feat(api): exclude storybook from helmet

apps/api/src/main.ts

@@ -1,3 +1,5 @@
+import { STORYBOOK_PATH } from '@ghostfolio/common/config';
+
 import {
   Logger,
   LogLevel,
@@ -7,6 +9,7 @@ import {
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
 import type { NestExpressApplication } from '@nestjs/platform-express';
+import { NextFunction, Request, Response } from 'express';
 import helmet from 'helmet';
 
 import { AppModule } from './app/app.module';
@@ -50,7 +53,10 @@ async function bootstrap() {
   app.useBodyParser('json', { limit: '10mb' });
 
   if (configService.get<string>('ENABLE_FEATURE_SUBSCRIPTION') === 'true') {
-    app.use(
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path.startsWith(STORYBOOK_PATH)) {
+        next();
+      } else {
         helmet({
           contentSecurityPolicy: {
             directives: {
@@ -62,8 +68,9 @@ async function bootstrap() {
             }
           },
           crossOriginOpenerPolicy: false // Disable Cross-Origin-Opener-Policy header (for Internet Identity)
-      })
+        })(req, res, next);
-    );
+      }
+    });
   }
 
   app.use(HtmlTemplateMiddleware);