From c4febaf1daf0b6f95f72b21e5bf2fb45e8ce9e49 Mon Sep 17 00:00:00 2001
From: esgn <5435148+esgn@users.noreply.github.com>
Date: Thu, 6 Aug 2026 18:51:03 +0200
Subject: [PATCH] refactor: update allowed data domains in CSP configuration

---
 server.ts             | 12 ++++++++++--
 tests/mcp-app.test.ts | 11 +++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/server.ts b/server.ts
index fc241bb..35ef17e 100644
--- a/server.ts
+++ b/server.ts
@@ -20,11 +20,19 @@ const DIST_DIR = import.meta.filename.endsWith(".ts")
 
 const resourceUri = "ui://mcp-carto/mcp-app.html";
 
+const allowedDataDomains = [
+  "https://data.geopf.fr",
+  "https://demo-geocontext.mut-dev.ign.fr",
+  "https://qlf-geollm.beta.ign.fr",
+  "https://geollm.beta.ign.fr",
+  "http://localhost:3002",
+];
+
 const cspMeta = {
   ui: {
     csp: {
-      connectDomains: ["https://data.geopf.fr"],
-      resourceDomains: ["https://data.geopf.fr"],
+      connectDomains: allowedDataDomains,
+      resourceDomains: allowedDataDomains,
     },
   },
 };
diff --git a/tests/mcp-app.test.ts b/tests/mcp-app.test.ts
index 7ff4844..b1e3502 100644
--- a/tests/mcp-app.test.ts
+++ b/tests/mcp-app.test.ts
@@ -54,8 +54,15 @@ test("MCP app exposes its UI resource and map tool", async (t) => {
   assertRecord(content._meta);
   assertRecord(content._meta.ui);
   assertRecord(content._meta.ui.csp);
-  assert.deepEqual(content._meta.ui.csp.connectDomains, ["https://data.geopf.fr"]);
-  assert.deepEqual(content._meta.ui.csp.resourceDomains, ["https://data.geopf.fr"]);
+  const expectedCspDomains = [
+    "https://data.geopf.fr",
+    "https://demo-geocontext.mut-dev.ign.fr",
+    "https://qlf-geollm.beta.ign.fr",
+    "https://geollm.beta.ign.fr",
+    "http://localhost:3002",
+  ];
+  assert.deepEqual(content._meta.ui.csp.connectDomains, expectedCspDomains);
+  assert.deepEqual(content._meta.ui.csp.resourceDomains, expectedCspDomains);
 
   const tools = await client.listTools();
   const mapTool = tools.tools.find(({ name }) => name === TOOL_NAME);