From 7e5f97a9de1417a09cb35f5731c237a687df417d Mon Sep 17 00:00:00 2001
From: Yuu Ottosoka <minato.namikaze.best.hokage@gmail.com>
Date: Sun, 20 Jul 2025 13:29:47 +0300
Subject: [PATCH] fix(security): disable browsing topics api in astro and nginx
 config

Add Permissions-Policy header to disable browsing-topics API to prevent Yandex.Metrika attestation errors
---
 astro.config.mjs | 5 +++++
 nginx/nginx.conf | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/astro.config.mjs b/astro.config.mjs
index e70f95a..d6ff6b3 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -15,6 +15,11 @@ export default defineConfig({
       prefixDefaultLocale: false,
     },
   },
+  server: {
+    headers: {
+      'Permissions-Policy': 'browsing-topics=()',
+    },
+  },
   env: {
     schema: {
       YCLIENTS_API_URL: envField.string({ context: 'server', access: 'public' }),
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index a1a6187..f17825c 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -18,6 +18,9 @@ http {
     gzip_proxied expired no-cache no-store private auth;
     gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
 
+    # Fix Yandex.Metrika Topics API attestation error
+    add_header Permissions-Policy "browsing-topics=()" always;
+
     error_page 404 /404.html;
     location = /404.html {
             root /usr/share/nginx/html;