@7365admin1/layer-common 4.85.0 → 4.86.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @iservice365/layer-common
 
+## 4.86.0
+
+### Minor Changes
+
+- 4891c16: Security headers on every app (HSTS, nosniff, frame-ancestors/X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, minimal enforced CSP + full Report-Only CSP), drop `x-powered-by`, explicit `SameSite=Lax` on the session cookies, `sanitizeHtml` for rich text rendered with `v-html`, html2pdf.js 0.14 (jsPDF 4.2.1).
+
 ## 4.85.0
 
 ### Minor Changes
@@ -1980,11 +1986,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/components/BulletinBoardView.vue

@@ -19,7 +19,7 @@
               <v-col class="font-weight-bold">{{ label }}:</v-col>
 
               <v-col cols="9" class="px-10">
-                <span v-if="key === 'content'" v-html="getFieldValue(key)" />
+                <span v-if="key === 'content'" v-html="sanitizeHtml(getFieldValue(key))" />
                 <span v-else-if="key === 'noExpiration'">
                   <BulletinExpirationChip
                     :value="getFieldValue(key) as boolean"

package/nuxt.config.ts

@@ -1,8 +1,23 @@
 // https://nuxt.com/docs/api/configuration/nuxt-config
 import vuetify, { transformAssetUrls } from "vite-plugin-vuetify";
+import { SECURITY_HEADERS } from "./utils/security-headers";
 export default defineNuxtConfig({
   ssr: false,
   devtools: { enabled: false },
+
+  // Security headers for every app that extends this layer: the HTML shell gets
+  // them from Nitro, the static files from the `_headers` file the Cloudflare
+  // preset writes from these same rules. See utils/security-headers.ts.
+  routeRules: {
+    "/**": { headers: SECURITY_HEADERS },
+    // Stored files read with the signed-in session (API-core
+    // GET /api/files/object/<key>) instead of the public CDN. Unused until an
+    // app's API_DO_STORAGE_ENDPOINT points at /api/storage/<folder>; that switch
+    // goes with SPACES_PRIVATE_PREFIXES - see the storage runbook.
+    ...(process.env.API_CORE
+      ? { "/api/storage/**": { proxy: `${process.env.API_CORE}/api/files/object/**` } }
+      : {}),
+  },
   build: {
     transpile: ["vuetify"],
   },
@@ -48,6 +63,9 @@ export default defineNuxtConfig({
       cookieConfig: {
         domain: (process.env.DOMAIN as string) ?? "localhost",
         secure: true,
+        // Explicit, not the browser default: the API also reads `sid` from the
+        // cookie, so a cross-site form post must never carry it (CSRF).
+        sameSite: "lax",
         maxAge: 30 * 24 * 60 * 60,
       },
       APP: (process.env.APP as string) ?? "App",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.85.0",
+  "version": "4.86.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -22,6 +22,7 @@
     "pages",
     "plugins",
     "public",
+    "server",
     "services",
     "types",
     "utils",
@@ -57,8 +58,9 @@
     "@mdi/font": "^7.4.47",
     "@types/qrcode": "^1.5.6",
     "ckeditor5": "47.4.0",
+    "dompurify": "^3.3.1",
     "hls.js": "^1.6.13",
-    "html2pdf.js": "^0.10.2",
+    "html2pdf.js": "^0.14.0",
     "html5-qrcode": "^2.3.8",
     "moment-timezone": "^0.6.0",
     "nuxt-signature-pad": "^1.8.0",

package/server/plugins/no-powered-by.ts

@@ -0,0 +1,7 @@
+// Nuxt's renderer stamps `x-powered-by: Nuxt` on the HTML shell. It tells a
+// scanner the framework for free and helps nobody, so drop it.
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("render:response", (response) => {
+    if (response?.headers) delete response.headers["x-powered-by"];
+  });
+});

package/utils/sanitize-html.ts

@@ -0,0 +1,16 @@
+import DOMPurify from "dompurify";
+
+/**
+ * The one way rich text typed by a user (announcements, facility descriptions,
+ * policies) reaches `v-html`. Keeps formatting, drops scripts, event handlers,
+ * `javascript:` links and embedded frames/forms. Browser-only (the apps are
+ * `ssr: false`); without a DOM it returns "" rather than unsanitised HTML.
+ */
+export function sanitizeHtml(html: unknown): string {
+  if (html === null || html === undefined || html === "") return "";
+  if (typeof window === "undefined" || !DOMPurify.isSupported) return "";
+  return DOMPurify.sanitize(String(html), {
+    USE_PROFILES: { html: true },
+    FORBID_TAGS: ["style", "form", "input", "button", "iframe", "object", "embed"],
+  });
+}

package/utils/security-headers.ts

@@ -0,0 +1,52 @@
+/**
+ * Response headers every web app sends, on the HTML shell (Nitro route rules)
+ * and on the static files (nitro writes the same rules into Cloudflare's
+ * `_headers`). One list, so the eleven apps cannot drift apart.
+ *
+ * The ENFORCED Content-Security-Policy only carries the directives that cannot
+ * break a screen: who may frame us (clickjacking), no plugins, no <base> swap.
+ * The full policy ships as Report-Only first: the apps load Google Fonts,
+ * camera players and documents in iframes, sockets and the Spaces CDN, and a
+ * wrong guess there blanks a page. Violations show in the browser console;
+ * once a release runs clean, move it to the enforced header.
+ *
+ * HSTS deliberately has no `preload`: preload is decided for the whole
+ * iservice365.org domain at the apex and is hard to undo (owner/leads action).
+ */
+export const CSP_ENFORCED = [
+  "frame-ancestors 'self'",
+  "object-src 'none'",
+  "base-uri 'self'",
+].join("; ");
+
+export const CSP_REPORT_ONLY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' data: https://fonts.gstatic.com",
+  "img-src 'self' data: blob: https:",
+  "media-src 'self' blob: https:",
+  "connect-src 'self' https: wss:",
+  "frame-src 'self' https:",
+  "worker-src 'self' blob:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'self'",
+  "form-action 'self' https:",
+  "upgrade-insecure-requests",
+].join("; ");
+
+export const SECURITY_HEADERS: Record<string, string> = {
+  "strict-transport-security": "max-age=31536000; includeSubDomains",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "SAMEORIGIN",
+  "referrer-policy": "strict-origin-when-cross-origin",
+  // camera/mic: QR scan, photo capture; geolocation: attendance;
+  // usb/serial/hid: card readers (useWebUsb). Everything else is off.
+  "permissions-policy":
+    "camera=(self), microphone=(self), geolocation=(self), usb=(self), serial=(self), hid=(self), payment=(self), display-capture=(self), bluetooth=(), midi=(), magnetometer=(), gyroscope=(), accelerometer=()",
+  // allow-popups: payment and document windows we open keep working.
+  "cross-origin-opener-policy": "same-origin-allow-popups",
+  "content-security-policy": CSP_ENFORCED,
+  "content-security-policy-report-only": CSP_REPORT_ONLY,
+};