LibreChat-AI
diff --git a/‎bun.lock‎
Lines changed: 25 additions & 12 deletions b/‎bun.lock‎
Lines changed: 25 additions & 12 deletions
diff --git a/‎e2e/grants.spec.ts‎
Lines changed: 2 additions & 2 deletions b/‎e2e/grants.spec.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎package.json‎
Lines changed: 3 additions & 2 deletions b/‎package.json‎
Lines changed: 3 additions & 2 deletions
diff --git a/‎server.ts‎
Lines changed: 43 additions & 5 deletions b/‎server.ts‎
Lines changed: 43 additions & 5 deletions
@@ -148,7 +148,7 @@ test.describe('Grants page - Audit Log tab', () => {
   });
 
   test('export button is present', async ({ page }) => {
-    const exportBtn = page.getByRole('button', { name: /export as csv/i });
+    const exportBtn = page.getByRole('button', { name: /export all matching/i });
     await expect(exportBtn).toBeVisible();
   });
 
@@ -180,7 +180,7 @@ test.describe('Grants page - Tab switching', () => {
     await page.waitForTimeout(300);
 
     await expect(page).toHaveURL(/tab=audit-log/);
-    await expect(page.getByRole('button', { name: /export as csv/i })).toBeVisible();
+    await expect(page.getByRole('button', { name: /export all matching/i })).toBeVisible();
 
     const mgmtTab = page.getByRole('tab', { name: /management/i });
     await mgmtTab.click();
 
@@ -22,7 +22,8 @@
   },
   "dependencies": {
     "@clickhouse/click-ui": "0.2.0-rc.4",
-    "@librechat/data-schemas": "^0.0.53",
+    "@librechat/data-schemas": "^0.0.54",
+    "@radix-ui/react-dialog": "1.1.15",
     "@tailwindcss/vite": "^4.1.18",
     "@tanstack/react-devtools": "0.10.0",
     "@tanstack/react-query": "5.95.2",
@@ -41,7 +42,7 @@
     "i18next-browser-languagedetector": "^8.2.1",
     "input-otp": "^1.4.2",
     "js-yaml": "^4.1.1",
-    "librechat-data-provider": "^0.8.505",
+    "librechat-data-provider": "^0.8.507",
     "lucide-react": "^0.545.0",
     "prom-client": "^15.1.3",
     "react": "^19.2.0",
 
@@ -41,6 +41,43 @@ function getCacheHeaders(filePath: string): Record<string, string> {
   return {};
 }
 
+// 'unsafe-inline' in style-src is required because Tailwind 4 + click-ui inject inline styles at runtime.
+// TanStack Start's SSR injects an inline `<script type="module">import("/_build/...")</script>` to
+// boot the client. Without a nonce or 'unsafe-inline' for script-src, browsers will block hydration.
+// Threading a per-request nonce through TanStack Start's manifest is non-trivial; until that wiring
+// lands we ship the policy as report-only so it surfaces violations in dev tooling without breaking
+// hydration in prod. Set ADMIN_PANEL_CSP_ENFORCE=true to switch back to enforcement (only safe once
+// the nonce path is in place).
+const CSP_VALUE = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob:",
+  "font-src 'self' data:",
+  "connect-src 'self'",
+  "object-src 'none'",
+  "frame-ancestors 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+].join('; ');
+
+const CSP_ENFORCE = process.env.ADMIN_PANEL_CSP_ENFORCE === 'true';
+const CSP_HEADER_NAME = CSP_ENFORCE
+  ? 'Content-Security-Policy'
+  : 'Content-Security-Policy-Report-Only';
+
+function applySecurityHeaders(headers: Headers): void {
+  const contentType = headers.get('Content-Type') ?? '';
+  if (!contentType.toLowerCase().startsWith('text/html')) return;
+  headers.set(CSP_HEADER_NAME, CSP_VALUE);
+  headers.set('X-Content-Type-Options', 'nosniff');
+  headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  headers.set('X-Frame-Options', 'DENY');
+  if (process.env.NODE_ENV === 'production') {
+    headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+  }
+}
+
 type Handler = { default: { fetch: (req: Request) => Promise<Response> } };
 
 const { default: handler } = (await import(SERVER_ENTRY.href)) as Handler;
@@ -66,11 +103,11 @@ async function buildStaticRoutes(): Promise<Record<string, (req: Request) => Pro
     const cache = getCacheHeaders(path);
     const routePath = `${BASE_PATH}/${path}`;
     routes[routePath] = (req) =>
-      withHttpMetrics(
-        req,
-        routePath,
-        () => new Response(file, { headers: { 'Content-Type': file.type, ...cache } }),
-      );
+      withHttpMetrics(req, routePath, () => {
+        const res = new Response(file, { headers: { 'Content-Type': file.type, ...cache } });
+        applySecurityHeaders(res.headers);
+        return res;
+      });
   }
   return routes;
 }
@@ -92,6 +129,7 @@ const server = Bun.serve({
       for (const [k, v] of Object.entries(NO_CACHE)) {
         patched.headers.set(k, v);
       }
+      applySecurityHeaders(patched.headers);
       return patched;
     },
   },