feat(security): HTTP security headers and a nonce-based CSP (F9)

[chriskehayias]

Closes F9 of the 2026-09-12 auth review — "No HTTP security headers". next.config.ts was empty: no CSP, no anti-framing header, no HSTS, no Referrer-Policy.

What lands

	next.config.ts	src/proxy.ts
What	X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS (prod only)	Content-Security-Policy
Why there	request-independent	carries a per-request nonce, which a build-time value cannot
Reaches	every response, /api and static assets included	the paths the proxy matcher covers

Both read from the new src/lib/security-headers.ts. Anti-framing is expressed twice on purpose — X-Frame-Options reaches the routes the proxy skips, frame-ancestors covers the rest. Deliberately not two CSP headers: those are enforced as an intersection, which is miserable to debug.

The CSP ships report-only

CSP_ENFORCE=true flips it, and only that exact string does, so a typo can't take a deploy down. A nonce CSP is the one security header that can white-screen an app, and the browser walk that should precede enforcement hasn't happened yet — sign-out is the step I'd watch, for the form-action reason below.

Three deliberate loosenings

Documented in .claude/references/security-headers.md so nobody "tightens" them back into an outage:

• style-src-attr 'unsafe-inline' — Radix and vaul position every popover, dialog, select and drawer with inline style attributes, which a nonce cannot cover.
• form-action includes the MP origin — sign-out is a form-driven server action ending in a redirect to MP's endsession endpoint, and browsers apply form-action to the whole redirect chain, not just its first hop.
• img-src includes the MP file origin — contact photos are next/image with unoptimized, so the browser fetches them straight from MP.

Why /signin moved

Nonces force dynamic rendering: a prerendered page has no request, so no nonce, so under enforcement its bootstrap script is blocked and it never hydrates. /signin does nothing but run client-side effects, so an unhydrated one is a permanent spinner that never reaches Ministry Platform.

The catch is that route segment config is ignored in a "use client" module — export const dynamic sat inert in the old page and the build output still read ○ /signin. So the page body moved to src/components/sign-in/, leaving the route file a server component that can actually opt out. /session-error needed only the export.

All 22 existing /signin tests pass unchanged through the wrapper. New tests pin both the export and the absence of "use client", since either one silently reverts the fix.

Verification

Against a real next start, not only unit tests:

content-security-policy-report-only: default-src 'self'; script-src 'self'
  'nonce-hoT5ClT7r18BIpStZfCD8A==' 'strict-dynamic'; style-src 'self' 'nonce-…';
  style-src-attr 'unsafe-inline'; img-src 'self' data: blob: https://files.example.com;
  font-src 'self'; connect-src 'self'; object-src 'none'; frame-src 'none';
  base-uri 'self'; form-action 'self' https://mp.example.com;
  frame-ancestors 'none'; upgrade-insecure-requests

14 script tags carried the nonce, 0 without.

• 974 tests / 56 files passing; coverage gates met, src/proxy.ts still at its required 100%
• Lint (including the new no-console rule), tsc --noEmit, and the production build all clean
• Rebased onto main after fix(logging): remove PII/pastoral-note debug logging from src (F5) #84 (F5) and fix(contact-logs): make Made_By and Contact_ID server-authoritative (F4) #85 (F4); the F5 log removals are carried into the moved sign-in component

Known gap

/_not-found is still prerendered. It's Next's built-in 404 — it renders its HTML and has no interactivity to lose, so it's accepted rather than papered over with a custom page nobody asked for. Noted in the reference doc.

Follow-up (not in this PR)

The browser walk, then CSP_ENFORCE=true.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!