diff --git a/next.config.js b/next.config.js index 194f076093..ed97822526 100644 --- a/next.config.js +++ b/next.config.js @@ -175,8 +175,9 @@ function contentSecurityPolicyReportOnly() { // Widget in Global/Layout renders. Currently unreachable (its Modal is // never opened), so it produces no violations today; allow-listed because // re-arming it is a one-line change and the failure would be a blank - // iframe under enforcement. - "frame-src 'self' https://*.crisp.chat https://*.sumsub.com https://widget.manteca.dev https://mpago.la https://*.bridge.xyz https://form.typeform.com", + // iframe under enforcement. The creator contest stays on its own Vercel + // project and is framed by /creator-contest. + "frame-src 'self' https://*.crisp.chat https://*.sumsub.com https://widget.manteca.dev https://mpago.la https://*.bridge.xyz https://form.typeform.com https://peanut-contest.vercel.app", "worker-src 'self' blob:", "object-src 'none'", "base-uri 'self'", diff --git a/src/app/creator-contest/__tests__/page.test.tsx b/src/app/creator-contest/__tests__/page.test.tsx new file mode 100644 index 0000000000..18f3376983 --- /dev/null +++ b/src/app/creator-contest/__tests__/page.test.tsx @@ -0,0 +1,17 @@ +import { render, screen } from '@testing-library/react' +import CreatorContestPage from '../page' + +describe('CreatorContestPage', () => { + it('embeds the contest with the required iframe permissions', () => { + render() + + const iframe = screen.getByTitle('Peanut Creator Contest') + expect(iframe).toHaveAttribute('src', 'https://peanut-contest.vercel.app/') + expect(iframe).toHaveAttribute('allow', 'storage-access *') + expect(iframe).toHaveAttribute( + 'sandbox', + 'allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-storage-access-by-user-activation' + ) + expect(iframe).toHaveAttribute('referrerpolicy', 'strict-origin-when-cross-origin') + }) +}) diff --git a/src/app/creator-contest/page.tsx b/src/app/creator-contest/page.tsx new file mode 100644 index 0000000000..5a0b5841e7 --- /dev/null +++ b/src/app/creator-contest/page.tsx @@ -0,0 +1,22 @@ +import { type Metadata } from 'next' + +export const metadata: Metadata = { + title: 'Peanut Creator Contest', + description: 'The Peanut content contest for creators in Brazil.', + robots: { index: false, follow: false }, +} + +export default function CreatorContestPage() { + return ( +
+