missing callback type for reportOnly

types/helmet/helmet-tests.ts

@@ -58,7 +58,8 @@ function contentSecurityPolicyTest() {
         disableAndroid: false
     };
 
-    function reportCb(req: express.Request, res: express.Response) { return '/some-uri'; }
+    function reportUriCb(req: express.Request, res: express.Response) { return '/some-uri'; }
+    function reportOnlyCb(req: express.Request, res: express.Response) { return false; }
 
     app.use(helmet.contentSecurityPolicy());
     app.use(helmet.contentSecurityPolicy({}));
@@ -66,11 +67,12 @@ function contentSecurityPolicyTest() {
     app.use(helmet.contentSecurityPolicy({
         directives: {
             defaultSrc: ["'self'"],
-            reportUri: reportCb,
-            'report-uri': reportCb,
-            reportTo: reportCb,
-            'report-to': reportCb
+            reportUri: reportUriCb,
+            'report-uri': reportUriCb,
+            reportTo: reportUriCb,
+            'report-to': reportUriCb
         },
+        reportOnly: reportOnlyCb,
         loose: false,
         setAllHeaders: true
     }));

types/helmet/index.d.ts

@@ -105,8 +105,12 @@ declare namespace helmet {
         'worker-src'?: HelmetCspDirectiveValue;
     }
 
+    export interface IHelmetContentSecurityReportOnlyFunction {
+        (req: express.Request, res: express.Response): boolean;
+    }
+
     export interface IHelmetContentSecurityPolicyConfiguration {
-        reportOnly?: boolean;
+        reportOnly?: boolean | IHelmetContentSecurityReportOnlyFunction;
         setAllHeaders?: boolean;
         disableAndroid?: boolean;
         browserSniff?: boolean;