Sapper with content security enabled for script tags

server.js

// @ts-nocheck
// TODO: remove once there are typings in place

import './css/tailwind.css';
import * as sapper from '@sapper/server';
import compression from 'compression';
import express from 'express';
import helmet from "helmet";
import sirv from 'sirv';
import uuidv4 from 'uuid/v4';

const {
	PORT,
	NODE_ENV
} = process.env;
const dev = NODE_ENV === 'development';

const app = express();


if ( dev ) {
	app.use(
		sirv( 'static', { dev } )
	);
}

app.use(
	( request, response, next ) => { response.locals.nonce = uuidv4(); next(); },
	sapper.middleware(),
	helmet( {
		contentSecurityPolicy: {
			directives: {
				scriptSrc: [
					"'self'",
					( request, response ) => `'nonce-${response.locals.nonce}'`
					]
				},
			browserSniff: false
			}
		}
		),
	( request, response ) => { response.end( `<script nonce="${response.locals.nonce}"></script>` ) },
	compression( { threshold: 0 } )
);


if ( dev ) {
	app.listen( PORT, err => { if ( err ) console.log( 'error', err ); } );
}

export { app };