NDK unsafe-eval

[huumn]

I'm seeing this in my logs as my zaps fail:

logger.js:32 [nwc] ↗ payment sent: 100 sats
bake-collection.js:65 Uncaught (in promise) EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' a.stacker.news 'unsafe-inline' 'wasm-unsafe-eval' 'nonce-N2NiODg0MjgtN2U0Yi00YmRlLThiZDQtMDc4NWE0YmJlMTRj' 'strict-dynamic' https:".

    at bakeCollection (bake-collection.js:65:1)
    at Object.f (task-collection.js:191:1)
    at Object.h [as call] (task-collection.js:202:1)
    at nt.s [as emit] (ee.js:22:1)
    at nt.stop (index.mjs:3286:1)
    at Object.<anonymous> (index.mjs:5979:1)
bakeCollection @ bake-collection.js:65
f @ task-collection.js:191
h @ task-collection.js:202
s @ ee.js:22
stop @ index.mjs:3286
(anonymous) @ index.mjs:5979
await in (anonymous)
s @ ee.js:22
eventReceived @ index.mjs:3368
onevent @ index.mjs:1347
onMessage @ index.mjs:641

[ekzyis]

Mhh, just tested with cashu.me in prod and it works for me:

2025-03-18.20-54-10.mp4

Couldn't test in local dev because react-refresh requires unsafe-eval and one can't disable it, see vercel/next.js#13268 🙄

And my pathetic attempts at getting a production build running have been unsuccessful so far:

patch

diff --git a/Dockerfile b/Dockerfile
index 2e7db085..74d11a68 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,4 +16,4 @@ EXPOSE 3000
 
 COPY package.json package-lock.json ./
 RUN npm ci --legacy-peer-deps --loglevel verbose
-CMD ["sh","-c","npm install --loglevel verbose --legacy-peer-deps && npx prisma migrate dev && npm run dev"]
\ No newline at end of file
+CMD ["sh","-c","npm install --loglevel verbose --legacy-peer-deps && npx prisma migrate dev && npm run build && npm start"]
\ No newline at end of file
diff --git a/middleware.js b/middleware.js
index f88bda31..0bf31410 100644
--- a/middleware.js
+++ b/middleware.js
@@ -106,7 +106,7 @@ export function middleware (request) {
     // Using nonces and strict-dynamic deploys a strict CSP.
     // see https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#strict-policy.
     // Old browsers will ignore nonce and strict-dynamic and fallback to host-based matching and unsafe-inline
-    `script-src 'self' a.stacker.news 'unsafe-inline' 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic' https:` + devScriptSrc,
+    `script-src 'self' a.stacker.news 'unsafe-inline' 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic' https:`,
     // unsafe-inline for styles is not ideal but okay if script-src is using nonces
     "style-src 'self' a.stacker.news 'unsafe-inline'",
     "manifest-src 'self'",
diff --git a/package.json b/package.json
index f4e7f2c5..49af540a 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "dev": "NODE_OPTIONS='--trace-warnings' next dev",
     "build": "next build",
     "migrate": "prisma migrate deploy",
-    "start": "NODE_OPTIONS='--trace-warnings --max-old-space-size=4096 --max-semi-space-size=128' next start -p $PORT --keepAliveTimeout 120000",
+    "start": "NODE_OPTIONS='--trace-warnings --max-old-space-size=4096 --max-semi-space-size=128' next start -p 3000 --keepAliveTimeout 120000",
     "lint": "standard",
     "test": "NODE_OPTIONS='--experimental-vm-modules' jest",
     "worker": "tsx --tsconfig jsconfig.json --trace-warnings worker/index.js",

logs

app     |    Generating static pages (0/3)  [    ]Error: NextRouter was not mounted. https://nextjs.org/docs/messages/next-router-not-mounted
app     |     at h (/app/.next/server/chunks/3330.js:1:16426)
app     |     at C (/app/.next/server/chunks/4926.js:3861:7934)
app     |     at renderWithHooks (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5658:16)
app     |     at renderIndeterminateComponent (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5732:15)
app     |     at renderElement (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5957:7)
app     |     at renderNodeDestructiveImpl (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6115:11)
app     |     at renderNodeDestructive (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6087:14)
app     |     at renderNode (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6270:12)
app     |     at renderChildrenArray (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6222:7)
app     |     at renderNodeDestructiveImpl (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6152:7)
app     |
app     | Error occurred prerendering page "/offline". Read more: https://nextjs.org/docs/messages/prerender-error
app     |
app     | Error: NextRouter was not mounted. https://nextjs.org/docs/messages/next-router-not-mounted
app     |     at h (/app/.next/server/chunks/3330.js:1:16426)
app     |     at C (/app/.next/server/chunks/4926.js:3861:7934)
app     |     at renderWithHooks (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5658:16)
app     |     at renderIndeterminateComponent (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5732:15)
app     |     at renderElement (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:5957:7)
app     |     at renderNodeDestructiveImpl (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6115:11)
app     |     at renderNodeDestructive (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6087:14)
app     |     at renderNode (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6270:12)
app     |     at renderChildrenArray (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6222:7)
app     |     at renderNodeDestructiveImpl (/app/node_modules/react-dom/cjs/react-dom-server.browser.development.js:6152:7)