revert(landing): drop landing-scoped CSP, put HubSpot in the shared policy

Cursor caught a fundamental problem with the landing-scoped CSP: the
Content-Security-Policy header is fixed to the document's initial HTTP
response and is NOT re-applied on Next.js client-side (soft) navigation.

Both the landing navbar's ChipLink to /login and AuthShell's Link back to
/ are soft navigations (confirmed directly in the source, not assumed).
That means:
- /login -> / (soft nav): the browser keeps /login's CSP, which never
  allowed HubSpot hosts, so the loader gets silently blocked on landing.
- / -> /login (soft nav): the browser keeps the landing CSP, which is
  MORE permissive than /login's, undoing the tightening entirely.

A per-route CSP is fundamentally incompatible with this app's
client-side-routed navigation. Greptile's original 'CSP too broad on
/workspace' concern was valid in isolation, but the fix built across the
last several rounds doesn't actually work — it's neither reliably
tighter nor reliably functional, and each round's patch (exclusion list
entries, /landing-preview handling) was really just papering over that
core issue.

Revert to a single shared CSP for the whole app, matching exactly how
GTM/GA/ahrefs are already handled in this same file: HubSpot hosts land
in STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC under the existing isHosted
gate. /workspace's CSP header technically allows origins it never
requests (same accepted tradeoff as GTM/GA), but the tracking script only
ever renders in the (landing) layout — matching the CSP scope Greptile
originally objected to. This is now provably correct because it can't
desync: proxy.ts, csp.ts, and proxy.test.ts are byte-for-byte identical
to origin/staging except for the HubSpot host list itself.

Author: waleedlatif1

apps/sim/lib/core/security/csp.ts

@@ -60,6 +60,12 @@ const STATIC_SCRIPT_SRC = [
         'https://www.googletagmanager.com',
         'https://www.google-analytics.com',
         'https://analytics.ahrefs.com',
+        // HubSpot tracking (landing pages) — loader plus the
+        // analytics/form-tracking/banner scripts it injects as <script> tags
+        'https://*.hs-scripts.com',
+        'https://*.hs-analytics.net',
+        'https://*.hscollectedforms.net',
+        'https://*.hs-banner.com',
       ]
     : []),
 ] as const
@@ -96,30 +102,14 @@ const STATIC_CONNECT_SRC = [
         'https://www.google.com',
         'https://analytics.ahrefs.com',
         'https://*.g.doubleclick.net',
-      ]
-    : []),
-] as const
-
-/**
- * HubSpot tracking sources. The loader only renders inside the (landing)
- * route group, so these are kept out of STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC
- * and merged in only by the landing-scoped CSP builders below.
- */
-const HUBSPOT_SCRIPT_SRC = [
-  ...(isHosted
-    ? [
-        'https://*.hs-scripts.com',
-        'https://*.hs-analytics.net',
+        // HubSpot tracking — form-tracking API (hscollectedforms.js) and
+        // the visitor beacon (track.hubspot.com)
         'https://*.hscollectedforms.net',
-        'https://*.hs-banner.com',
+        'https://*.hubspot.com',
       ]
     : []),
 ] as const
 
-const HUBSPOT_CONNECT_SRC = [
-  ...(isHosted ? ['https://*.hscollectedforms.net', 'https://*.hubspot.com'] : []),
-] as const
-
 const STATIC_FRAME_SRC = [
   "'self'",
   'blob:',
@@ -203,12 +193,12 @@ export function buildCSPString(directives: CSPDirectives): string {
 }
 
 /**
- * Build runtime CSP directives with dynamic environment variables.
+ * Generate runtime CSP header with dynamic environment variables.
  * Composes from the same STATIC_* constants as buildTimeCSPDirectives,
  * but resolves env vars at request time via getEnv() to fix Docker
  * deployments where build-time values may be stale placeholders.
  */
-function buildRuntimeCSPDirectives(): CSPDirectives {
+export function generateRuntimeCSP(): string {
   const appUrl = getEnv('NEXT_PUBLIC_APP_URL') || ''
 
   const socketUrl = getEnv('NEXT_PUBLIC_SOCKET_URL') || (isDev ? DEFAULT_SOCKET_URL : '')
@@ -219,7 +209,7 @@ function buildRuntimeCSPDirectives(): CSPDirectives {
   const privacyDomains = getHostnameFromUrl(getEnv('NEXT_PUBLIC_PRIVACY_URL'))
   const termsDomains = getHostnameFromUrl(getEnv('NEXT_PUBLIC_TERMS_URL'))
 
-  return {
+  const runtimeDirectives: CSPDirectives = {
     ...buildTimeCSPDirectives,
 
     'img-src': [...STATIC_IMG_SRC],
@@ -235,27 +225,8 @@ function buildRuntimeCSPDirectives(): CSPDirectives {
       ...termsDomains,
     ],
   }
-}
-
-/**
- * Generate runtime CSP header for non-landing routes (proxy.ts).
- */
-export function generateRuntimeCSP(): string {
-  return buildCSPString(buildRuntimeCSPDirectives())
-}
 
-/**
- * Generate runtime CSP header for the public marketing/landing site.
- * Extends the shared runtime policy with HubSpot tracking hosts.
- */
-export function generateLandingRuntimeCSP(): string {
-  const directives = buildRuntimeCSPDirectives()
-
-  return buildCSPString({
-    ...directives,
-    'script-src': [...(directives['script-src'] ?? []), ...HUBSPOT_SCRIPT_SRC],
-    'connect-src': [...(directives['connect-src'] ?? []), ...HUBSPOT_CONNECT_SRC],
-  })
+  return buildCSPString(runtimeDirectives)
 }
 
 /**

apps/sim/proxy.test.ts

@@ -9,7 +9,7 @@ vi.mock('@/lib/core/config/env', () =>
   createEnvMock({ NEXT_PUBLIC_APP_URL: 'https://app.sim.test' })
 )
 
-import { isNonLandingPath, resolveApiCorsPolicy } from '@/proxy'
+import { resolveApiCorsPolicy } from '@/proxy'
 
 function makeRequest(pathname: string, origin?: string): NextRequest {
   return {
@@ -122,38 +122,3 @@ describe('resolveApiCorsPolicy', () => {
     }
   })
 })
-
-describe('isNonLandingPath', () => {
-  it('matches known non-landing top-level pages and their subpaths', () => {
-    const paths = [
-      '/verify',
-      '/sso',
-      '/reset-password',
-      '/resume',
-      '/resume/workflow-123',
-      '/f',
-      '/f/token-abc',
-      '/invite',
-      '/invite/invite-id',
-      '/playground',
-      '/unsubscribe',
-    ]
-    for (const path of paths) {
-      expect(isNonLandingPath(path)).toBe(true)
-    }
-  })
-
-  it('does not match landing pages', () => {
-    const paths = ['/', '/pricing', '/blog/some-post', '/integrations', '/terms', '/privacy']
-    for (const path of paths) {
-      expect(isNonLandingPath(path)).toBe(false)
-    }
-  })
-
-  it('does not false-positive on landing pages that share a prefix with a non-landing page', () => {
-    // '/ffoo' and '/finance' start with 'f' but are not the '/f/:token' route
-    expect(isNonLandingPath('/ffoo')).toBe(false)
-    expect(isNonLandingPath('/finance')).toBe(false)
-    expect(isNonLandingPath('/resumes')).toBe(false)
-  })
-})

apps/sim/proxy.ts

@@ -4,7 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { sendToProfound } from './lib/analytics/profound'
 import { getEnv } from './lib/core/config/env'
 import { isAuthDisabled, isHosted } from './lib/core/config/env-flags'
-import { generateLandingRuntimeCSP, generateRuntimeCSP } from './lib/core/security/csp'
+import { generateRuntimeCSP } from './lib/core/security/csp'
 import { getClientIp } from './lib/core/utils/request'
 
 const logger = createLogger('Proxy')
@@ -117,24 +117,6 @@ function buildPreflightResponse(policy: CorsPolicy): NextResponse {
   return response
 }
 
-/** Top-level pages outside (landing) that still reach the catch-all branch below. */
-const NON_LANDING_PATH_PREFIXES = [
-  '/verify',
-  '/sso',
-  '/reset-password',
-  '/resume',
-  '/f',
-  '/invite',
-  '/playground',
-  '/unsubscribe',
-]
-
-export function isNonLandingPath(pathname: string): boolean {
-  return NON_LANDING_PATH_PREFIXES.some(
-    (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
-  )
-}
-
 const SUSPICIOUS_UA_PATTERNS = [
   /^\s*$/, // Empty user agents
   /\.\./, // Path traversal attempt
@@ -302,13 +284,10 @@ export async function proxy(request: NextRequest) {
   const securityBlock = handleSecurityFiltering(request)
   if (securityBlock) return track(request, securityBlock)
 
-  // Mostly the public marketing/landing site, plus a few non-landing pages
-  // (see isNonLandingPath) that also fall through to this branch.
   const response = NextResponse.next()
   response.headers.set('Vary', 'User-Agent')
 
-  const csp = isNonLandingPath(url.pathname) ? generateRuntimeCSP() : generateLandingRuntimeCSP()
-  response.headers.set('Content-Security-Policy', csp)
+  response.headers.set('Content-Security-Policy', generateRuntimeCSP())
   response.headers.set('X-Content-Type-Options', 'nosniff')
   response.headers.set('X-Frame-Options', 'SAMEORIGIN')