@dwp/govuk-casa 8.0.1 → 8.1.0

package/dist/lib/configuration-ingestor.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateEvents = exports.validatePlugins = exports.validateGlobalHooks = exports.validatePlan = exports.validatePages = exports.validateFields = exports.validatePageHooks = exports.validateSessionCookieSameSite = exports.validateSessionCookiePath = exports.validateSessionStore = exports.validateSessionSecure = exports.validateSessionName = exports.validateSessionTtl = exports.validateSessionSecret = exports.validateViews = exports.validateSessionObject = exports.validateMountUrl = exports.validateI18nLocales = exports.validateI18nDirs = exports.validateI18nObject = void 0;
+exports.validateHelmetConfigurator = exports.validateEvents = exports.validatePlugins = exports.validateGlobalHooks = exports.validatePlan = exports.validatePages = exports.validateFields = exports.validatePageHooks = exports.validateSessionCookieSameSite = exports.validateSessionCookiePath = exports.validateSessionStore = exports.validateSessionSecure = exports.validateSessionName = exports.validateSessionTtl = exports.validateSessionSecret = exports.validateViews = exports.validateSessionObject = exports.validateMountUrl = exports.validateI18nLocales = exports.validateI18nDirs = exports.validateI18nObject = void 0;
 /* eslint-disable sonarjs/no-duplicate-string */
 const field_js_1 = require("./field.js");
 const Plan_js_1 = __importDefault(require("./Plan.js"));
@@ -44,6 +44,11 @@ const utils_js_1 = require("./utils.js");
  * @property {PageHook[]} [hooks=[]] Page-specific hooks (optional, default [])
  * @property {PageField[]} [fields=[]] Fields to be managed on this page (optional, default [])
  */
+/**
+ * @callback HelmetConfigurator
+ * @param {object} config A default Helmet configuration provided by CASA
+ * @returns {object} The modified configuration object
+ */
 /**
  * Configure some middleware for use in creating a new CASA app.
  *
@@ -418,6 +423,20 @@ function validateEvents(events) {
     return events;
 }
 exports.validateEvents = validateEvents;
+/**
+ * Validates helmet configuration function.
+ *
+ * @param {HelmetConfigurator} helmetConfigurator Configuration function
+ * @returns {HelmetConfigurator} Validated configuration function
+ * @throws {TypeError} when passed a non-function
+ */
+function validateHelmetConfigurator(helmetConfigurator) {
+    if (helmetConfigurator !== undefined && !(helmetConfigurator instanceof Function)) {
+        throw new TypeError('Helmet configurator must be a function');
+    }
+    return helmetConfigurator;
+}
+exports.validateHelmetConfigurator = validateHelmetConfigurator;
 /**
  * Ingest, validate, sanitise and manipulate configuration parameters.
  *
@@ -456,6 +475,8 @@ function ingest(config = {}) {
         plugins: validatePlugins(config.plugins),
         // Events
         events: validateEvents(config.events),
+        // Helmet configuration
+        helmetConfigurator: validateHelmetConfigurator(config.helmetConfigurator),
     };
     // Freeze to modifications
     Object.freeze(parsed);

package/dist/lib/configure.js

@@ -72,7 +72,7 @@ function configure(config = {}) {
     }, pages = [], plan = null, hooks = [], plugins = [], events = [], i18n = {
         dirs: [],
         locales: ['en', 'cy'],
-    }, } = (0, configuration_ingestor_js_1.default)(config);
+    }, helmetConfigurator = undefined, } = (0, configuration_ingestor_js_1.default)(config);
     // Prepare all page hooks so they are prefixed with the `journey.` scope.
     pages.forEach((page) => {
         var _a;
@@ -92,7 +92,7 @@ function configure(config = {}) {
     // Prepare mandatory middleware
     // These _must_ be added to the ExpressJS application at the start and end
     // of all other middleware respectively.
-    const preMiddleware = (0, pre_js_1.default)();
+    const preMiddleware = (0, pre_js_1.default)({ helmetConfigurator });
     const postMiddleware = (0, post_js_1.default)({ mountUrl });
     // Prepare common middleware mounted prior to the ancillaryRouter
     const cookieParserMiddleware = (0, cookie_parser_1.default)(session.secret);

package/dist/lib/index.js

@@ -5,7 +5,11 @@
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];

package/dist/lib/utils.d.ts

@@ -43,6 +43,14 @@ export function validateWaypoint(waypoint: any): void;
 export function validateView(view: any): void;
 export function validateHookName(hookName: any): void;
 export function validateHookPath(path: any): void;
+/**
+ * Checks if the given string can be used as an object key.
+ *
+ * @param {string} key Proposed Object key
+ * @returns {string} Same key if it's valid
+ * @throws {Error} if proposed key is an invalid keyword
+ */
+export function notProto(key: string): string;
 export type GlobalHook = import('./configuration-ingestor').GlobalHook;
 export type PageHook = import('./configuration-ingestor').PageHook;
 export type Hook = GlobalHook | PageHook;

package/dist/lib/utils.js

@@ -3,7 +3,7 @@
  * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
+exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
 /**
  * @typedef {import('./configuration-ingestor').PageHook} PageHook
  */
@@ -111,3 +111,17 @@ function validateHookPath(path) {
     }
 }
 exports.validateHookPath = validateHookPath;
+/**
+ * Checks if the given string can be used as an object key.
+ *
+ * @param {string} key Proposed Object key
+ * @returns {string} Same key if it's valid
+ * @throws {Error} if proposed key is an invalid keyword
+ */
+function notProto(key) {
+    if (['__proto__', 'constructor', 'prototype'].includes(String(key).toLowerCase())) {
+        throw new Error('Attempt to use prototype key disallowed');
+    }
+    return key;
+}
+exports.notProto = notProto;

package/dist/lib/validators/dateObject.d.ts

@@ -1,4 +1,5 @@
 export default class DateObject extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/email.d.ts

@@ -1,4 +1,6 @@
 export default class Email extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/inArray.d.ts

@@ -1,4 +1,6 @@
 export default class InArray extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | string[] | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/nino.d.ts

@@ -1,4 +1,6 @@
 export default class Nino extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/postalAddressObject.d.ts

@@ -1,4 +1,5 @@
 export default class PostalAddressObject extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/regex.d.ts

@@ -1,4 +1,6 @@
 export default class Regex extends ValidatorFactory {
     name: string;
+    validate(value?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/required.d.ts

@@ -1,4 +1,8 @@
 export default class Required extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | (string | undefined)[] | {
+        [k: string]: string | undefined;
+    } | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/strlen.d.ts

@@ -1,4 +1,6 @@
 export default class Strlen extends ValidatorFactory {
     name: string;
+    validate(inputValue?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/wordCount.d.ts

@@ -1,5 +1,7 @@
 export default class WordCount extends ValidatorFactory {
     name: string;
     count(input: any): any;
+    validate(inputValue?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/middleware/post.js

@@ -9,7 +9,7 @@ const log = (0, logger_js_1.default)('middleware:post');
 function postMiddleware({ mountUrl, }) {
     return [
         (req, res) => {
-            res.render('casa/errors/404.njk');
+            res.status(404).render('casa/errors/404.njk');
         },
         /* eslint-disable-next-line no-unused-vars */
         (err, req, res, next) => {

package/dist/middleware/pre.d.ts

@@ -1,3 +1,5 @@
-/// <reference types="node" />
-declare function _default(): ((req: import("http").IncomingMessage, res: import("http").ServerResponse, next: (err?: unknown) => void) => void)[];
+declare function _default({ helmetConfigurator, }?: {
+    helmetConfigurator: HelmetConfigurator;
+}): Function[];
 export default _default;
+export type HelmetConfigurator = import('../lib/configuration-ingestor').HelmetConfigurator;

package/dist/middleware/pre.js

@@ -5,7 +5,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
-exports.default = () => [
+const GA_DOMAIN = 'www.google-analytics.com';
+const GTM_DOMAIN = 'www.googletagmanager.com';
+/**
+ * @typedef {import('../lib/configuration-ingestor').HelmetConfigurator} HelmetConfigurator
+ */
+/**
+ * Pre middleware.
+ *
+ * @param {object} opts Options
+ * @param {HelmetConfigurator} opts.helmetConfigurator Function to customise Helmet configuration
+ * @returns {Function[]} List of middleware
+ */
+exports.default = ({ helmetConfigurator = (config) => (config), } = {}) => [
     // Only allow certain request methods
     (req, res, next) => {
         if (req.method !== 'GET' && req.method !== 'POST') {
@@ -35,17 +47,23 @@ exports.default = () => [
         next();
     },
     // Helmet suite of headers
-    (0, helmet_1.default)({
+    (0, helmet_1.default)(helmetConfigurator({
         // Allows GA which is typically used, and a known inline script nonce
         contentSecurityPolicy: {
             useDefaults: true,
             directives: {
-                'script-src': ["'self'", 'www.google-analytics.com', 'www.googletagmanager.com', (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'style-src': ["'self'", 'https:', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'default-src': ["'none'"],
+                'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'img-src': ["'self'", GA_DOMAIN],
+                'connect-src': ["'self'", GA_DOMAIN],
+                'frame-src': ["'self'", GTM_DOMAIN],
+                'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],
+                'style-src': ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'font-src': ["'self'"],
             },
         },
         // // Require referrer to aid navigation
         // referrerPolicy: 'no-referrer, same-origin',
-    }),
+    })),
 ];

package/dist/middleware/session.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "8.0.1",
+  "version": "8.1.0",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
   "repository": {
     "type": "git",
@@ -45,48 +45,48 @@
     "csurf": "1.11.0",
     "debug": "4.3.3",
     "deepmerge": "4.2.2",
-    "express": "4.17.2",
+    "express": "4.17.3",
     "express-session": "1.17.2",
-    "govuk-frontend": "4.0.0",
+    "govuk-frontend": "4.0.1",
     "graphlib": "2.1.8",
-    "helmet": "5.0.1",
-    "i18next": "21.6.6",
-    "i18next-http-middleware": "3.1.5",
+    "helmet": "5.0.2",
+    "i18next": "21.6.14",
+    "i18next-http-middleware": "3.2.0",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "luxon": "2.3.0",
+    "luxon": "2.3.1",
     "nunjucks": "3.2.3",
     "uuid": "8.3.2",
-    "validator": "^13.7.0"
+    "validator": "13.7.0"
   },
   "devDependencies": {
-    "@babel/core": "7.16.7",
-    "@babel/eslint-parser": "7.16.5",
-    "@babel/preset-env": "7.16.8",
-    "@commitlint/config-conventional": "16.0.0",
-    "@dwp/casa-spiderplan": "2.0.0",
-    "@dwp/casa-spiderplan-a11y-plugin": "0.1.3",
+    "@babel/core": "7.17.5",
+    "@babel/eslint-parser": "7.17.0",
+    "@babel/preset-env": "7.16.11",
+    "@commitlint/config-conventional": "16.2.1",
+    "@dwp/casa-spiderplan": "2.4.0",
+    "@dwp/casa-spiderplan-a11y-plugin": "0.1.4",
     "@dwp/casa-spiderplan-zap-plugin": "0.1.1",
     "@dwp/eslint-config-base": "6.0.0",
     "@types/express": "4.17.13",
-    "@types/node": "17.0.8",
+    "@types/node": "17.0.21",
     "@types/nunjucks": "3.2.1",
     "babel-eslint": "10.1.0",
     "c8": "7.11.0",
-    "chai": "4.3.4",
-    "commitlint": "16.0.2",
-    "eslint": "8.6.0",
+    "chai": "4.3.6",
+    "commitlint": "16.2.1",
+    "eslint": "8.10.0",
     "eslint-plugin-no-unsafe-regex": "1.0.0",
     "eslint-plugin-security": "1.4.0",
-    "eslint-plugin-sonarjs": "0.11.0",
-    "fast-check": "2.21.0",
+    "eslint-plugin-sonarjs": "0.12.0",
+    "fast-check": "2.22.0",
     "husky": "7.0.4",
-    "mocha": "9.1.3",
-    "sass": "1.47.0",
-    "sinon": "12.0.1",
+    "mocha": "9.2.1",
+    "sass": "1.49.9",
+    "sinon": "13.0.1",
     "sinon-chai": "3.7.0",
     "standard-version": "9.3.2",
-    "supertest": "6.2.1",
-    "typescript": "4.5.4"
+    "supertest": "6.2.2",
+    "typescript": "4.6.2"
   }
 }