Set Permissions-Policy for Transak

Author: lukaw3d

internals/getPermissionHeaders.js

@@ -56,26 +56,26 @@ const getCsp = ({ isExtension } = { isExtension: false }) =>
 // Generated with https://www.permissionspolicy.com/
 const getPermissionsPolicy = () =>
   `
-    accelerometer=(),
+    accelerometer=("https://api.sardine.ai"),
     ambient-light-sensor=(),
     autoplay=(),
     bluetooth=(self),
-    camera=(),
+    camera=("https://global.transak.com" "https://global-stg.transak.com"),
     cross-origin-isolated=(),
     display-capture=(),
     document-domain=(),
     encrypted-media=(),
     execution-while-not-rendered=(),
     execution-while-out-of-viewport=(),
-    fullscreen=(self),
+    fullscreen=(self "https://global.transak.com" "https://global-stg.transak.com"),
     geolocation=(),
-    gyroscope=(),
+    gyroscope=("https://api.sardine.ai"),
     keyboard-map=(),
     magnetometer=(),
-    microphone=(),
+    microphone=("https://global.transak.com" "https://global-stg.transak.com"),
     midi=(),
     navigation-override=(),
-    payment=(),
+    payment=("https://global.transak.com" "https://global-stg.transak.com"),
     picture-in-picture=(),
     publickey-credentials-get=(),
     screen-wake-lock=(),

src/app/pages/FiatOnrampPage/index.tsx

@@ -112,6 +112,9 @@ export function FiatOnramp() {
           <iframe
             height="875"
             title="Transak On/Off Ramp Widget"
+            // From https://github.com/Transak/transak-sdk/blob/2ebb3bd/src/index.js#L52
+            // TODO: It also loads https://api.sardine.ai inside, and that tries
+            // to listen for devicemotion and deviceorientation. Is this necessary?
             allow="camera;microphone;fullscreen;payment"
             // Restrict top-navigation
             sandbox={[