---
whitelist:
  script-src-elem:
    - "{{ lookup('asset_host') }}"
    - https://kit.fontawesome.com # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
    - https://code.jquery.com/ # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  style-src-elem:
    - https://kit.fontawesome.com # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
    - https://code.jquery.com/ # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  font-src:
    - https://ka-f.fontawesome.com # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
  connect-src:
    - https://ka-f.fontawesome.com # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
    - "{{ lookup('domain', 'web-app-keycloak') }}"
  frame-src:
    - "*.{{ DOMAIN_PRIMARY }}"
flags:
  script-src:
    unsafe-inline: false
  script-src-elem:
    unsafe-inline: false
  script-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: port-ui 2.2.2 renders inline event handlers (menu onclick entries, openDynamicPopup, closeAllModals, card image onerror)