next.config.ts

import type { NextConfig } from "next";
import { withSentryConfig } from "@sentry/nextjs";

function getSupabaseRealtimeOrigin() {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;

  if (!supabaseUrl) {
    return "wss://*.supabase.co";
  }

  try {
    const url = new URL(supabaseUrl);
    const protocol = url.protocol === "http:" ? "ws:" : "wss:";

    return `${protocol}//${url.host}`;
  } catch {
    return "wss://*.supabase.co";
  }
}

const supabaseRealtimeOrigin = getSupabaseRealtimeOrigin();

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [
          {
            key: "Content-Security-Policy",
            value: `default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https: ${supabaseRealtimeOrigin}; frame-ancestors 'none';`,
          },
          {
            key: "X-Frame-Options",
            value: "DENY",
          },
          {
            key: "X-Content-Type-Options",
            value: "nosniff",
          },
          {
            key: "Referrer-Policy",
            value: "strict-origin-when-cross-origin",
          },
          {
            key: "Strict-Transport-Security",
            value: "max-age=31536000; includeSubDomains",
          },
        ],
      },
    ];
  },
};

const sentryConfig = {
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_PROJECT,
  widenClientFileUpload: true,
  hideSourceMaps: true,
  disableLogger: true,
  silent: !process.env.CI,
};

export default process.env.SENTRY_DSN
  ? withSentryConfig(nextConfig, sentryConfig)
  : nextConfig;