firebase.json

{
  "firestore": {
    "rules": "firebase/admin/firestore.rules",
    "indexes": "firebase/admin/firestore.indexes.json"
  },
  "hosting": [
    {
      "public": "dist",
      "target": "staging",
      "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
      "rewrites": [
        {
          "source": "**",
          "destination": "/index.html",
          "headers": [
            {
              "key": "Cross-Origin-Opener-Policy",
              "value": "same-origin-allow-popups"
            }
          ]
        }
      ],
      "headers": [
        {
          "source": "**",
          "headers": [
            {
              "key": "Content-Security-Policy-Report-Only",
              "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://googletagmanager.com https://tagmanager.google.com https://*.googleapis.com https://apis.google.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://browser.sentry-cdn.com https://js.sentry-cdn.com blob:; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline' https://googletagmanager.com https://tagmanager.google.com https://fonts.googleapis.com; img-src 'self' data: https://storage.googleapis.com/roam-apps/ https://*.googletagmanager.com https://googletagmanager.com https://ssl.gstatic.com https://www.gstatic.com https://*.google-analytics.com; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://firestore.googleapis.com https://identitytoolkit.googleapis.com https://raw.githubusercontent.com/yeatmanlab/ https://us-central1-gse-roar-admin-dev.cloudfunctions.net https://*.googleapis.com https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.sentry.io; frame-src 'self' https://roar.education https://gse-roar-admin-dev.firebaseapp.com/ https://gse-roar-assessment-dev.firebaseapp.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; frame-ancestors 'none'; report-uri https://o4505913837420544.ingest.us.sentry.io/api/4506820782129152/security/?sentry_key=f15e3ff866394e93e00514b42113d03d&sentry_environment=staging; report-to csp-endpoint"
            },
            {
              "key": "Report-To",
              "value": "{\"group\"\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"https://o4505913837420544.ingest.us.sentry.io/api/4506820782129152/security/?sentry_key=f15e3ff866394e93e00514b42113d03d&sentry_environment=staging\"}],\"include_subdomains\":true}"
            },
            {
              "key": "Cross-Origin-Opener-Policy",
              "value": "same-origin-allow-popups"
            },
            {
              "key": "X-Content-Type-Options",
              "value": "nosniff"
            },
            {
              "key": "Referrer-Policy",
              "value": "no-referrer"
            },
            {
              "key": "Strict-Transport-Security",
              "value": "max-age=63072000; includeSubDomains; preload"
            }
          ]
        }
      ]
    },
    {
      "public": "dist",
      "target": "production",
      "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
      "rewrites": [
        {
          "source": "**",
          "destination": "/index.html",
          "headers": [
            {
              "key": "Cross-Origin-Opener-Policy",
              "value": "same-origin-allow-popups"
            }
          ]
        }
      ],
      "headers": [
        {
          "source": "**",
          "headers": [
            {
              "key": "Content-Security-Policy-Report-Only",
              "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://googletagmanager.com https://tagmanager.google.com https://*.googleapis.com https://apis.google.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://browser.sentry-cdn.com https://js.sentry-cdn.com blob:; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline' https://googletagmanager.com https://tagmanager.google.com https://fonts.googleapis.com; img-src 'self' data: https://storage.googleapis.com/roam-apps/ https://*.googletagmanager.com https://googletagmanager.com https://ssl.gstatic.com https://www.gstatic.com https://*.google-analytics.com; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://firestore.googleapis.com https://identitytoolkit.googleapis.com https://raw.githubusercontent.com/yeatmanlab/ https://us-central1-gse-roar-admin.cloudfunctions.net https://*.googleapis.com https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.sentry.io; frame-src 'self' https://roar.education https://gse-roar-admin.firebaseapp.com/ https://gse-roar-assessment.firebaseapp.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; frame-ancestors 'none'; report-uri https://o4505913837420544.ingest.us.sentry.io/api/4506820782129152/security/?sentry_key=f15e3ff866394e93e00514b42113d03d&sentry_environment=production; report-to csp-endpoint"
            },
            {
              "key": "Report-To",
              "value": "{\"group\"\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"https://o4505913837420544.ingest.us.sentry.io/api/4506820782129152/security/?sentry_key=f15e3ff866394e93e00514b42113d03d&sentry_environment=production\"}],\"include_subdomains\":true}"
            },
            {
              "key": "Cross-Origin-Opener-Policy",
              "value": "same-origin-allow-popups"
            },
            {
              "key": "X-Content-Type-Options",
              "value": "nosniff"
            },
            {
              "key": "Referrer-Policy",
              "value": "no-referrer"
            },
            {
              "key": "Strict-Transport-Security",
              "value": "max-age=63072000; includeSubDomains; preload"
            }
          ]
        }
      ]
    }
  ]
}