{
  "context": "This criteria evaluates how well the engineer uses Flask-Admin's Content Security Policy (CSP) nonce generation capability to secure an admin interface. The focus is on proper configuration and usage of Flask-Admin's built-in CSP support.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Admin Initialization",
      "description": "Creates an Admin instance with csp_enabled parameter set to enable CSP nonce generation support",
      "max_score": 25
    },
    {
      "name": "AdminIndexView Configuration",
      "description": "Uses AdminIndexView or a custom subclass for the admin index with proper CSP nonce template access via csp_nonce() or admin_view.csp_nonce()",
      "max_score": 20
    },
    {
      "name": "Template Nonce Usage",
      "description": "Correctly uses the CSP nonce in custom templates for inline scripts and/or styles by accessing the nonce value through the template context",
      "max_score": 25
    },
    {
      "name": "CSP Header Verification",
      "description": "Implementation generates CSP headers with unique nonce values that are included in Content-Security-Policy header's script-src and/or style-src directives",
      "max_score": 20
    },
    {
      "name": "Flask Integration",
      "description": "Properly integrates the Admin instance with the Flask application using init_app() or constructor-based initialization",
      "max_score": 10
    }
  ]
}