fix billing and 2fa admin

config/nextSecurityHeaders.js

@@ -58,7 +58,7 @@ function collectBrowserApiSources() {
   return sources
 }
 
-function buildSecurityHeaders({ assetSources = [], connectSources = collectBrowserApiSources() } = {}) {
+function buildSecurityHeaders({ assetSources = [], connectSources = collectBrowserApiSources(), frameSources = [] } = {}) {
   const assetOrigins = collectOrigins(assetSources)
   const connectOrigins = collectOrigins(connectSources)
   const websocketOrigins = [
@@ -76,6 +76,7 @@ function buildSecurityHeaders({ assetSources = [], connectSources = collectBrows
   const imgSrc = [...new Set(["'self'", 'data:', 'blob:', 'https:', ...assetOrigins, ...connectOrigins])]
   const fontSrc = ["'self'", 'data:', ...assetOrigins]
   const connectSrc = [...new Set(["'self'", 'https:', 'wss:', ...assetOrigins, ...connectOrigins, ...websocketOrigins])]
+  const frameSrc = [...new Set(["'self'", ...frameSources])]
   if (process.env.NODE_ENV !== 'production') {
     connectSrc.push('ws:')
   }
@@ -95,6 +96,7 @@ function buildSecurityHeaders({ assetSources = [], connectSources = collectBrows
         `img-src ${imgSrc.join(' ')}`,
         `font-src ${fontSrc.join(' ')}`,
         `connect-src ${connectSrc.join(' ')}`,
+        `frame-src ${frameSrc.join(' ')}`,
         "frame-ancestors 'none'",
         "base-uri 'self'",
         "form-action 'self'",