@application-kit/nestjs-vite 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @application-kit/nestjs-vite
 
+## 0.5.0
+
+### Minor Changes
+
+- 9909a33: HTML-страницы получают `Content-Security-Policy` с новым nonce на каждый запрос, и тот же nonce стоит на теге состояния. Режим задаёт `CONTENT_SECURITY_POLICY_MODE`: `enforce` по умолчанию, `report-only` или `off` для отката. В `peerDependencies` добавлены `@libs-for-dev/nestjs-config-module`, `class-transformer` и `class-validator`. Клиенту с `zod` нужен `z.config({ jitless: true })`, иначе его проба `eval` пишет нарушение в консоль.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -104,17 +104,35 @@ export class ClientModule {}
 
 | Константа | В шаблоне | Чем заменяется |
 |---|---|---|
-| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script>` с присваиваниями `window[ключ] = значение` |
+| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script id="state" nonce="…">` с присваиваниями `window[ключ] = значение` |
 | `TEMPLATE_PLACEHOLDER` | `<div id="app"></div>` | тот же `div` с разметкой `template` внутри |
 | `LANG_ATTRIBUTE_PATTERN` | `<html lang="…">` с любым значением | `lang` страницы |
 
 Значения состояния уходят JS-литералами строки с экранированным `<`: `</script>` в данных не закроет тег, какой бы
 сериализатор ни выбрало приложение. Клиентский энтри читает их до гидрации.
 
-`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера и `Content-Type: text/html`
-и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
+`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера, `Content-Type: text/html` и
+заголовки рендера и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
 `@Header('Content-Type')` на маршруте страницы не нужен.
 
+### Content Security Policy
+
+Рендерер выпускает на каждый ответ новый nonce и ставит его в заголовок и на тег состояния:
+`script-src 'self' 'nonce-…'; object-src 'none'; base-uri 'self'`. Заголовок ставит пакет, потому что значение меняется
+с каждым запросом, а прокси перед приложением этого не умеют. Страницу с nonce нельзя кешировать на прокси или CDN: все
+посетители получили бы один nonce.
+
+Режим — переменная `CONTENT_SECURITY_POLICY_MODE`, проверяется при старте:
+
+| Значение | Заголовок |
+|---|---|
+| `enforce` (по умолчанию) | `Content-Security-Policy` |
+| `report-only` | `Content-Security-Policy-Report-Only` |
+| `off` | нет, и nonce на тег не ставится |
+
+`eval` и `new Function` политика запрещает, и браузер пишет нарушение в консоль, даже если код перехватывает ошибку. Так
+поступает проба `allowsEval` в `zod`: клиенту с `zod` нужен `z.config({ jitless: true })` до первой схемы.
+
 ### Фильтры
 
 - `NotFoundFilter` — регистрирует `ViteSsrModule`: `NotFoundException` отвечает отрендеренной страницей

package/dist/cjs/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/cjs/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyConfig = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const content_security_policy_environment_js_1 = require("./content-security-policy.environment.js");
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = (0, node_crypto_1.randomBytes)(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig;
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);

package/dist/cjs/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/cjs/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyEnvironment = exports.CONTENT_SECURITY_POLICY_MODES = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+exports.CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+exports.ContentSecurityPolicyEnvironment = ContentSecurityPolicyEnvironment;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsIn)(exports.CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/cjs/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/cjs/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/cjs/content-security-policy/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy.config.js"), exports);
+__exportStar(require("./content-security-policy.environment.js"), exports);
+__exportStar(require("./content-security-policy.interface.js"), exports);

package/dist/cjs/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/cjs/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy/index.js"), exports);
 __exportStar(require("./filters/index.js"), exports);
 __exportStar(require("./html-loader/index.js"), exports);
 __exportStar(require("./renderer/index.js"), exports);

package/dist/cjs/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/cjs/renderer/html-template.js

@@ -6,13 +6,14 @@ exports.TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 exports.LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-const fillHtmlTemplate = (html, page) => html
-    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state))
+const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(exports.TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(exports.LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);
 exports.fillHtmlTemplate = fillHtmlTemplate;

package/dist/cjs/renderer/render-html-page.js

@@ -2,8 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderHtmlPage = void 0;
 const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };
 exports.renderHtmlPage = renderHtmlPage;

package/dist/cjs/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/cjs/renderer/vite-application-renderer.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteApplicationRenderer = void 0;
 const common_1 = require("@nestjs/common");
+const content_security_policy_config_js_1 = require("../content-security-policy/content-security-policy.config.js");
 const html_loader_interface_js_1 = require("../html-loader/html-loader.interface.js");
 const ssr_entry_interface_js_1 = require("../ssr-entry/ssr-entry.interface.js");
 const vite_constants_js_1 = require("../vite.constants.js");
@@ -22,16 +23,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: (0, html_template_js_1.fillHtmlTemplate)(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: (0, html_template_js_1.fillHtmlTemplate)(html, page, nonce), statusCode: page.statusCode };
     }
 };
 exports.ViteApplicationRenderer = ViteApplicationRenderer;
@@ -40,5 +44,6 @@ exports.ViteApplicationRenderer = ViteApplicationRenderer = __decorate([
     __param(0, (0, common_1.Inject)(ssr_entry_interface_js_1.SSR_ENTRY_INTERFACE)),
     __param(1, (0, common_1.Inject)(html_loader_interface_js_1.HTML_LOADER_INTERFACE)),
     __param(2, (0, common_1.Inject)(vite_constants_js_1.VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, (0, common_1.Inject)(content_security_policy_config_js_1.ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, content_security_policy_config_js_1.ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);

package/dist/cjs/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/cjs/vite-ssr.module.js

@@ -7,8 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteSsrModule = void 0;
+const nestjs_config_module_1 = require("@libs-for-dev/nestjs-config-module");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const content_security_policy_config_js_1 = require("./content-security-policy/content-security-policy.config.js");
+const content_security_policy_environment_js_1 = require("./content-security-policy/content-security-policy.environment.js");
 const not_found_filter_js_1 = require("./filters/not-found.filter.js");
 const html_loader_with_vite_js_1 = require("./html-loader/html-loader-with-vite.js");
 const html_loader_interface_js_1 = require("./html-loader/html-loader.interface.js");
@@ -37,7 +40,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [vite_application_renderer_interface_js_1.VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [vite_module_js_1.ViteModule],
+            imports: [
+                nestjs_config_module_1.ConfigsModule.forFeature([content_security_policy_config_js_1.ContentSecurityPolicyConfig], [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [vite_module_js_1.ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: vite_constants_js_1.VITE_SSR_OPTIONS, useValue: options },

package/dist/esm/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/esm/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,41 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { randomBytes } from 'node:crypto';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = randomBytes(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+ContentSecurityPolicyConfig = __decorate([
+    Injectable(),
+    __param(0, Inject(ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);
+export { ContentSecurityPolicyConfig };

package/dist/esm/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/esm/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Expose } from 'class-transformer';
+import { IsIn } from 'class-validator';
+export const CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+export class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+__decorate([
+    Expose(),
+    IsIn(CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/esm/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/esm/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/content-security-policy/index.js

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/index.js

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/esm/renderer/html-template.js

@@ -3,12 +3,13 @@ export const TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 export const LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-export const fillHtmlTemplate = (html, page) => html
-    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state))
+export const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);

package/dist/esm/renderer/render-html-page.js

@@ -1,5 +1,8 @@
 export const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };

package/dist/esm/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/esm/renderer/vite-application-renderer.js

@@ -11,6 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from '@nestjs/common';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 import { HTML_LOADER_INTERFACE } from '../html-loader/html-loader.interface.js';
 import { SSR_ENTRY_INTERFACE } from '../ssr-entry/ssr-entry.interface.js';
 import { VITE_SSR_OPTIONS } from '../vite.constants.js';
@@ -19,16 +20,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: fillHtmlTemplate(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: fillHtmlTemplate(html, page, nonce), statusCode: page.statusCode };
     }
 };
 ViteApplicationRenderer = __decorate([
@@ -36,6 +40,7 @@ ViteApplicationRenderer = __decorate([
     __param(0, Inject(SSR_ENTRY_INTERFACE)),
     __param(1, Inject(HTML_LOADER_INTERFACE)),
     __param(2, Inject(VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, Inject(ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);
 export { ViteApplicationRenderer };

package/dist/esm/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/esm/vite-ssr.module.js

@@ -4,8 +4,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+import { ConfigsModule } from '@libs-for-dev/nestjs-config-module';
 import { Module } from '@nestjs/common';
 import { APP_FILTER } from '@nestjs/core';
+import { ContentSecurityPolicyConfig } from './content-security-policy/content-security-policy.config.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy/content-security-policy.environment.js';
 import { NotFoundFilter } from './filters/not-found.filter.js';
 import { HtmlLoaderWithVite } from './html-loader/html-loader-with-vite.js';
 import { HTML_LOADER_INTERFACE } from './html-loader/html-loader.interface.js';
@@ -34,7 +37,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [ViteModule],
+            imports: [
+                ConfigsModule.forFeature([ContentSecurityPolicyConfig], [ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: VITE_SSR_OPTIONS, useValue: options },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/nestjs-vite",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Мост Vite ↔ NestJS для SSR: dev-обвязка, загрузка HTML и ssr-entry",
   "keywords": [
     "nestjs",
@@ -66,6 +66,7 @@
     "test:unit": "vitest run"
   },
   "devDependencies": {
+    "@libs-for-dev/nestjs-config-module": "3.0.0",
     "@nestjs/common": "^11.2.1",
     "@nestjs/core": "^11.2.1",
     "@nestjs/platform-fastify": "^11.2.1",
@@ -73,6 +74,8 @@
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
     "@types/node": "^26.2.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.12.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
@@ -81,9 +84,12 @@
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
+    "@libs-for-dev/nestjs-config-module": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-fastify": "^11.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.0.0",
     "vite": "^8.0.0"
   },