Merge pull request #148 from adambullmer/unblock-manifest-v3

feat: Unblock manifest v3 usage by fixing incompatible CSP automation

lib/manifest.js

@@ -18,6 +18,8 @@ function syncManifestWithPackageJson ({ manifestSync }, packageJson, manifest) {
   })
 }
 
+const defaultCsp = "script-src 'self' 'unsafe-eval'; object-src 'self'"
+
 module.exports = (api, pluginOptions, packageJson) => async (content) => {
   const manifest = JSON.parse(content)
   const keyFile = api.resolve('key.pem')
@@ -26,15 +28,28 @@ module.exports = (api, pluginOptions, packageJson) => async (content) => {
 
   syncManifestWithPackageJson(pluginOptions, packageJson, manifest)
 
-  manifest.content_security_policy =
-    manifest.content_security_policy || "script-src 'self' 'unsafe-eval'; object-src 'self'"
+  if (manifest.manifest_version === 3) {
+    manifest.content_security_policy = Object.assign(
+      {
+        extension_pages: defaultCsp
+      },
+      manifest.content_security_policy
+    )
+  } else {
+    manifest.content_security_policy =
+      manifest.content_security_policy || defaultCsp
+  }
 
   // validate manifest
 
   // If building for production (going to web store) abort early.
   // The browser extension store will hash your signing key and apply CSP policies.
   if (isProduction) {
-    manifest.content_security_policy = manifest.content_security_policy.replace(/'unsafe-eval'/, '')
+    if (manifest.manifest_version === 3) {
+      manifest.content_security_policy.extension_pages = manifest.content_security_policy.extension_pages.replace(/'unsafe-eval'/, '')
+    } else {
+      manifest.content_security_policy = manifest.content_security_policy.replace(/'unsafe-eval'/, '')
+    }
 
     // validate minimum options