@dwp/govuk-casa 8.0.3 → 8.2.1

package/dist/lib/configure.js

@@ -3,11 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
 const express_session_1 = require("express-session");
 const path_1 = require("path");
 const module_1 = require("module");
 const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const path_to_regexp_1 = require("path-to-regexp");
 const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
+const utils_js_1 = require("./utils.js");
 const configuration_ingestor_js_1 = __importDefault(require("./configuration-ingestor.js"));
 const nunjucks_js_1 = __importDefault(require("./nunjucks.js"));
 const static_js_1 = __importDefault(require("../routes/static.js"));
@@ -20,36 +23,20 @@ const i18n_js_1 = __importDefault(require("../middleware/i18n.js"));
 const data_js_1 = __importDefault(require("../middleware/data.js"));
 const body_parser_js_1 = __importDefault(require("../middleware/body-parser.js"));
 const csrf_js_1 = __importDefault(require("../middleware/csrf.js"));
+const logger_js_1 = __importDefault(require("./logger.js"));
+const log = (0, logger_js_1.default)('lib:configure');
 /**
- * @typedef {import('express').RequestHandler} ExpressRequestHandler
+ * @typedef {import('../casa').ConfigurationOptions} ConfigurationOptions
  */
 /**
- * @typedef {import('./index').MutableRouter} MutableRouter
+ * @typedef {import('../casa').ConfigurationOptions} ConfigureResult
  */
 /**
- * @typedef {import('./configuration-ingestor').ConfigurationOptions} ConfigurationOptions
- */
-/**
- * @typedef {object} ConfigureResult Result of a call to configure() function
- * @property {nunjucks.Environment} nunjucksEnv Nunjucks environment
- * @property {MutableRouter} staticRouter Router handling all static assets
- * @property {MutableRouter} ancillaryRouter Router handling ancillary routes
- * @property {MutableRouter} journeyRouter Router handling all waypoint requests
- * @property {ExpressRequestHandler[]} preMiddleware Middleware mounted before anything else
- * @property {ExpressRequestHandler[]} postMiddleware Middleware mounted after everything else
- * @property {ExpressRequestHandler[]} csrfMiddleware CSRF get/set middleware (useful for forms)
- * @property {ExpressRequestHandler} sessionMiddleware Session middleware
- * @property {ExpressRequestHandler[]} cookieParserMiddleware Cookie-parsing middleware
- * @property {ExpressRequestHandler[]} i18nMiddleware I18n preparation middleware
- * @property {ExpressRequestHandler} bodyParserMiddleware Body parsing middleware
- * @property {Function} mount Function used to mount all CASA artifacts onto an ExpressJS app
+ * @typedef {import('../casa').Mounter} Mounter
  */
 /**
  * Configure some middleware for use in creating a new CASA app.
  *
- * `mountUrl` is used to ensure the CSS content uses the correct reference to
- * static assets in the `govuk-frontend` module.
- *
  * @param {ConfigurationOptions} config Configuration options
  * @returns {ConfigureResult} Result
  */
@@ -72,7 +59,7 @@ function configure(config = {}) {
     }, pages = [], plan = null, hooks = [], plugins = [], events = [], i18n = {
         dirs: [],
         locales: ['en', 'cy'],
-    }, } = (0, configuration_ingestor_js_1.default)(config);
+    }, helmetConfigurator = undefined, } = (0, configuration_ingestor_js_1.default)(config);
     // Prepare all page hooks so they are prefixed with the `journey.` scope.
     pages.forEach((page) => {
         var _a;
@@ -82,7 +69,6 @@ function configure(config = {}) {
     // Prepare a Nunjucks environment for rendering all templates.
     // Resolve priority: userland templates > CASA templates > GOVUK templates > Plugin templates
     const nunjucksEnv = (0, nunjucks_js_1.default)({
-        mountUrl,
         views: [
             ...views,
             (0, path_1.resolve)(dirname_cjs_1.default, '../../views'),
@@ -92,8 +78,8 @@ function configure(config = {}) {
     // Prepare mandatory middleware
     // These _must_ be added to the ExpressJS application at the start and end
     // of all other middleware respectively.
-    const preMiddleware = (0, pre_js_1.default)();
-    const postMiddleware = (0, post_js_1.default)({ mountUrl });
+    const preMiddleware = (0, pre_js_1.default)({ helmetConfigurator });
+    const postMiddleware = (0, post_js_1.default)();
     // Prepare common middleware mounted prior to the ancillaryRouter
     const cookieParserMiddleware = (0, cookie_parser_1.default)(session.secret);
     const sessionMiddleware = (0, session_js_1.default)({
@@ -104,7 +90,6 @@ function configure(config = {}) {
         ttl: session.ttl,
         cookieSameSite: session.cookieSameSite,
         cookiePath: session.cookiePath,
-        mountUrl,
         store: (_b = session.store) !== null && _b !== void 0 ? _b : new express_session_1.MemoryStore(),
     });
     const i18nMiddleware = (0, i18n_js_1.default)({
@@ -117,7 +102,6 @@ function configure(config = {}) {
     });
     const dataMiddleware = (0, data_js_1.default)({
         plan,
-        mountUrl,
         events,
     });
     // Prepare form middleware and its constiuent parts
@@ -125,9 +109,7 @@ function configure(config = {}) {
     const bodyParserMiddleware = (0, body_parser_js_1.default)();
     const csrfMiddleware = (0, csrf_js_1.default)();
     // Setup router to serve up bundled static assets
-    const staticRouter = (0, static_js_1.default)({
-        mountUrl,
-    });
+    const staticRouter = (0, static_js_1.default)();
     // Setup ancillary router default stand-alone pages.
     const ancillaryRouter = (0, ancillary_js_1.default)({
         sessionTtl: session.ttl,
@@ -138,25 +120,107 @@ function configure(config = {}) {
         pages,
         plan,
         csrfMiddleware,
-        mountUrl,
     });
     // Mount function
     // This will mount all of these routes and middleware in the correct order on
     // the given ExpressJS app.
     // Once this is called, you will not be able to modify any of the routers as
     // they will be "sealed".
-    const mount = (app) => {
+    /**
+     * Mounting function.
+     *
+     * @type {Mounter} mount
+     */
+    const mount = (app, { route = '/' } = {}) => {
         nunjucksEnv.express(app);
         app.set('view engine', 'njk');
+        // !!! DEPRECATION NOTICE !!!
+        // This provides a non-breaking pathway to replacing `mountUrl` with
+        // `req.baseUrl` in all internal route handlers/middleware for services
+        // that use a proxy path in their mount point.
+        //
+        // In some cases, the URL on which `app` instance is mounted might include a
+        // proxy path so that it can handle incoming requests that have had a path
+        // prepended to it by an intermediary, such as nginx. This would be common
+        // in a hosting environment that serves several separate applications.
+        //
+        // This bit of middleware removes that proxy path segment from the request
+        // so that all subsequent middleware behave as if it was never present.
+        //
+        // e.g. Where the proxy path is `my-proxy`, then a request to
+        // `/my-proxy/app` will be seen as `/app` in all subsequent middleware, and
+        // all URLs generated for the browser will use `/app`.
+        //
+        // Using `config.mountUrl` rather than `mountUrl` here to test whether the
+        // consumer explicitly set a `mountUrl`, in which case we're dealing with
+        // backwards-compatibility mode.
+        //
+        // This intervention would not be needed for apps that omit `mountUrl` as if
+        // so, it's assumed they're following the guidance for setting up a proxy
+        // as described in `docs/guides/setup-behind-a-proxy.md`.
+        if (config.mountUrl) {
+            log.warn('[DEPRECATION WARNING] Using configuration attribute, mountUrl. This will be removed in an upcoming major version');
+            app.use((req, res, next) => {
+                // Mimic what the `docs/guides/setup-behind-a-proxy.md` guidance
+                // recommends for stripping off any proxy prefixes to leave just the
+                // "mountUrl" remaining.
+                const originalBaseUrl = req.baseUrl;
+                req.baseUrl = mountUrl.replace(/\/$/, '');
+                // If the app has been mounted directly on the specific `mountUrl`, then
+                // there's nothing we need to do and can let this request pass-through.
+                if (req.baseUrl === originalBaseUrl) {
+                    next();
+                }
+                else if (req.__CASA_BASE_URL_REWRITTEN__) {
+                    delete req.__CASA_BASE_URL_REWRITTEN__;
+                    next();
+                }
+                else {
+                    // Issuing this call will re-run this same middleware, so we use this
+                    // `__CASA_BASE_URL_REWRITTEN__` flag to prevent recursion.
+                    req.__CASA_BASE_URL_REWRITTEN__ = true;
+                    req.app.handle(req, res, next);
+                }
+            });
+        }
+        // Attach a handler to redirect requests for `/` to the first waypoint in
+        // the plan
+        if (plan) {
+            const re = (0, path_to_regexp_1.pathToRegexp)(`${route}`.replace(/\/+/g, '/'));
+            app.use(re, (req, res) => {
+                const reqUrl = new URL(req.url, 'https://placeholder.test/');
+                const reqPath = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}${reqUrl.pathname}${plan.getWaypoints()[0]}`);
+                let reqParams = reqUrl.searchParams.toString();
+                reqParams = reqParams ? `?${reqParams}` : '';
+                res.redirect(302, `${reqPath}${reqParams}`);
+            });
+        }
+        // Service static assets from the `app` rather than the `router`. The router
+        // may contain paramaterised path segments which would mean serving static
+        // assets over a dynamic URL each time, thus causing lots of cache misses on
+        // the browser.
+        const sealedStaticRouter = staticRouter.seal();
         app.use(preMiddleware);
-        app.use(staticRouter.seal());
-        app.use(sessionMiddleware); // A session is useful to all pages, so always mounted
-        app.use(i18nMiddleware);
-        app.use(bodyParserMiddleware);
-        app.use(dataMiddleware);
-        app.use(ancillaryRouter.seal());
-        app.use(journeyRouter.seal());
-        app.use(postMiddleware);
+        app.use(sealedStaticRouter);
+        const router = (0, express_1.Router)({
+            // Required so that any parameters in the URL are propagated to middleware
+            mergeParams: true,
+        });
+        router.use(preMiddleware);
+        // !!! DEPRECATE in v9 !!! For performance reasons, static assets will
+        // always be handled via the `app` middleware rather than `router`.
+        // Anywhere `mountUrl` is used in templates to service static assets must be
+        // changed to use `staticMountUrl`.
+        // TASK: remove this line below
+        router.use(sealedStaticRouter);
+        router.use(sessionMiddleware);
+        router.use(i18nMiddleware);
+        router.use(bodyParserMiddleware);
+        router.use(dataMiddleware);
+        router.use(ancillaryRouter.seal());
+        router.use(journeyRouter.seal());
+        router.use(postMiddleware);
+        app.use(route, router);
         return app;
     };
     // Prepare configuration result

package/dist/lib/index.js

@@ -5,7 +5,11 @@
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];

package/dist/lib/nunjucks.d.ts

@@ -1,6 +1,5 @@
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -9,12 +8,8 @@
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-export default function nunjucksConfig({ mountUrl, views, }: NunjucksOptions): Environment;
+export default function nunjucksConfig({ views, }: NunjucksOptions): Environment;
 export type NunjucksOptions = {
-    /**
-     * )
-     */
-    mountUrl?: string | undefined;
     /**
      * Template file directories (optional, default [])
      */

package/dist/lib/nunjucks.js

@@ -11,7 +11,6 @@ const CasaTemplateLoader_js_1 = __importDefault(require("./CasaTemplateLoader.js
 const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -20,7 +19,7 @@ const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-function nunjucksConfig({ mountUrl = '/', views = [], }) {
+function nunjucksConfig({ views = [], }) {
     // Prepare a single Nunjucks environment for all responses to use. Note that
     // we cannot prepare response-specific global functions/filters if we use a
     // single environment, but the performance gains of doing so are significant.
@@ -38,7 +37,6 @@ function nunjucksConfig({ mountUrl = '/', views = [], }) {
     env.modifyBlock = loader.modifyBlock.bind(loader);
     // Globals
     // These can't be modified once set. But they can be overridden by res.locals.
-    env.addGlobal('assetPath', `${mountUrl}govuk/assets`); // Required by govuk-frontend layout template
     env.addGlobal('casaVersion', JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../package.json'))).version);
     env.addGlobal('mergeObjects', nunjucks_filters_js_1.mergeObjects);
     env.addGlobal('includes', nunjucks_filters_js_1.includes);

package/dist/lib/utils.d.ts

@@ -1,11 +1,5 @@
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
- */
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 /**
  * Test is a value can be stringifed (numbers or strings)
@@ -40,9 +34,26 @@ export function isEmpty(val: any): boolean;
  */
 export function resolveMiddlewareHooks(hookName: string, path: string, hooks?: Hook[]): Function[];
 export function validateWaypoint(waypoint: any): void;
+export function validateUrlPath(path: any): string;
 export function validateView(view: any): void;
 export function validateHookName(hookName: any): void;
 export function validateHookPath(path: any): void;
-export type GlobalHook = import('./configuration-ingestor').GlobalHook;
-export type PageHook = import('./configuration-ingestor').PageHook;
-export type Hook = GlobalHook | PageHook;
+/**
+ * Checks if the given string can be used as an object key.
+ *
+ * @param {string} key Proposed Object key
+ * @returns {string} Same key if it's valid
+ * @throws {Error} if proposed key is an invalid keyword
+ */
+export function notProto(key: string): string;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+export function stripProxyFromUrlPath(req: import('express').Request): string;
+export type Hook = import('../casa').GlobalHook | import('../casa').PageHook;

package/dist/lib/utils.js

@@ -1,15 +1,9 @@
 "use strict";
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
- */
+exports.stripProxyFromUrlPath = exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateUrlPath = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
 /**
  * Test is a value can be stringifed (numbers or strings)
  *
@@ -81,6 +75,19 @@ function validateWaypoint(waypoint) {
     }
 }
 exports.validateWaypoint = validateWaypoint;
+function validateUrlPath(path) {
+    if (typeof path !== 'string') {
+        throw new TypeError('URL path must be a string');
+    }
+    if (path.match(/[^/a-z0-9_-]/)) {
+        throw new SyntaxError('URL path must contain only a-z, 0-9, -, _ and / characters');
+    }
+    if (path.match(/\/{2,}/)) {
+        throw new SyntaxError('URL path must not contain consecutive /');
+    }
+    return path;
+}
+exports.validateUrlPath = validateUrlPath;
 function validateView(view) {
     if (typeof view !== 'string') {
         throw new TypeError('View must be a string');
@@ -111,3 +118,42 @@ function validateHookPath(path) {
     }
 }
 exports.validateHookPath = validateHookPath;
+/**
+ * Checks if the given string can be used as an object key.
+ *
+ * @param {string} key Proposed Object key
+ * @returns {string} Same key if it's valid
+ * @throws {Error} if proposed key is an invalid keyword
+ */
+function notProto(key) {
+    if (['__proto__', 'constructor', 'prototype'].includes(String(key).toLowerCase())) {
+        throw new Error('Attempt to use prototype key disallowed');
+    }
+    return key;
+}
+exports.notProto = notProto;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+function stripProxyFromUrlPath(req) {
+    if (typeof req.app.mountpath !== 'string') {
+        throw new Error('CASA does not currently support multiple mountpaths');
+    }
+    let stripped = '/';
+    const mountPathParts = req.app.mountpath.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    const baseUrlParts = req.baseUrl.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    for (let i = 0, l = mountPathParts.length; i < l; i++) {
+        /* eslint-disable-next-line security/detect-object-injection */
+        if (baseUrlParts.length && mountPathParts[i] === baseUrlParts[0]) {
+            stripped = `${stripped}${baseUrlParts.shift()}/`;
+        }
+    }
+    return stripped;
+}
+exports.stripProxyFromUrlPath = stripProxyFromUrlPath;

package/dist/lib/validators/dateObject.d.ts

@@ -1,4 +1,5 @@
 export default class DateObject extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/email.d.ts

@@ -1,4 +1,6 @@
 export default class Email extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/inArray.d.ts

@@ -1,4 +1,6 @@
 export default class InArray extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | string[] | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/nino.d.ts

@@ -1,4 +1,6 @@
 export default class Nino extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/postalAddressObject.d.ts

@@ -1,4 +1,5 @@
 export default class PostalAddressObject extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/regex.d.ts

@@ -1,4 +1,6 @@
 export default class Regex extends ValidatorFactory {
     name: string;
+    validate(value?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/required.d.ts

@@ -1,4 +1,8 @@
 export default class Required extends ValidatorFactory {
     name: string;
+    validate(value: any, dataContext?: {}): object[];
+    sanitise(value: any): string | (string | undefined)[] | {
+        [k: string]: string | undefined;
+    } | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/strlen.d.ts

@@ -1,4 +1,6 @@
 export default class Strlen extends ValidatorFactory {
     name: string;
+    validate(inputValue?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/validators/wordCount.d.ts

@@ -1,5 +1,7 @@
 export default class WordCount extends ValidatorFactory {
     name: string;
     count(input: any): any;
+    validate(inputValue?: string, dataContext?: {}): object[];
+    sanitise(value: any): string | undefined;
 }
 import ValidatorFactory from "../ValidatorFactory.js";

package/dist/lib/waypoint-url.js

@@ -32,8 +32,14 @@ function waypointUrl({ waypoint = '', mountUrl = '/', journeyContext, edit = fal
     else {
         url.pathname = `${mountUrl}${waypoint}`;
     }
-    // Attach context id for non-default contexts
-    if (journeyContext && !journeyContext.isDefault() && journeyContext.identity.id) {
+    // Attach context ID as query parameter for non-default contexts.
+    // To avoid messy URLs with duplicated content, this parameter will _not_ be
+    // added if the context ID already appears in the url path, i.e. to avoid
+    // `/path/1234-abcd/waypoint?contextid=1234-abcd` scenarios
+    if (journeyContext
+        && !journeyContext.isDefault()
+        && journeyContext.identity.id
+        && !mountUrl.includes(journeyContext.identity.id)) {
         url.searchParams.append('contextid', journeyContext.identity.id);
     }
     // Attach edit mode flag

package/dist/middleware/body-parser.js

@@ -6,7 +6,7 @@ const rProto = /__proto__/i;
 const rPrototype = /prototype[='"[\]]/i;
 const rConstructor = /constructor[='"[\]]/i;
 function verifyBody(req, res, buf, encoding) {
-    const body = decodeURI(buf.toString(encoding));
+    const body = decodeURI(buf.toString(encoding)).replace(/[\s\u200B-\u200D\uFEFF]/g, '');
     if (rProto.test(body)) {
         throw new Error('Request body verification failed (__proto__)');
     }

package/dist/middleware/data.d.ts

@@ -1,5 +1,4 @@
-export default function dataMiddleware({ plan, mountUrl, events, }: {
+export default function dataMiddleware({ plan, events, }: {
     plan: any;
-    mountUrl: any;
     events: any;
 }): ((req: any, res: any, next: any) => void)[];

package/dist/middleware/data.js

@@ -7,6 +7,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const lodash_1 = __importDefault(require("lodash"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const utils_js_1 = require("../lib/utils.js");
 const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const { has } = lodash_1.default;
 const editOrigin = (req) => {
@@ -18,7 +19,7 @@ const editOrigin = (req) => {
     }
     return '';
 };
-function dataMiddleware({ plan, mountUrl, events, }) {
+function dataMiddleware({ plan, events, }) {
     return [
         (req, res, next) => {
             /* ------------------------------------------------ Request decorations */
@@ -34,16 +35,25 @@ function dataMiddleware({ plan, mountUrl, events, }) {
             // Grab chosen language from session
             req.casa.journeyContext.nav.language = req.session.language;
             /* ------------------------------------------------- Template variables */
+            // Figure out the mount URL of the current request
+            const mountUrl = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`.replace(/\/+/g, '/'));
+            // For browser performance reasons, CASA's static assets are potentially
+            // delivered over a different route to the `mountUrl` if this CASA app has
+            // been mounted on a parameterised route.
+            const staticMountUrl = (0, utils_js_1.validateUrlPath)(`${(0, utils_js_1.stripProxyFromUrlPath)(req)}`.replace(/\/+/g, '/'));
             // CASA and userland templates
             res.locals.casa = {
                 mountUrl,
+                staticMountUrl,
                 editMode: req.casa.editMode,
                 editOrigin: req.casa.editOrigin,
             };
             res.locals.locale = req.language;
             // Used by govuk-frontend template
-            // - req.language is provided by i18n-http-middleware
+            //   htmlLang = req.language is provided by i18n-http-middleware
+            //   assetPath = used for linking to static assets in the govuk-frontend module
             res.locals.htmlLang = req.language;
+            res.locals.assetPath = `${staticMountUrl}govuk/assets`;
             // Function for building URLs. This will be curried with the `mountUrl`,
             // `journeyContext`, `edit` and `editOrigin` for convenience. This means
             // the template author does not have to be concerned about the current

package/dist/middleware/post.d.ts

@@ -1,3 +1 @@
-export default function postMiddleware({ mountUrl, }: {
-    mountUrl: any;
-}): ((err: any, req: any, res: any, next: any) => any)[];
+export default function postMiddleware(): ((err: any, req: any, res: any, next: any) => any)[];

package/dist/middleware/post.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // 2 middleware: one as a fallback 404 handler, one to handle thrown errors
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:post');
-function postMiddleware({ mountUrl, }) {
+function postMiddleware() {
     return [
         (req, res) => {
             res.status(404).render('casa/errors/404.njk');
@@ -20,7 +20,7 @@ function postMiddleware({ mountUrl, }) {
             let TEMPLATE = 'casa/errors/500.njk';
             if (!res.locals.t) {
                 res.locals.t = () => ('');
-                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl });
+                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl: `${req.baseUrl}/` });
                 TEMPLATE = 'casa/errors/static.njk';
             }
             // CSRF token is invalid in some way

package/dist/middleware/pre.d.ts

@@ -1,3 +1,5 @@
-/// <reference types="node" />
-declare function _default(): ((req: import("http").IncomingMessage, res: import("http").ServerResponse, next: (err?: unknown) => void) => void)[];
+declare function _default({ helmetConfigurator, }?: {
+    helmetConfigurator: HelmetConfigurator;
+}): Function[];
 export default _default;
+export type HelmetConfigurator = import('../casa').HelmetConfigurator;

package/dist/middleware/pre.js

@@ -5,9 +5,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
-const GA_DOMAIN = 'www.google-analytics.com';
+const GA_DOMAIN = '*.google-analytics.com';
+const GA_ANALYTICS_DOMAIN = '*.analytics.google.com';
 const GTM_DOMAIN = 'www.googletagmanager.com';
-exports.default = () => [
+/**
+ * @typedef {import('../casa').HelmetConfigurator} HelmetConfigurator
+ */
+/**
+ * Pre middleware.
+ *
+ * @param {object} opts Options
+ * @param {HelmetConfigurator} opts.helmetConfigurator Function to customise Helmet configuration
+ * @returns {Function[]} List of middleware
+ */
+exports.default = ({ helmetConfigurator = (config) => (config), } = {}) => [
     // Only allow certain request methods
     (req, res, next) => {
         if (req.method !== 'GET' && req.method !== 'POST') {
@@ -37,15 +48,15 @@ exports.default = () => [
         next();
     },
     // Helmet suite of headers
-    (0, helmet_1.default)({
+    (0, helmet_1.default)(helmetConfigurator({
         // Allows GA which is typically used, and a known inline script nonce
         contentSecurityPolicy: {
             useDefaults: true,
             directives: {
                 'default-src': ["'none'"],
                 'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'img-src': ["'self'", GA_DOMAIN],
-                'connect-src': ["'self'", GA_DOMAIN],
+                'img-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
+                'connect-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
                 'frame-src': ["'self'", GTM_DOMAIN],
                 'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],
@@ -55,5 +66,5 @@ exports.default = () => [
         },
         // // Require referrer to aid navigation
         // referrerPolicy: 'no-referrer, same-origin',
-    }),
+    })),
 ];