fix login

apps/homepage/src/proxy.ts

@@ -19,9 +19,25 @@ function applySecurityHeaders(response: NextResponse, contentSecurityPolicy: str
   return response;
 }
 
+function resolveApiOrigin(): string | undefined {
+  const origins = new Set<string>();
+  const urls = [process.env.API_INTERNAL_URL, process.env.NEXT_PUBLIC_API_URL];
+  for (const url of urls) {
+    if (!url) continue;
+    try {
+      origins.add(new URL(url).origin);
+    } catch {
+      // ignore malformed URLs
+    }
+  }
+  return origins.size > 0 ? Array.from(origins).join(' ') : undefined;
+}
+
 export function proxy(request: NextRequest): NextResponse {
   const nonce = createNonce();
-  const csp = buildContentSecurityPolicy(nonce, process.env.NODE_ENV !== 'production');
+  const isDev = process.env.NODE_ENV !== 'production';
+  const apiOrigin = resolveApiOrigin();
+  const csp = buildContentSecurityPolicy(nonce, isDev, apiOrigin);
   const requestHeaders = new Headers(request.headers);
   requestHeaders.set('x-nonce', nonce);
   requestHeaders.set('Content-Security-Policy', csp);