From 4c335e93cd2676063fda274f03f95a0c3881ed0c Mon Sep 17 00:00:00 2001
From: Patryk Makuch <makuchpatryk@gmail.com>
Date: Mon, 23 Feb 2026 23:55:06 +0100
Subject: [PATCH] fix(global): display issue

---
 layouts/default.vue      |  1 -
 layouts/game.vue         |  1 -
 nuxt.config.ts           | 30 ++++++++++++++++++++++++++----
 server/api/get-image.ts  |  9 ++++++++-
 server/api/get-images.ts | 10 +++++++++-
 5 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/layouts/default.vue b/layouts/default.vue
index d193954..f367189 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -17,7 +17,6 @@
 </template>
 
 <style lang="css">
-@import url("https://fonts.googleapis.com/css2?family=League+Spartan:wght@100..900&display=swap");
 
 * {
   font-family: "League Spartan", sans-serif;
diff --git a/layouts/game.vue b/layouts/game.vue
index cb805f7..87e458f 100644
--- a/layouts/game.vue
+++ b/layouts/game.vue
@@ -17,7 +17,6 @@
 </template>
 
 <style lang="css">
-@import url("https://fonts.googleapis.com/css2?family=League+Spartan:wght@100..900&display=swap");
 
 * {
   font-family: "League Spartan", sans-serif;
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 2ed46e0..b43b6fa 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -12,6 +12,21 @@ export default defineNuxtConfig({
       charset: "utf-8",
       viewport: "width=device-width, initial-scale=1",
       meta: [{ name: "description", content: "Perplex Image" }],
+      link: [
+        {
+          rel: "preconnect",
+          href: "https://fonts.googleapis.com",
+        },
+        {
+          rel: "preconnect",
+          href: "https://fonts.gstatic.com",
+          crossorigin: "anonymous",
+        },
+        {
+          rel: "stylesheet",
+          href: "https://fonts.googleapis.com/css2?family=League+Spartan:wght@100..900&display=swap",
+        },
+      ],
     },
   },
 
@@ -48,6 +63,13 @@ export default defineNuxtConfig({
   },
 
   routeRules: {
+    "/api/**": {
+      headers: {
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "strict-origin-when-cross-origin",
+        "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+      },
+    },
     "/**": {
       headers: {
         "X-Content-Type-Options": "nosniff",
@@ -59,10 +81,10 @@ export default defineNuxtConfig({
         "Content-Security-Policy":
           "default-src 'self'; " +
           "script-src 'self' 'unsafe-inline'; " +
-          "style-src 'self' 'unsafe-inline'; " +
-          "img-src 'self' data: https://images.pexels.com https://www.pexels.com; " +
-          "connect-src 'self'; " +
-          "font-src 'self'; " +
+          "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +
+          "img-src 'self' data: blob: https://images.pexels.com https://www.pexels.com; " +
+          "connect-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://images.pexels.com ws: wss:; " +
+          "font-src 'self' https://fonts.gstatic.com; " +
           "object-src 'none'; " +
           "base-uri 'self'; " +
           "form-action 'self'; " +
diff --git a/server/api/get-image.ts b/server/api/get-image.ts
index 1daeab4..382675c 100644
--- a/server/api/get-image.ts
+++ b/server/api/get-image.ts
@@ -2,7 +2,14 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const { id } = getQuery(event);
 
-  // Walidacja: id musi być dodatnią liczbą całkowitą (zabezpieczenie przed SSRF)
+  if (!config.pexelsApiKey) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: "Brak klucza API Pexels. Ustaw zmienną środowiskową PEXELS_API_KEY.",
+    });
+  }
+
   const photoId = Number(id);
   if (!id || !Number.isInteger(photoId) || photoId <= 0) {
     throw createError({
diff --git a/server/api/get-images.ts b/server/api/get-images.ts
index 4e4a7b4..17a46c0 100644
--- a/server/api/get-images.ts
+++ b/server/api/get-images.ts
@@ -4,7 +4,15 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const { per_page } = getQuery(event);
 
-  // Walidacja: per_page musi być liczbą całkowitą w zakresie 1–100
+  if (!config.pexelsApiKey) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: "Brak klucza API Pexels. Ustaw zmienną środowiskową PEXELS_API_KEY.",
+    });
+  }
+
+  // ...existing code...
   const perPage = Number(per_page);
   if (!per_page || !Number.isInteger(perPage) || perPage < 1 || perPage > 100) {
     throw createError({