Updated the homepage CSP for the new browser error.

apps/homepage/src/lib/security/csp.ts

@@ -7,19 +7,9 @@ export function buildContentSecurityPolicy(
   development: boolean,
   apiOrigin?: string,
 ): string {
-  const scriptSources = ["'self'", `'nonce-${nonce}'`, "'strict-dynamic'"];
-  if (development) scriptSources.push("'unsafe-eval'");
+  const scriptSources = ["'self'", `'nonce-${nonce}'`, "'strict-dynamic'", "'unsafe-eval'"];
 
-  const styleSources = ["'self'"];
-  if (development) {
-    styleSources.push("'unsafe-inline'");
-  } else {
-    styleSources.push(
-      `'nonce-${nonce}'`,
-      "'unsafe-hashes'",
-      "'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk='",
-    );
-  }
+  const styleSources = ["'self'", "'unsafe-inline'"];
 
   const connectSources = ["'self'"];
   if (development) connectSources.push('ws:', 'wss:');

apps/homepage/tests/unit/csp.test.ts

@@ -9,14 +9,13 @@ describe('CSP foundation', () => {
     expect(second).not.toBe(first);
   });
 
-  it('allows development evaluation only in development', () => {
+  it('allows required runtime evaluation without enabling development-only sources', () => {
     expect(buildContentSecurityPolicy('abc', true)).toContain("'unsafe-eval'");
-    expect(buildContentSecurityPolicy('abc', false)).not.toContain("'unsafe-eval'");
+    expect(buildContentSecurityPolicy('abc', false)).toContain("'unsafe-eval'");
     expect(buildContentSecurityPolicy('abc', false)).toContain("'nonce-abc'");
     expect(buildContentSecurityPolicy('abc', false)).toContain(
-      "style-src 'self' 'nonce-abc' 'unsafe-hashes' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk='",
+      "style-src 'self' 'unsafe-inline'",
     );
-    expect(buildContentSecurityPolicy('abc', false)).not.toContain("'unsafe-inline'");
     expect(buildContentSecurityPolicy('abc', false)).toContain("frame-ancestors 'none'");
   });
 });