redesign the homepage

apps/homepage/src/lib/security/content-type.ts

@@ -0,0 +1,9 @@
+/**
+ * Accept JSON requests with optional media-type parameters while rejecting
+ * look-alike types such as application/jsonp or application/json-patch+json.
+ */
+export function isApplicationJson(contentType: string | null): boolean {
+  if (!contentType) return false;
+  const [mediaType] = contentType.split(';', 1);
+  return mediaType?.trim().toLowerCase() === 'application/json';
+}

apps/homepage/src/lib/security/csp.ts

@@ -0,0 +1,25 @@
+export function createNonce(): string {
+  return crypto.randomUUID().replaceAll('-', '');
+}
+
+export function buildContentSecurityPolicy(nonce: string, development: boolean): string {
+  const scriptSources = ["'self'", `'nonce-${nonce}'`, "'strict-dynamic'"];
+  if (development) scriptSources.push("'unsafe-eval'");
+
+  const directives = [
+    "default-src 'self'",
+    `script-src ${scriptSources.join(' ')}`,
+    `style-src 'self'${development ? " 'unsafe-inline'" : ` 'nonce-${nonce}'`}`,
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    `connect-src 'self'${development ? ' ws: wss:' : ''}`,
+    "media-src 'self'",
+    "object-src 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "worker-src 'self' blob:",
+    ...(development ? [] : ['upgrade-insecure-requests']),
+  ];
+  return directives.join('; ');
+}