From ea93075bd528c568af1ce27b854d292e265d813c Mon Sep 17 00:00:00 2001
From: Rotimi Best <best@classroomio.com>
Date: Thu, 4 Dec 2025 00:10:15 +0100
Subject: [PATCH] fix: update content security policy to allow YouTube and
 refine source origins

---
 apps/dashboard/svelte.config.js | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/apps/dashboard/svelte.config.js b/apps/dashboard/svelte.config.js
index f36452fc..5ce0d157 100644
--- a/apps/dashboard/svelte.config.js
+++ b/apps/dashboard/svelte.config.js
@@ -27,7 +27,9 @@ const config = {
           'https://assets.cdn.clsrio.com',
           'https://cdnjs.cloudflare.com',
           'https://*.i.posthog.com',
-          'https://*.senja.io'
+          'https://*.senja.io',
+          'https://www.youtube.com',
+          'https://youtube.com'
         ],
         'style-src': [
           'self',
@@ -50,8 +52,7 @@ const config = {
         'connect-src': [
           'self',
           'https://*.supabase.co',
-          'https://pgrest.classroomio.com',
-          'https://api.classroomio.com',
+          'https://*.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://*.i.posthog.com',
@@ -63,6 +64,7 @@ const config = {
           'wss://*.supabase.co',
           'https://*.senja.io'
         ],
+        'worker-src': ['self', 'blob:'],
         'object-src': ['none'],
         'base-uri': ['self'],
         'form-action': ['self'],
@@ -76,7 +78,9 @@ const config = {
           'https://assets.cdn.clsrio.com',
           'https://cdnjs.cloudflare.com',
           'https://*.i.posthog.com',
-          'https://*.senja.io'
+          'https://*.senja.io',
+          'https://www.youtube.com',
+          'https://youtube.com'
         ],
         'style-src': [
           'self',
@@ -108,10 +112,11 @@ const config = {
           'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
-          'wss://*.supabase.co',
           'wss://*.classroomio.com',
+          'wss://*.supabase.co',
           'https://*.senja.io'
         ],
+        'worker-src': ['self', 'blob:'],
         'object-src': ['none'],
         'base-uri': ['self'],
         'form-action': ['self'],