/**
 * Configuración de Content Security Policy
 * Permite recursos externos necesarios para la página de bienvenida
 */

const helmetCSP = {
  directives: {
    defaultSrc: ["'self'"],
    styleSrc: [
      "'self'",
      "'unsafe-inline'",
      "https://fonts.googleapis.com",
      "https://cdnjs.cloudflare.com"
    ],
    fontSrc: [
      "'self'",
      "https://fonts.gstatic.com",
      "https://cdnjs.cloudflare.com"
    ],
    scriptSrc: [
      "'self'",
      "'unsafe-inline'",
      "https://cdnjs.cloudflare.com"
    ],
    imgSrc: [
      "'self'",
      "data:",
      "https:",
      "http:"
    ],
    connectSrc: [
      "'self'"
    ],
    frameSrc: ["'none'"],
    objectSrc: ["'none'"],
    upgradeInsecureRequests: []
  }
};

module.exports = helmetCSP;