Using route middleware with report-only mode

[pawel-baster]

Hi, thanks for a very useful package that helps a lot in maintaining CSP policies. I wanted to upgrade from v2.10 to v3.5 and I've noticed that in the new version:

There's no more support for reportOnly and shouldBeApplied in presets, as there are other ways to accommodate this functionality.

I am using three Policy/Preset classes for different parts of the project (each intended for a different category of users). They are attached to routes via route group middleware like this:

Route::group(['middleware' => [
     'web', Spatie\Csp\AddCspHeaders::class . ':' . AdminPolicy::class], 
     'domain' => 'admin.example.com'], 
     function (): void { ... }
);

It seems that there's no way to set my policies/presets to report-only mode or enable reporting, because this code in AddCspHeaders does not support neither report-only header nor report-uri:

if ($customPreset) {
    // reportUri not passed to Policy::create() and the field is protected in the Policy class, 
    // so Presets cannot modify it on their own:
    $policy = Policy::create([$customPreset]);
    // header hard-coded to the non-report-only variant:
    $response->headers->set('Content-Security-Policy', $policy->getContents());
    return $response;
}

I am wondering if I am missing something or is replicating my v2 setup not possible in v3?