<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <!-- SimplyIN CCIframe library -->
                <value id="simplyin_card_js" type="host">https://nice-forest-050c81103.6.azurestaticapps.net</value>
                <!-- SimplyIN backend (covers preprod.backend.simplyin.app and backend.simplyin.app) -->
                <value id="simplyin_backend" type="host">*.simplyin.app</value>
            </values>
        </policy>
        <policy id="frame-src">
            <values>
                <!-- SimplyIN backend for 3DS -->
                <value id="simplyin_3ds" type="host">*.simplyin.app</value>
                <!-- Bank 3DS verification domains -->
                <value id="bank_3ds_visa" type="host">*.visa.com</value>
                <value id="bank_3ds_mc" type="host">*.mastercard.com</value>
                <value id="bank_3ds_secure" type="host">*.3dsecure.io</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <!-- SimplyIN API (prod and preprod) -->
                <value id="simplyin_api" type="host">*.simplyin.app</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <!-- SimplyIN assets -->
                <value id="simplyin_images" type="host">*.simply.in</value>
                <value id="simplyin_woo_logo" type="host">*.simplyin.app</value>
                <value id="simplyin_blob_storage" type="host">*.blob.core.windows.net</value>
                <value id="simplyin_blik_img" type="host">*.azurecontainerapps.io</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>
