# INVEETAIRE — Google Maps Embed Fix (Phase 1)

The investigation has been completed.

The root cause has been verified using Chrome DevTools.

This is now an IMPLEMENTATION phase.

====================================================
BACKGROUND
====================================================

Google Maps iframe is currently NOT displayed on Live Preview and Public Invitation.

Chrome DevTools confirms the browser error:

Refused to frame 'https://www.google.com/'
because it violates the following Content Security Policy directive:

"default-src 'self'"

Note that "frame-src" was not explicitly set,
so "default-src" is used as a fallback.

Therefore the primary blocker is the application's CSP configuration.

====================================================
OBJECTIVE
====================================================

Fix Google Maps embedding WITHOUT changing the existing architecture.

Current architecture is already correct:

Couple Input

↓

extractMapsEmbedUrl()

↓

Store ONLY maps_embed_url

↓

View generates iframe

This architecture should remain unchanged.

====================================================
TASKS
====================================================

1.

Update Content Security Policy

Locate:

public/.htaccess

Modify the existing

Content-Security-Policy

to explicitly allow Google Maps iframe loading.

Add an appropriate

frame-src

directive.

Keep the policy as restrictive as possible.

Only allow the domains actually required for Google Maps embedding.

Do NOT weaken other CSP directives.

====================================================

2.

Review extractMapsEmbedUrl()

Do NOT redesign it.

Only verify whether valid Google Maps Embed URLs are incorrectly rejected.

If necessary,

replace the brittle validation with a safer implementation.

Requirements:

✓ Accept

https://www.google.com/maps/embed?...

✓ Accept iframe HTML and extract its src

✓ Reject non-Google embed URLs

✓ Continue storing ONLY the Embed URL

Never store raw iframe HTML.

====================================================

3.

Do NOT change database schema.

Do NOT add new columns.

Do NOT modify themes.

Do NOT modify renderer architecture.

====================================================

4.

Verification

Verify:

A.

Live Preview

/workspace/livepreview

Google Maps iframe loads successfully.

B.

Public Invitation

/workspace/i/{guest}

Google Maps iframe loads successfully.

C.

Browser Console

There must be NO remaining CSP violation.

====================================================
REGRESSION TEST
====================================================

Verify that the following continue working:

✓ Google Maps "Open in Google Maps" button

✓ Event Configuration

✓ Invitation Preview

✓ Public Invitation

✓ Theme compatibility

✓ Existing wedding_events.maps_embed_url data

====================================================
OUTPUT
====================================================

Generate:

1.

Files modified

2.

CSP changes made

3.

extractMapsEmbedUrl() review

4.

Verification results

5.

Browser Console result

6.

Regression test result

7.

Final production readiness statement

Stop after implementation.