From 4ce8562fd885e6b5b4bdd6cd60f982387fcd29da Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Thu, 7 May 2026 21:26:35 +0800
Subject: [PATCH] fix: allow next inline scripts in csp

---
 next.config.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/next.config.ts b/next.config.ts
index b96bf8e17..7ad7b1817 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -40,8 +40,8 @@ const nextConfig: NextConfig = {
     const isDev = process.env.NODE_ENV === "development";
     const csp = [
       "default-src 'self'",
-      // Next.js 需要 unsafe-eval 用于开发模式 (Fast Refresh / Turbopack)
-      `script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`,
+      // Next.js App Router/RSC emits inline bootstrap scripts in production.
+      `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
       // Next.js 需要 unsafe-inline 用于样式 (CSS-in-JS / Tailwind)
       "style-src 'self' 'unsafe-inline'",
       "img-src 'self' data: blob: https: http:",