fix: allow unsafe-eval for wasm (#238)

* fix: allow `unsafe-eval` for wasm

* fmt

* change to unsafe-wasm-eval

* fmt

* add back unsafe-eval in dev

Author: CrabNejonas

clients/web/csp.js

@@ -1,4 +1,11 @@
-import { getCSP, SELF, NONE, UNSAFE_INLINE, UNSAFE_EVAL } from "csp-header";
+import {
+  getCSP,
+  SELF,
+  NONE,
+  UNSAFE_INLINE,
+  WASM_UNSAFE_EVAL,
+  UNSAFE_EVAL,
+} from "csp-header";
 
 export function generateCSP(isDev = false) {
   return getCSP({
@@ -8,7 +15,7 @@ export function generateCSP(isDev = false) {
     directives: {
       "default-src": [SELF],
       "frame-src": [SELF],
-      "script-src": isDev ? [SELF, UNSAFE_EVAL] : [SELF],
+      "script-src": isDev ? [SELF, UNSAFE_EVAL] : [SELF, WASM_UNSAFE_EVAL],
       "style-src": isDev ? [SELF, UNSAFE_INLINE] : [SELF],
       "connect-src": [SELF, "127.0.0.1", "127.0.0.1:*", "ws://localhost:5173/"],
       "img-src": [SELF],