feat: iframe configuration

apps/server/src/common/helpers/index.ts

@@ -2,3 +2,4 @@ export * from './utils';
 export * from './nanoid.utils';
 export * from './file.helper';
 export * from './constants';
+export * from './security-headers';

apps/server/src/common/helpers/security-headers.ts

@@ -0,0 +1,19 @@
+export type SecurityHeader = { name: string; value: string };
+
+export function resolveFrameHeader(
+  iframeEmbedAllowed: boolean,
+  allowedOrigins: string[],
+): SecurityHeader | null {
+  if (!iframeEmbedAllowed) {
+    return { name: 'X-Frame-Options', value: 'SAMEORIGIN' };
+  }
+
+  if (allowedOrigins.length === 0) {
+    return null;
+  }
+
+  return {
+    name: 'Content-Security-Policy',
+    value: `frame-ancestors 'self' ${allowedOrigins.join(' ')}`,
+  };
+}