@camstack/server 1.2.265 → 1.2.267

package/dist/api/static/frame-policy.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAME_ANCESTORS_POLICY = void 0;
+exports.isFramePolicyTarget = isFramePolicyTarget;
+exports.registerFramePolicy = registerFramePolicy;
+/** The one directive: frame me from my origin only. */
+exports.FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
+const CSP_HEADER = 'content-security-policy';
+/** Only a document can be framed; assets, JSON and streams are never one. */
+function isFramePolicyTarget(contentType) {
+    return typeof contentType === 'string' && contentType.trim().toLowerCase().startsWith('text/html');
+}
+/**
+ * Install the `onSend` hook on the hub's one Fastify instance. Replies that
+ * bypass Fastify's reply pipeline (`reply.raw`, `reply.hijack()` — the addon
+ * reverse proxy's streaming path) are not seen here; they carry no HTML
+ * shell of ours.
+ */
+function registerFramePolicy(fastify) {
+    fastify.addHook('onSend', async (_request, reply, payload) => {
+        if (!isFramePolicyTarget(reply.getHeader('content-type')))
+            return payload;
+        if (reply.getHeader(CSP_HEADER) !== undefined)
+            return payload;
+        reply.header(CSP_HEADER, exports.FRAME_ANCESTORS_POLICY);
+        return payload;
+    });
+}

package/dist/main.js

@@ -67,6 +67,7 @@ const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
 const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
 const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
+const frame_policy_1 = require("./api/static/frame-policy");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
 const request_census_settings_1 = require("./api/core/request-census-settings");
@@ -326,6 +327,10 @@ async function bootstrap() {
     app.enableCors();
     const fastify = app.getHttpAdapter().getInstance();
     await fastify.register(cookie_1.default);
+    // Every HTML document the hub serves may be framed by its own origin only
+    // (D425). Stamped here, on the one instance, so no shell-send site added
+    // later can ship without it.
+    (0, frame_policy_1.registerFramePolicy)(fastify);
     // Gzip/Brotli compression for all responses (including static JS/CSS).
     // Registered before @fastify/static so the compress plugin wraps the
     // static send path — hashed admin-ui chunks go from ~2MB to ~600KB on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.265",
+  "version": "1.2.267",
   "private": false,
   "files": [
     "dist",