@arcblock/did-connect-service 4.1.13 → 4.1.14

package/dist/http/security-headers.d.ts

@@ -1,38 +0,0 @@
-/**
- * Shared security headers for server-rendered HTML responses (see issue #72).
- *
- * connect-service renders login/homepage/admin/invite/OAuth/error pages as raw
- * HTML strings from several different handlers (there is no single Hono app /
- * router that all of them funnel through — see the handlers listed at each
- * `htmlResponse` call site). Without a common send point, every one of those
- * handlers previously built its own `new Response(html, { headers: {...} })`
- * and could silently drop hardening headers. `htmlResponse` is the one place
- * that guarantees they don't: every HTML response gets `X-Frame-Options`,
- * `X-Content-Type-Options`, and a CSP, even though the pages themselves stay
- * wherever they are.
- *
- * This is defense-in-depth, not a substitute for fixing individual XSS sinks
- * (see #62/#63/#64) — it limits what an attacker can do *if* one of those sinks
- * is (or becomes) exploitable: no clickjacking (`frame-ancestors 'none'` +
- * `X-Frame-Options: DENY`), no cross-origin script/style loads, no MIME-sniff
- * smuggling (`nosniff`).
- *
- * CSP trade-off (intentional, see #72 discussion): connect-service's pages rely
- * heavily on inline `<script>` blocks (see `packages/connect-service/CLAUDE.md` —
- * Browser Asset Externalization) — the login/OAuth/admin/invite pages all inline
- * small bootstrap scripts alongside externalized asset bundles. Migrating every
- * inline script to a nonce- or hash-based CSP is a much larger, higher-regression-risk
- * change than this issue calls for, so `script-src`/`style-src` keep `'unsafe-inline'`
- * for now. The policy still meaningfully narrows the blast radius (no foreign script
- * origins, no framing, no arbitrary form submission targets). Tightening to a
- * nonce-based CSP is a good follow-up once the inline-script surface is consolidated.
- */
-export declare const HTML_SECURITY_HEADERS: Readonly<Record<string, string>>;
-/**
- * Build a `Response` for server-rendered HTML. Merges the shared security headers
- * (always applied — they are not overridable via `init.headers`, see #72) with
- * caller-supplied headers (`Content-Type` defaults to `text/html; charset=utf-8`
- * unless the caller sets its own, `Cache-Control` etc. pass through untouched).
- */
-export declare function htmlResponse(html: string, init?: ResponseInit): Response;
-//# sourceMappingURL=security-headers.d.ts.map

package/dist/http/security-headers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAmBH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIjE,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,QAAQ,CASxE"}

package/dist/http/security-headers.js

@@ -1,67 +0,0 @@
-/**
- * Shared security headers for server-rendered HTML responses (see issue #72).
- *
- * connect-service renders login/homepage/admin/invite/OAuth/error pages as raw
- * HTML strings from several different handlers (there is no single Hono app /
- * router that all of them funnel through — see the handlers listed at each
- * `htmlResponse` call site). Without a common send point, every one of those
- * handlers previously built its own `new Response(html, { headers: {...} })`
- * and could silently drop hardening headers. `htmlResponse` is the one place
- * that guarantees they don't: every HTML response gets `X-Frame-Options`,
- * `X-Content-Type-Options`, and a CSP, even though the pages themselves stay
- * wherever they are.
- *
- * This is defense-in-depth, not a substitute for fixing individual XSS sinks
- * (see #62/#63/#64) — it limits what an attacker can do *if* one of those sinks
- * is (or becomes) exploitable: no clickjacking (`frame-ancestors 'none'` +
- * `X-Frame-Options: DENY`), no cross-origin script/style loads, no MIME-sniff
- * smuggling (`nosniff`).
- *
- * CSP trade-off (intentional, see #72 discussion): connect-service's pages rely
- * heavily on inline `<script>` blocks (see `packages/connect-service/CLAUDE.md` —
- * Browser Asset Externalization) — the login/OAuth/admin/invite pages all inline
- * small bootstrap scripts alongside externalized asset bundles. Migrating every
- * inline script to a nonce- or hash-based CSP is a much larger, higher-regression-risk
- * change than this issue calls for, so `script-src`/`style-src` keep `'unsafe-inline'`
- * for now. The policy still meaningfully narrows the blast radius (no foreign script
- * origins, no framing, no arbitrary form submission targets). Tightening to a
- * nonce-based CSP is a good follow-up once the inline-script surface is consolidated.
- */
-/** Directives shared by every HTML response. Keep in sync with the pages this
- * protects: assets are same-origin (`assetUrl()` — see `asset-registry.ts`),
- * avatars/branding logos may be arbitrary external `https:` URLs, and all forms /
- * XHR calls target this same origin (OAuth provider redirects are top-level
- * navigations, which CSP does not gate). */
-const CONTENT_SECURITY_POLICY = [
-    "default-src 'self'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: https:",
-    "font-src 'self' data:",
-    "connect-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-    "form-action 'self'",
-].join("; ");
-export const HTML_SECURITY_HEADERS = Object.freeze({
-    "X-Frame-Options": "DENY",
-    "X-Content-Type-Options": "nosniff",
-    "Content-Security-Policy": CONTENT_SECURITY_POLICY,
-});
-/**
- * Build a `Response` for server-rendered HTML. Merges the shared security headers
- * (always applied — they are not overridable via `init.headers`, see #72) with
- * caller-supplied headers (`Content-Type` defaults to `text/html; charset=utf-8`
- * unless the caller sets its own, `Cache-Control` etc. pass through untouched).
- */
-export function htmlResponse(html, init) {
-    const headers = new Headers(init?.headers);
-    if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "text/html; charset=utf-8");
-    }
-    for (const [name, value] of Object.entries(HTML_SECURITY_HEADERS)) {
-        headers.set(name, value);
-    }
-    return new Response(html, { ...init, headers });
-}
-//# sourceMappingURL=security-headers.js.map

package/dist/http/security-headers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;4CAI4C;AAC5C,MAAM,uBAAuB,GAAG;IAC9B,oBAAoB;IACpB,mCAAmC;IACnC,kCAAkC;IAClC,6BAA6B;IAC7B,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,qBAAqB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnF,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,yBAAyB,EAAE,uBAAuB;CACnD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAmB;IAC5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC"}