@@ -1,5 +1,3 @@
-@import url('https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;600&display=swap');
-
 * {
  box-sizing: border-box;
  margin: 0;
@@ -13,8 +13,13 @@ import ApplicationChrome from "./ui/ApplicationChrome";
 export const metadata = {
  title: "Magent",
  description: "Request timeline and AI triage for media requests",
+  icons: { icon: "/api/branding/favicon.ico" },
 };

+// A request-specific CSP nonce is generated in proxy.ts. Dynamic rendering lets
+// Next.js apply that nonce to its framework and hydration scripts.
+export const dynamic = "force-dynamic";
+
 export default function RootLayout({ children }: { children: ReactNode }) {
  return (
    <html lang="en" data-theme="dark">
@@ -1,5 +1,3 @@
-@import url('https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;600;700&family=Inter:wght@400;500;600&family=JetBrains+Mono:wght@400;500;600;700&display=swap');
-
 /* Stitch production handoff: Media-Ops master system */
 * {
  letter-spacing: 0 !important;