Implement phase 1 completion and phase 2 dynamic QR

dist/app.js

@@ -11,7 +11,24 @@ import path from "node:path";
 import fs from "node:fs";
 const app = express();
 startNotificationOrchestrator();
-app.use(helmet());
+app.use(helmet({
+    crossOriginResourcePolicy: {
+        policy: "cross-origin"
+    },
+    contentSecurityPolicy: {
+        directives: {
+            defaultSrc: ["'self'"],
+            scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", "https://cdn.tailwindcss.com"],
+            scriptSrcAttr: ["'unsafe-inline'"],
+            styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
+            fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
+            imgSrc: ["'self'", "data:", "https://lh3.googleusercontent.com", "https://*.googleusercontent.com"],
+            connectSrc: ["'self'"],
+            objectSrc: ["'none'"],
+            baseUri: ["'self'"]
+        }
+    }
+}));
 app.use(express.json());
 app.use(morgan("dev"));
 app.use(requestContext);
@@ -35,6 +52,7 @@ app.get("/ui/hub", (_req, res) => {
     const filePath = path.resolve(process.cwd(), "ui/hub.html");
     res.sendFile(filePath);
 });
+app.use("/ui/shared", express.static(path.resolve(process.cwd(), "ui", "shared")));
 app.get("/ui/:page", (req, res, next) => {
     const filePath = resolveUiPageFile(req.params.page);
     if (!filePath) {