fix(csp): types and validation issues

.changeset/early-bees-write.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes an issue where `report-uri` wasn't available in `experimental.csp.directives`, causing a typing error and a runtime validation error.

.changeset/shaggy-singers-argue.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a type error for the CSP directives `upgrade-insecure-requests`, `sandbox`, and `trusted-type`.  

packages/astro/src/core/csp/config.ts

@@ -57,14 +57,15 @@ const ALLOWED_DIRECTIVES = [
 	'object-src',
 	'referrer',
 	'report-to',
+	'report-uri',
 	'require-trusted-types-for',
 	'sandbox',
 	'trusted-types',
 	'upgrade-insecure-requests',
 	'worker-src',
 ] as const;
 type AllowedDirectives = (typeof ALLOWED_DIRECTIVES)[number];
-export type CspDirective = `${AllowedDirectives} ${string}`;
+export type CspDirective = `${AllowedDirectives}${string | undefined}`;
 
 export const allowedDirectivesSchema = z.custom<CspDirective>((value) => {
 	if (typeof value !== 'string') {

packages/astro/test/csp.test.js

@@ -231,6 +231,31 @@ describe('CSP', () => {
 		assert.ok(meta.attr('content').toString().includes("'strict-dynamic';"));
 	});
 
+	it("allows the use of directives that don't require values, and deprecated ones", async () => {
+		fixture = await loadFixture({
+			root: './fixtures/csp/',
+			experimental: {
+				csp: {
+					directives: [
+						'upgrade-insecure-requests',
+						'sandbox',
+						'trusted-types',
+						'report-uri https://endpoint.example.com',
+					],
+				},
+			},
+		});
+		await fixture.build();
+		const html = await fixture.readFile('/index.html');
+		const $ = cheerio.load(html);
+
+		const meta = $('meta[http-equiv="Content-Security-Policy"]');
+		assert.ok(meta.attr('content').toString().includes('upgrade-insecure-requests'));
+		assert.ok(meta.attr('content').toString().includes('sandbox'));
+		assert.ok(meta.attr('content').toString().includes('trusted-types'));
+		assert.ok(meta.attr('content').toString().includes('report-uri https://endpoint.example.com'));
+	});
+
 	it('should serve hashes via headers for dynamic pages, when the strategy is "auto"', async () => {
 		fixture = await loadFixture({
 			root: './fixtures/csp-adapter/',