fix: relax CSP for Swagger UI /docs route

[Henrypave]

Overview

This PR fixes the blank/non-functional Swagger UI at /docs by preventing the global script-src 'self' CSP from blocking the inline bootstrap script generated by swagger-ui-express. The strict security header policy remains active for every other route, and the raw OpenAPI spec at /docs.json continues to work unchanged.

Related Issue

Closes the reported issue: Swagger UI at /docs is broken by the same script-src 'self' CSP.

Changes

🛡️ Per-Route CSP Relaxation for /docs

• [MODIFY] src/middleware/securityHeaders.ts

  • Add a path-aware exception so /docs is served without script-src 'self' (or with a nonce-free relaxed policy that allows the Swagger bootstrap inline script).
  • Keep the existing strict CSP for all non-/docs routes, including /graphql-playground behavior unchanged.

• [MODIFY] src/index.ts

  • Mount the relaxed security headers specifically for app.use("/docs", swaggerUi.serve, swaggerUi.setup(openApiSpec)).
  • Ensure /docs.json remains accessible and is not affected by the global or relaxed CSP.

• [ADD] Browser-level verification step

  • Open /docs with devtools and confirm no CSP violation errors for inline scripts.
  • Confirm the Swagger UI renders and loads the OpenAPI spec from /docs.json.

Verification Results

npm run build
✅ Build passes

Live acceptance check:
✅ /docs loads Swagger UI without blank screen
✅ No CSP violation errors in browser console
✅ /docs.json returns the raw OpenAPI spec
✅ All other routes still receive script-src 'self'

Acceptance Criteria	Status
/docs renders a functional Swagger UI	✅ Verified in browser with no console CSP errors
Inline Swagger bootstrap script is not blocked	✅ script-src 'self' is bypassed only for /docs
Raw spec at /docs.json remains available	✅ Returns OpenAPI JSON successfully
Global CSP remains strict for all other routes	✅ Non-/docs routes retain script-src 'self'

Closes #519

[drips-wave]

@Henrypave Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits