From 2deb523f3d2bdcf098d20f57060dd0de7e2f11d0 Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Fri, 10 May 2024 14:46:48 +0200
Subject: [PATCH] backend-app-api: accept camelCase csp directives

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 packages/backend-app-api/src/http/readHelmetOptions.test.ts | 2 +-
 packages/backend-app-api/src/http/readHelmetOptions.ts      | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/backend-app-api/src/http/readHelmetOptions.test.ts b/packages/backend-app-api/src/http/readHelmetOptions.test.ts
index bc31404634..619a4e6a17 100644
--- a/packages/backend-app-api/src/http/readHelmetOptions.test.ts
+++ b/packages/backend-app-api/src/http/readHelmetOptions.test.ts
@@ -47,7 +47,7 @@ describe('readHelmetOptions', () => {
       csp: {
         key: ['value'],
         'img-src': false,
-        'script-src-attr': ['custom'],
+        scriptSrcAttr: ['custom'],
       },
     });
     expect(readHelmetOptions(config)).toEqual({
diff --git a/packages/backend-app-api/src/http/readHelmetOptions.ts b/packages/backend-app-api/src/http/readHelmetOptions.ts
index 0555bdef00..510fdd9586 100644
--- a/packages/backend-app-api/src/http/readHelmetOptions.ts
+++ b/packages/backend-app-api/src/http/readHelmetOptions.ts
@@ -18,6 +18,7 @@ import { Config } from '@backstage/config';
 import helmet from 'helmet';
 import { HelmetOptions } from 'helmet';
 import { ContentSecurityPolicyOptions } from 'helmet/dist/types/middlewares/content-security-policy';
+import kebabCase from 'lodash/kebabCase';
 
 /**
  * Attempts to read Helmet options from the backend configuration object.
@@ -97,10 +98,11 @@ export function applyCspDirectives(
 
   if (directives) {
     for (const [key, value] of Object.entries(directives)) {
+      const kebabCaseKey = kebabCase(key);
       if (value === false) {
-        delete result[key];
+        delete result[kebabCaseKey];
       } else {
-        result[key] = value;
+        result[kebabCaseKey] = value;
       }
     }
   }