next.config.js

const createNextIntlPlugin = require('next-intl/plugin');

// Wire next-intl's server request config (./i18n/request.ts). This MUST be set
// up or every page throws "Couldn't find next-intl config file" at runtime —
// NextIntlClientProvider in the root layout loads it on each render. (The build
// doesn't render the dynamic pages, so a missing config only surfaces when the
// server actually serves a page, e.g. in Docker.)
const withNextIntl = createNextIntlPlugin('./i18n/request.ts');

/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  poweredByHeader: false,
  // Keep node-only drivers external so Next doesn't bundle their optionals.
  experimental: {
    serverComponentsExternalPackages: ['pg', 'imapflow', 'mailparser', 'nodemailer', 'html-to-text', 'officeparser'],
  },
  async headers() {
    // Content-Security-Policy. img-src allows data:/blob: so KB diagrams (rendered
    // as <img src="data:image/svg+xml,…">) and previews work; object-src 'none' plus
    // base-uri/frame-ancestors lock down injection/clickjacking. 'unsafe-inline' is
    // kept for Next's inline bootstrap/styles and Google Fonts; 'unsafe-eval' is
    // dev-only (HMR). Defense-in-depth — uploaded SVG/HTML is already neutralized at
    // the serve layer (forced download + sandbox) and diagrams via the <img> data URI.
    const dev = process.env.NODE_ENV !== 'production';
    const csp = [
      "default-src 'self'",
      "base-uri 'self'",
      "object-src 'none'",
      "frame-ancestors 'none'",
      "form-action 'self'",
      "img-src 'self' data: blob:",
      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
      "font-src 'self' https://fonts.gstatic.com",
      `script-src 'self' 'unsafe-inline'${dev ? " 'unsafe-eval'" : ''}`,
      "connect-src 'self'",
    ].join('; ');
    return [
      {
        source: '/:path*',
        headers: [
          { key: 'Content-Security-Policy', value: csp },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'X-DNS-Prefetch-Control', value: 'off' },
          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
        ],
      },
    ];
  },
};

module.exports = withNextIntl(nextConfig);