fix(csp): close report-only allowlist gaps for OneSignal, RPC and analytics

[innolope-dev]

Follow-up to #2462. In the first hours after that merged, the report-only policy produced ~800 violations (Sentry logger:csp). Nothing is broken today — disposition is report — but promoting this policy to enforcing as-is would break real functionality.

I audited every reported host against the code that actually originates the request.

OneSignal was missing entirely

cdn.onesignal.com (24 hits, script-src-elem) is the web SDK loader, and api.onesignal.com was blocked under both script-src-elem (12) and connect-src (6). Enforcing would have stopped the SDK from loading at all and taken web push with it. Added the two hosts explicitly to script-src (kept tight, since that's the XSS-relevant directive) and https://*.onesignal.com to connect-src.

Chain RPC endpoints — both sources, not just the reported ones

The reported RPC hosts (~780 of the 800 violations) are only half the story. There are two independent sources and both need allowlisting:

1. rpcUrls in src/constants/general.consts.ts — the curated per-chain list our own viem clients use.
2. viem's per-chain defaults — wagmi's transports are bare http() with no URL, so external-wallet flows fall back to viem's built-in RPC per chain.

Source 2 hadn't shown up in the reports yet (those flows are rarer), so allowlisting only what was reported would have meant a second round of violations. I enumerated both, which is why the list includes hosts like eth.merkle.io and rpc.gnosischain.com that aren't in the Sentry data.

Provider-level wildcards (*.core.chainstack.com, *.publicnode.com, *.arbitrum.io, *.drpc.org) because each provider serves one subdomain per network; single-host providers are listed exactly. Noted in the "known-loose parts" comment as something to revisit before promotion.

The list is a hand-kept mirror — next.config.js is CommonJS and general.consts.ts is TS, so neither source is importable here. There's a comment on the constant saying to re-check it when either source gains a chain.

Analytics

analytics.google.com (50), region1.analytics.google.com (29), stats.g.doubleclick.net (16), www.google.com (15). These are GA4's region-specific beacon and GTM's audience/conversion pings — the marketing analytics stack depends on them, so they're allowlisted to keep reporting intact once the policy is enforcing.

Remaining app traffic

ipapi.co (useGeoLocation), api.justaname.id (JustaName ENS provider), and storage.crisp.chat — the last via widening client.crisp.chat to *.crisp.chat, since Crisp serves assets from several subdomains.

Verification

• Rendered the resulting policy and asserted all 16 reported hosts are covered (accounting for wildcard matching)
• next.config.js loads, eslint clean, prettier reports unchanged
• Still report-only. Promotion to enforcing should wait until the violation stream is quiet, and is its own PR.

Summary by CodeRabbit

• Security & Compatibility
  • Updated content security policies to support additional blockchain RPC providers and external service endpoints.
  • Expanded analytics, location, naming, support chat, and notification service connectivity.
  • Added support for required OneSignal scripts and broader provider domains.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview, Comment	Jul 22, 2026 7:28pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The Next.js report-only CSP configuration centralizes chain RPC hosts and expands script-src and connect-src allowlists for Onesignal, analytics, API, Crisp, and RPC endpoints.

Changes

CSP allowlist expansion

Layer / File(s)	Summary
Centralized chain RPC allowlist next.config.js	Defines reusable chain RPC provider host patterns, including wildcard subdomains.
Expanded CSP directives next.config.js	Adds Onesignal script and connection endpoints, analytics and API hosts, wildcard Crisp coverage, and the centralized RPC hosts to connect-src.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• peanutprotocol/peanut-ui#2462: Modifies the same CSP generation logic and expands script-src/connect-src directives.

Suggested reviewers: hugo0

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main CSP report-only allowlist expansion for OneSignal, RPC, and analytics.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/csp-allowlist-gaps

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code-analysis diff

Painscore total: 6247.08 → 6247.08 (0)
Findings: 0 net (+0 new, -0 resolved)

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 2062 ran, 0 failed, 0 skipped, 32.7s

📊 Coverage (unit)

metric	%
statements	60.1%
branches	43.9%
functions	49.0%
lines	60.5%

⏱ 10 slowest test cases

time	test
3.5s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.1s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.4s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.2s	src/app/actions/__tests__/api-headers.test.ts › should include Content-Type in validateInviteCode
0.2s	src/app/actions/__tests__/api-headers-extended.test.ts › should not include apiKey in validateInviteCode body
0.2s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › keeps stickers off the username pill (final pass respects the keep-out)
0.2s	src/utils/__tests__/demo-balance.test.ts › starts at the full balance on a fresh install and stamps a timestamp
0.2s	src/utils/__tests__/demo-balance.test.ts › resetDemoBalance refills and restarts the TTL window
0.1s	src/components/Global/GeneralRecipientInput/__tests__/GeneralRecipientInput.test.tsx › should handle valid 9-digit US account

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

[kushagrasarathe]

Reviewed — SAFE. Approving.

CSP allowlist gaps closed for legitimate OneSignal / Google Analytics origins, still in report-only mode — no enforcement change, no unsafe-* widening. Low risk.

No blocking issues.