fix: allow localhost in frame-ancestors for testing

src/hooks.server.ts

@@ -286,10 +286,13 @@ export const handle: Handle = async ({ event, resolve }) => {
 
 			// Add CSP header to control iframe embedding
 			if (config.ALLOW_IFRAME === "true") {
-				const frameAncestors = ["'self'", "https://huggingface.co", "https://*.hf.space"];
-				if (dev) {
-					frameAncestors.push("http://localhost:*", "http://127.0.0.1:*");
-				}
+				const frameAncestors = [
+					"'self'",
+					"https://huggingface.co",
+					"https://*.hf.space",
+					"http://localhost:*",
+					"http://127.0.0.1:*",
+				];
 				response.headers.append(
 					"Content-Security-Policy",
 					`frame-ancestors ${frameAncestors.join(" ")};`

svelte.config.js

@@ -43,9 +43,8 @@ const config = {
 								"'self'",
 								"https://huggingface.co",
 								"https://*.hf.space",
-								...(process.env.NODE_ENV !== "production"
-									? ["http://localhost:*", "http://127.0.0.1:*"]
-									: []),
+								"http://localhost:*",
+								"http://127.0.0.1:*",
 							]
 						: ["'none'"],
 			},