Revert "fix: add security headers via helmet with CSP configuration"

package.json

@@ -17,7 +17,7 @@
     "dotenv": "^17.3.1",
     "express": "^4.18.2",
     "express-rate-limit": "^8.5.2",
-    "helmet": "^8.2.0",
+    "google-auth-library": "^10.6.2",
     "jsonwebtoken": "^9.0.2",
     "razorpay": "^2.9.6",
     "uuid": "^9.0.0"

public/admin.html

@@ -297,7 +297,7 @@ <h2 class="section-card-title">Top Performing Links</h2>
     <aside class="preview-panel" id="previewPanel">
       <div class="preview-header">
         <span class="preview-title">Live Preview</span>
-        <button class="btn btn-icon btn-secondary" title="Share" id="previewShareBtn">
+        <button class="btn btn-icon btn-secondary" title="Share" id="previewShareBtn" onclick="window.open('/me', '_blank')">
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg>
         </button>
       </div>

public/js/admin.js

@@ -1059,12 +1059,4 @@
       // fail silently
     }
   }
-
-  // ─── Live Preview Share Button ───
-  const previewShareBtn = document.getElementById('previewShareBtn');
-  if (previewShareBtn) {
-    previewShareBtn.addEventListener('click', function () {
-      window.open('/me', '_blank');
-    });
-  }
 })();

server.js

@@ -10,7 +10,6 @@ const crypto = require('crypto');
 const supabase = require('./db');
 const { OAuth2Client } = require('google-auth-library');
 const rateLimit = require('express-rate-limit');
-const helmet = require('helmet');
 const app = express();
 const PORT = process.env.PORT || 3000;
 if (!process.env.JWT_SECRET) {
@@ -70,23 +69,6 @@ const googleAuthLimiter = rateLimit({
 
 // Middleware
 app.use(cors());
-
-// Security headers
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-      fontSrc: ["'self'", "https://fonts.gstatic.com"],
-      scriptSrc: ["'self'", "'unsafe-inline'", "https://checkout.razorpay.com", "https://cdnjs.cloudflare.com"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'"],
-      frameAncestors: ["'self'"],
-      upgradeInsecureRequests: []
-    }
-  }
-}));
-
 app.use(express.json());
 app.use(cookieParser());