security(csp): migrate script-src from 'unsafe-inline' to per-request nonce

[BigSimmo]

What

Migrates the production Content-Security-Policy script-src from 'unsafe-inline' to a per-request nonce + 'strict-dynamic' policy. Every other CSP directive and every other security header is preserved exactly.

Closes the L19 deferral in docs/process-hardening.md ("CSP script-src 'unsafe-inline' deferred; nonce migration needs dedicated UI verification").

How it works (Next 16 App Router)

• src/proxy.ts generates a fresh base64 nonce per request, threads it into the SSR request via the x-nonce header and the CSP request header (Next parses the latter to stamp its own scripts), and sets the enforced Content-Security-Policy on every response. CSP moved here because a nonce cannot be a build-time constant.
• next.config.ts / buildSecurityHeaders still emits all the other security headers statically for every route (including static assets); Content-Security-Policy was removed from that set so there is exactly one CSP header per response (two would be enforced as their intersection and break the app).
• src/app/layout.tsx reads x-nonce and stamps the one hand-authored inline script — the theme-flash guard — which Next does not auto-nonce. Reading headers() opts the app into dynamic rendering (inherent to per-request nonces; generateStaticParams pages are now ƒ dynamic, build stays green). suppressHydrationWarning is added because Next strips the nonce from the client payload.

Which inline scripts were nonce-tagged

• Hand-authored: the theme-flash-prevention <script> in src/app/layout.tsx — verified in prod HTML that its nonce attribute equals the CSP header nonce.
• Framework (auto): Next's bootstrap, per-page bundle, RSC flight-data, and useReportWebVitals inline scripts are nonced automatically by Next once the nonce is present in the request CSP header. Confirmed loading cleanly under 'strict-dynamic' in a production server.
• There are no other hand-authored inline scripts, next/script components, or JSON-LD blocks in the app (grep-verified).

Development exception

Dev keeps the pre-migration script-src 'self' 'unsafe-inline' 'unsafe-eval' (no 'strict-dynamic'). The Turbopack dev server injects non-nonced HMR/route-chunk <script src> tags, and 'strict-dynamic' disables the 'self' allow-list, so it would blank the dev app. Dev is not the shipped security boundary (it already relaxes with 'unsafe-eval').

Zod JIT eval probe

The strict prod CSP surfaced a pre-existing, benign violation (already blocked under the old prod policy, which also lacked 'unsafe-eval'): Zod 4's JIT compiler probes for eval with new Function("") inside a swallowed try/catch, which the browser still reports as a securitypolicyviolation. Silenced by setting Zod jitless: true on the client in src/instrumentation-client.ts (runs before hydration; server keeps fast JIT — no CSP there). This is Zod's documented remedy for strict CSPs.

Verification (clean console across smoke flows)

• npm run build — green; nonce forces dynamic rendering, no build errors.
• npm run verify:ui (full Chromium) — 120 passed, 0 failed.
• Scripted production server (next start, live env) console sweep of answer render (/, /?mode=answer), search (/documents/search), document viewer (/documents/source), medications/differentials/favourites, and an auth interaction → zero securitypolicyviolation; confirmed served script-src is 'self' 'nonce-…' 'strict-dynamic' with no 'unsafe-inline'/'unsafe-eval' and the theme-script nonce matches the header.
• Unit: tests/security-headers.test.ts updated for the dev/prod split (17 passed).

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

Follow-up: added tests/proxy.test.ts to close the CI coverage gap. verify:ui only exercises the dev CSP path (Turbopack keeps 'unsafe-inline'), so the strict shipped policy previously had no automated coverage. The proxy unit tests run under NODE_ENV=test — which takes the production branch of buildContentSecurityPolicy — and assert the response CSP is 'self' 'nonce-<per-request>' 'strict-dynamic' (no 'unsafe-inline'/'unsafe-eval'), every other directive is unchanged, the nonce is fresh per request, and the same nonce is threaded into the SSR x-nonce request header. Now runs in npm run test / verify:cheap.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.