@freedomofpress/webcat 0.0.0-stage → 3.0.0

package/dist/lib/webcat/logger.d.ts

@@ -0,0 +1,64 @@
+import { RequestDetails } from "../browser/requests";
+import { LogEntry } from "./interfaces/log";
+import { Stateful } from "./interfaces/requeststate";
+type ConsoleLevel = "log" | "warn" | "error" | "info" | "debug";
+declare const globalLogs: LogEntry[];
+declare class Logger {
+    private debugMode;
+    /**
+     * Enable or disable debug mode.
+     * @param enabled - Whether debug mode is enabled.
+     */
+    setDebugMode(enabled: boolean): void;
+    /**
+     * Add a log entry.
+     * @param level - Log level (debug, info, warn, error).
+     * @param message - The log message.
+     * @param tabId - The tab ID associated with the log.
+     * @param origin - The origin of the log (e.g., URL or script).
+     * @param stack - Optional stack trace.
+     */
+    addLog(level: ConsoleLevel, message: string, tabId: number, origin: string, stack?: string): void;
+    /** Adds a log entry with the default level. */
+    log(message: string, details: Stateful<RequestDetails>, stack?: string): void;
+    /** Adds a warning log entry. */
+    warn(message: string, details: Stateful<RequestDetails>, stack?: string): void;
+    /** Adds an error log entry. */
+    error(message: string, details: Stateful<RequestDetails>, stack?: string): void;
+    /** Adds an informational log entry. */
+    info(message: string, details: Stateful<RequestDetails>, stack?: string): void;
+    /** Add a debug log entry. */
+    debug(message: string, details: Stateful<RequestDetails>, stack?: string): void;
+    /**
+     * Determine if a log should be printed based on the debug mode and log level.
+     * @param level - Log level to check.
+     */
+    private shouldPrint;
+    /**
+     * Get all log entries.
+     */
+    getLogs(): LogEntry[];
+    /**
+     * Get logs filtered by level.
+     * @param level - Log level to filter by (debug, info, warn, error).
+     */
+    getLogsByLevel(level: ConsoleLevel): LogEntry[];
+    /**
+     * Get logs filtered by tab ID.
+     * @param tabId - Tab ID to filter by.
+     */
+    getLogsByTab(tabId: number): LogEntry[];
+    /**
+     * Get logs filtered by origin.
+     * @param origin - Origin (e.g., URL or script) to filter by.
+     */
+    getLogsByOrigin(origin: string): LogEntry[];
+    /**
+     * Clear all logs.
+     */
+    clearLogs(): void;
+}
+/** @internal */
+export declare const logger: Logger;
+/** @internal */
+export { globalLogs };

package/dist/lib/webcat/logger.js

@@ -0,0 +1,112 @@
+const globalLogs = [];
+class Logger {
+  constructor() {
+    this.debugMode = true;
+  }
+  // Controls if debug/info logs are printed
+  /**
+   * Enable or disable debug mode.
+   * @param enabled - Whether debug mode is enabled.
+   */
+  setDebugMode(enabled) {
+    this.debugMode = enabled;
+  }
+  /**
+   * Add a log entry.
+   * @param level - Log level (debug, info, warn, error).
+   * @param message - The log message.
+   * @param tabId - The tab ID associated with the log.
+   * @param origin - The origin of the log (e.g., URL or script).
+   * @param stack - Optional stack trace.
+   */
+  addLog(level, message, tabId, origin, stack) {
+    const logEntry = {
+      timestamp: /* @__PURE__ */ new Date(),
+      tabId,
+      origin,
+      level,
+      message,
+      stack
+    };
+    globalLogs.push(logEntry);
+    if (this.shouldPrint(level)) {
+      let tab;
+      if (logEntry.tabId > 0) {
+        tab = `Tab ${logEntry.tabId}`;
+      } else {
+        tab = "worker";
+      }
+      console[level](
+        `[${logEntry.timestamp.toISOString()}] [${tab}] [${logEntry.origin}] ${logEntry.message}`
+      );
+    }
+  }
+  /** Adds a log entry with the default level. */
+  log(message, details, stack) {
+    this.addLog("log", message, details.tabId, details.state.fqdn, stack);
+  }
+  /** Adds a warning log entry. */
+  warn(message, details, stack) {
+    this.addLog("warn", message, details.tabId, details.state.fqdn, stack);
+  }
+  /** Adds an error log entry. */
+  error(message, details, stack) {
+    this.addLog("error", message, details.tabId, details.state.fqdn, stack);
+  }
+  /** Adds an informational log entry. */
+  info(message, details, stack) {
+    this.addLog("info", message, details.tabId, details.state.fqdn, stack);
+  }
+  /** Add a debug log entry. */
+  debug(message, details, stack) {
+    this.addLog("debug", message, details.tabId, details.state.fqdn, stack);
+  }
+  /**
+   * Determine if a log should be printed based on the debug mode and log level.
+   * @param level - Log level to check.
+   */
+  shouldPrint(level) {
+    if (level === "warn" || level === "error") {
+      return true;
+    }
+    return this.debugMode;
+  }
+  /**
+   * Get all log entries.
+   */
+  getLogs() {
+    return [...globalLogs];
+  }
+  /**
+   * Get logs filtered by level.
+   * @param level - Log level to filter by (debug, info, warn, error).
+   */
+  getLogsByLevel(level) {
+    return globalLogs.filter((log) => log.level === level);
+  }
+  /**
+   * Get logs filtered by tab ID.
+   * @param tabId - Tab ID to filter by.
+   */
+  getLogsByTab(tabId) {
+    return globalLogs.filter((log) => log.tabId === tabId);
+  }
+  /**
+   * Get logs filtered by origin.
+   * @param origin - Origin (e.g., URL or script) to filter by.
+   */
+  getLogsByOrigin(origin) {
+    return globalLogs.filter((log) => log.origin === origin);
+  }
+  /**
+   * Clear all logs.
+   */
+  clearLogs() {
+    globalLogs.length = 0;
+  }
+}
+const logger = new Logger();
+export {
+  globalLogs,
+  logger
+};

package/dist/lib/webcat/originstate.d.ts

@@ -0,0 +1,45 @@
+import { Bundle, Enrollment, Manifest, SigstoreSignatures, SigsumSignatures } from "./interfaces/bundle";
+import { Database } from "./interfaces/database";
+import { WebcatError } from "./interfaces/errors";
+import { CachePartition, OriginState as IOriginState, OriginStateFailed, OriginStateObject, OriginStateVerifiedEnrollment, OriginStateVerifiedManifest } from "./interfaces/originstate";
+type BundleFetch = {
+    promise: Promise<Response>;
+    error?: WebcatError;
+    value?: Bundle;
+};
+export type BundleFetcherConfig = {
+    /** The path to `bundle.json`. */
+    bundlePath: string;
+    /** The path to `bundle-prev.json`. */
+    bundlePrevPath: string;
+};
+/** @internal */
+export declare class BundleFetcher {
+    readonly current: BundleFetch;
+    readonly previous: BundleFetch;
+    constructor(base: string, config: BundleFetcherConfig);
+    awaitAll(): Promise<void>;
+}
+export declare class OriginState implements IOriginState {
+    #private;
+    status: "request_sent" | "verified_enrollment" | "verified_manifest" | "failed";
+    readonly enrollment_hash: Uint8Array;
+    fetcher: BundleFetcher;
+    enrollment?: Enrollment;
+    manifest?: Manifest;
+    delegation?: string;
+    error?: WebcatError;
+    validUntil?: number;
+    stale: boolean;
+    constructor(db: Database, fetcher: BundleFetcher, enrollment_hash: Uint8Array, cachePartition: CachePartition, delegation?: string);
+    isRequestSent(): boolean;
+    isFailed(): this is OriginStateFailed;
+    isEnrollmentVerified(): this is OriginStateVerifiedEnrollment;
+    isManifestVerified(): this is OriginStateVerifiedManifest;
+    verifyEnrollment(enrollment?: Enrollment, delegation?: string): Promise<void>;
+    verifyManifest(manifest?: Manifest, signatures?: SigsumSignatures | SigstoreSignatures): Promise<void>;
+    verifyCSP(csp: string, pathname: string): boolean;
+    toPOJO(): OriginStateObject;
+    static fromPOJO(pojo: OriginStateObject): OriginState;
+}
+export {};

package/dist/lib/webcat/originstate.js

@@ -0,0 +1,302 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var _db, _cachePartition, _bundle, _OriginState_instances, fail_fn, setVerifiedEnrollment_fn, setVerifiedManifest_fn, verifyDelegation_fn, enrollmentHash_fn;
+import { canonicalize } from "./canonicalize.js";
+import { stringToUint8Array } from "./encoding.js";
+import { EnrollmentTypes } from "./interfaces/bundle.js";
+import { WebcatError, WebcatErrorCode } from "./interfaces/errors.js";
+import { arraysEqual, SHA256 } from "./utils.js";
+import { validateSigsumEnrollment, validateSigstoreEnrollment, verifySigstoreManifest, verifySigsumManifest, validateManifest, validateCSP } from "./validators.js";
+import "../browser/permissions.js";
+import "@freedomofpress/sigstore-browser";
+import "@freedomofpress/sigsum";
+import "@freedomofpress/sigsum/dist/compiledPolicy";
+import "@freedomofpress/sigsum/dist/crypto";
+import "@freedomofpress/sigsum/dist/proof";
+import "@freedomofpress/sigsum/dist/types";
+import "./parsers.js";
+class BundleFetcher {
+  constructor(base, config) {
+    this.current = {
+      promise: fetch(`${base}${config.bundlePath}`, {
+        cache: "no-store"
+      })
+    };
+    this.previous = {
+      promise: fetch(`${base}${config.bundlePrevPath}`, {
+        cache: "no-store"
+      })
+    };
+  }
+  async awaitAll() {
+    for (const slot of [this.current, this.previous]) {
+      if (slot.value || slot.error) {
+        continue;
+      }
+      let response;
+      try {
+        response = await slot.promise;
+      } catch {
+        slot.error = new WebcatError(WebcatErrorCode.Fetch.FETCH_ERROR);
+        continue;
+      }
+      if (!response.ok) {
+        slot.error = new WebcatError(WebcatErrorCode.Fetch.FETCH_ERROR);
+        continue;
+      }
+      let bundle;
+      try {
+        bundle = await response.json();
+      } catch {
+        slot.error = new WebcatError(WebcatErrorCode.Bundle.MALFORMED);
+        continue;
+      }
+      if (!bundle.enrollment) {
+        slot.error = new WebcatError(WebcatErrorCode.Bundle.ENROLLMENT_MISSING);
+        continue;
+      }
+      if (!bundle.manifest) {
+        slot.error = new WebcatError(WebcatErrorCode.Bundle.MANIFEST_MISSING);
+        continue;
+      }
+      if (!bundle.signatures) {
+        slot.error = new WebcatError(WebcatErrorCode.Bundle.SIGNATURES_MISSING);
+        continue;
+      }
+      slot.value = bundle;
+    }
+  }
+}
+const _OriginState = class _OriginState {
+  // Due to list logic, we support only one app per domain, and that should be a privileged one
+  // But that is enforced in request.ts
+  constructor(db, fetcher, enrollment_hash, cachePartition, delegation) {
+    __privateAdd(this, _OriginState_instances);
+    __privateAdd(this, _db);
+    __privateAdd(this, _cachePartition);
+    __privateAdd(this, _bundle);
+    this.stale = false;
+    __privateSet(this, _db, db);
+    this.fetcher = fetcher;
+    this.enrollment_hash = enrollment_hash;
+    __privateSet(this, _cachePartition, cachePartition);
+    this.delegation = delegation;
+    this.status = "request_sent";
+  }
+  isRequestSent() {
+    return this.status === "request_sent" && this.enrollment === void 0 && this.manifest === void 0 && this.error === void 0;
+  }
+  isFailed() {
+    return this.status === "failed";
+  }
+  isEnrollmentVerified() {
+    return this.status === "verified_enrollment" && this.enrollment !== void 0;
+  }
+  isManifestVerified() {
+    return this.status === "verified_manifest" && this.manifest !== void 0 && this.validUntil !== void 0;
+  }
+  // This functiont ries to verify the enrollment information against the value in the local list
+  // It will also return errors while fetching the bundles (though they are generated in awaitBundles)
+  // and tell the next stages whether they should use the current or the previous bundle
+  async verifyEnrollment(enrollment, delegation) {
+    let verified_delegation;
+    if (delegation && await __privateMethod(this, _OriginState_instances, verifyDelegation_fn).call(this, delegation)) {
+      verified_delegation = delegation;
+    }
+    if (!enrollment) {
+      if (!this.fetcher.current.value) {
+        if (!this.fetcher.current.error) {
+          throw new Error("verifyEnrollment called before fetcher is ready");
+        }
+        return __privateMethod(this, _OriginState_instances, fail_fn).call(this, this.fetcher.current.error);
+      }
+      enrollment = this.fetcher.current.value.enrollment;
+    }
+    const canonicalized_hash = await __privateMethod(this, _OriginState_instances, enrollmentHash_fn).call(this, enrollment);
+    const match = canonicalized_hash !== null && arraysEqual(this.enrollment_hash, canonicalized_hash);
+    if (match) {
+      __privateSet(this, _bundle, this.fetcher.current.value);
+    } else {
+      if (!this.fetcher.previous.value) {
+        return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Enrollment.MISMATCH));
+      }
+      enrollment = this.fetcher.previous.value.enrollment;
+      const canonicalized_hash_prev = await __privateMethod(this, _OriginState_instances, enrollmentHash_fn).call(this, enrollment);
+      if (canonicalized_hash_prev === null || !arraysEqual(this.enrollment_hash, canonicalized_hash_prev)) {
+        return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Enrollment.MISMATCH));
+      }
+      __privateSet(this, _bundle, this.fetcher.previous.value);
+    }
+    let err = null;
+    if (enrollment.type === EnrollmentTypes.Sigsum) {
+      err = validateSigsumEnrollment(enrollment);
+    } else if (enrollment.type === EnrollmentTypes.Sigstore) {
+      err = validateSigstoreEnrollment(enrollment);
+    } else {
+      err = new WebcatError(WebcatErrorCode.Enrollment.TYPE_INVALID);
+    }
+    if (err) {
+      return __privateMethod(this, _OriginState_instances, fail_fn).call(this, err);
+    }
+    return __privateMethod(this, _OriginState_instances, setVerifiedEnrollment_fn).call(this, enrollment, verified_delegation);
+  }
+  async verifyManifest(manifest, signatures) {
+    if (!this.isEnrollmentVerified()) {
+      throw new Error("verifyManifest called before verifyEnrollment");
+    }
+    if (!manifest || !signatures) {
+      if (!__privateGet(this, _bundle)) {
+        return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Bundle.MANIFEST_MISSING));
+      }
+      manifest = __privateGet(this, _bundle).manifest;
+      signatures = __privateGet(this, _bundle).signatures;
+    }
+    let verify_result;
+    switch (this.enrollment.type) {
+      case EnrollmentTypes.Sigsum:
+        verify_result = await verifySigsumManifest(
+          this.enrollment,
+          manifest,
+          signatures
+        );
+        break;
+      case EnrollmentTypes.Sigstore:
+        verify_result = await verifySigstoreManifest(
+          this.enrollment,
+          manifest,
+          signatures
+        );
+        break;
+      default:
+        verify_result = new WebcatError(
+          WebcatErrorCode.Enrollment.TYPE_INVALID
+        );
+    }
+    if (verify_result instanceof WebcatError) {
+      return __privateMethod(this, _OriginState_instances, fail_fn).call(this, verify_result);
+    }
+    const format_error = validateManifest(manifest);
+    if (format_error) {
+      return __privateMethod(this, _OriginState_instances, fail_fn).call(this, format_error);
+    }
+    try {
+      validateCSP(manifest.default_csp);
+    } catch (e) {
+      return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Manifest.DEFAULT_CSP_INVALID, [
+        String(e)
+      ]));
+    }
+    for (const path in manifest.extra_csp) {
+      if (manifest.extra_csp.hasOwnProperty(path)) {
+        const csp = manifest.extra_csp[path];
+        try {
+          validateCSP(csp);
+        } catch (e) {
+          return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Manifest.EXTRA_CSP_INVALID, [
+            String(e)
+          ]));
+        }
+      } else {
+        return __privateMethod(this, _OriginState_instances, fail_fn).call(this, new WebcatError(WebcatErrorCode.Manifest.EXTRA_CSP_MALFORMED, [
+          String(path)
+        ]));
+      }
+    }
+    return __privateMethod(this, _OriginState_instances, setVerifiedManifest_fn).call(this, manifest, verify_result);
+  }
+  verifyCSP(csp, pathname) {
+    if (!this.isManifestVerified()) {
+      throw new Error("verifyCSP called before verifyManifest");
+    }
+    csp = csp.split(",")[0];
+    const extraCSP = this.manifest.extra_csp || {};
+    const defaultCSP = this.manifest.default_csp;
+    const effectivePath = pathname === "/" ? this.manifest.default_index : pathname;
+    if (extraCSP[effectivePath]) {
+      return csp === extraCSP[effectivePath];
+    }
+    let bestMatch = null;
+    let bestMatchLength = 0;
+    for (const prefix in extraCSP) {
+      if (effectivePath.startsWith(prefix) && prefix.length > bestMatchLength) {
+        bestMatch = prefix;
+        bestMatchLength = prefix.length;
+      }
+    }
+    const correctCSP = bestMatch ? extraCSP[bestMatch] : defaultCSP;
+    return csp === correctCSP;
+  }
+  toPOJO() {
+    if (!this.isManifestVerified()) {
+      throw new Error(
+        "cannot serialize OriginState before verifying the manifest"
+      );
+    }
+    return {
+      status: "verified_manifest",
+      enrollment_hash: this.enrollment_hash.toBase64(),
+      manifest: this.manifest,
+      delegation: this.delegation,
+      validUntil: this.validUntil
+    };
+  }
+  static fromPOJO(pojo) {
+    if (pojo.status !== "verified_manifest") {
+      throw new Error("cannot deserialize an unverified OriginState");
+    }
+    const restored = new _OriginState(
+      {},
+      {},
+      Uint8Array.fromBase64(pojo.enrollment_hash),
+      {}
+    );
+    restored.status = pojo.status;
+    restored.manifest = pojo.manifest;
+    restored.delegation = pojo.delegation;
+    restored.validUntil = pojo.validUntil;
+    return restored;
+  }
+};
+_db = new WeakMap();
+_cachePartition = new WeakMap();
+_bundle = new WeakMap();
+_OriginState_instances = new WeakSet();
+fail_fn = function(error) {
+  this.status = "failed";
+  this.error = error;
+};
+setVerifiedEnrollment_fn = function(enrollment, delegation) {
+  this.status = "verified_enrollment";
+  this.enrollment = enrollment;
+  this.delegation = delegation;
+};
+setVerifiedManifest_fn = function(manifest, validUntil) {
+  this.status = "verified_manifest";
+  this.manifest = manifest;
+  this.validUntil = validUntil;
+};
+verifyDelegation_fn = async function(delegation) {
+  const delegation_hash = await __privateGet(this, _db).getFQDNEnrollment(
+    delegation,
+    __privateGet(this, _cachePartition)
+  );
+  return delegation_hash && arraysEqual(delegation_hash, this.enrollment_hash);
+};
+enrollmentHash_fn = async function(enrollment) {
+  const canonicalized = canonicalize(enrollment);
+  if (canonicalized === null) {
+    return null;
+  }
+  return new Uint8Array(await SHA256(stringToUint8Array(canonicalized)));
+};
+let OriginState = _OriginState;
+export {
+  BundleFetcher,
+  OriginState
+};

package/dist/lib/webcat/parsers.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Parse a serialized Content Security Policy via [the spec][0].
+ *
+ * [0]: https://w3c.github.io/webappsec-csp/#parse-serialized-policy
+ *
+ * @param policy The serialized Content Security Policy to parse.
+ * @returns A Map of Content Security Policy directives.
+ * @example
+ * parseContentSecurityPolicy(
+ *   "default-src 'self'; script-src 'unsafe-eval' scripts.example; object-src; style-src styles.example",
+ * );
+ * // => Map(4) {
+ * //      "default-src" => ["'self'"],
+ * //      "script-src" => ["'unsafe-eval'", "scripts.example"],
+ * //      "object-src" => [],
+ * //      "style-src" => ["styles.example"],
+ * //    }
+ */
+export declare function parseContentSecurityPolicy(policy: string): Map<string, string[]>;
+export declare function extractHostname(key: string): string;
+export declare function extractRawHash(hexValue: string): Uint8Array;

package/dist/lib/webcat/parsers.js

@@ -0,0 +1,36 @@
+import { hexToUint8Array } from "./encoding.js";
+const ASCII_WHITESPACE_CHARS = "	\n\f\r ";
+const ASCII_WHITESPACE = RegExp(`[${ASCII_WHITESPACE_CHARS}]+`);
+const ASCII_WHITESPACE_AT_START = RegExp(`^[${ASCII_WHITESPACE_CHARS}]+`);
+const ASCII_WHITESPACE_AT_END = RegExp(`[${ASCII_WHITESPACE_CHARS}]+$`);
+const ASCII = /^[\x00-\x7f]*$/;
+function parseContentSecurityPolicy(policy) {
+  const result = /* @__PURE__ */ new Map();
+  for (let token of policy.split(";")) {
+    token = token.replace(ASCII_WHITESPACE_AT_START, "").replace(ASCII_WHITESPACE_AT_END, "");
+    if (!token || !ASCII.test(token)) continue;
+    const [rawDirectiveName, ...directiveValue] = token.split(ASCII_WHITESPACE);
+    const directiveName = rawDirectiveName.toLowerCase();
+    if (result.has(directiveName)) continue;
+    result.set(directiveName, directiveValue);
+  }
+  return result;
+}
+function extractHostname(key) {
+  let host = key.replace(/^canonical\//, "");
+  host = host.replace(/^\./, "");
+  const labels = host.split(".");
+  return labels.reverse().join(".");
+}
+function extractRawHash(hexValue) {
+  const bytes = hexToUint8Array(hexValue);
+  if (bytes[0] !== 10) throw new Error("Unexpected ICS23 prefix");
+  const len = bytes[1];
+  const valueBytes = bytes.slice(2, 2 + len);
+  return valueBytes;
+}
+export {
+  extractHostname,
+  extractRawHash,
+  parseContentSecurityPolicy
+};

package/dist/lib/webcat/request.d.ts

@@ -0,0 +1,11 @@
+import { BeforeRequestDetails } from "../browser/requests";
+import { Database } from "./interfaces/database";
+import { WebcatError } from "./interfaces/errors";
+import { Stateful } from "./interfaces/requeststate";
+import { BundleFetcherConfig } from "./originstate";
+import { WebcatUI } from "./ui";
+export declare function validateProtocolAndPort(urlobj: URL): boolean;
+export declare function enforceHTTPS(urlobj: URL): string | undefined;
+export declare function validateOrigin(db: Database, ui: WebcatUI, details: Stateful<BeforeRequestDetails>, config: BundleFetcherConfig): Promise<WebcatError | {
+    redirectUrl: string;
+} | undefined>;

package/dist/lib/webcat/request.js

@@ -0,0 +1,78 @@
+import { CacheKey } from "./cache.js";
+import { WebcatError, WebcatErrorCode } from "./interfaces/errors.js";
+import { logger } from "./logger.js";
+import { BundleFetcher, OriginState } from "./originstate.js";
+import "../browser/sync.js";
+import "./canonicalize.js";
+import "./encoding.js";
+import "./interfaces/bundle.js";
+import "./utils.js";
+import "../browser/permissions.js";
+import "./validators.js";
+import "@freedomofpress/sigstore-browser";
+import "@freedomofpress/sigsum";
+import "@freedomofpress/sigsum/dist/compiledPolicy";
+import "@freedomofpress/sigsum/dist/crypto";
+import "@freedomofpress/sigsum/dist/proof";
+import "@freedomofpress/sigsum/dist/types";
+import "./parsers.js";
+const allowedPorts = ["80", "443", ""];
+function validateProtocolAndPort(urlobj) {
+  if (!allowedPorts.includes(urlobj.port) || !["http:", "https:"].includes(urlobj.protocol)) {
+    return false;
+  } else {
+    return true;
+  }
+}
+function enforceHTTPS(urlobj) {
+  if (urlobj.protocol !== "https:" && urlobj.hostname.substring(urlobj.hostname.lastIndexOf(".")) !== ".onion") {
+    urlobj.protocol = "https:";
+    return urlobj.toString();
+  }
+}
+async function validateOrigin(db, ui, details, config) {
+  const { fqdn, cachePartition, isFrame } = details.state;
+  const enrollment_hash = await db.getFQDNEnrollment(fqdn, cachePartition);
+  if (enrollment_hash.length === 0) {
+    return;
+  }
+  if (isFrame) {
+    ui.showIcon(details.tabId);
+  }
+  const urlobj = new URL(details.url);
+  if (!validateProtocolAndPort(urlobj)) {
+    return new WebcatError(WebcatErrorCode.URL.UNSUPPORTED, [
+      String(urlobj.protocol),
+      String(urlobj.port || "default")
+    ]);
+  }
+  const redirect = enforceHTTPS(urlobj);
+  if (redirect) {
+    return { redirectUrl: redirect };
+  }
+  const cached = await db.origins.get(CacheKey(fqdn, cachePartition));
+  const now = Math.floor(Date.now() / 1e3);
+  if (cached && cached.validUntil && cached.validUntil > now) {
+    details.state.pendingOrigin = cached;
+    return;
+  }
+  logger.info(`${fqdn} is enrolled, but we do not have metadata yet.`, details);
+  const newFetcher = new BundleFetcher(
+    `${urlobj.protocol}//${fqdn}:${urlobj.port}`,
+    config
+  );
+  const newOriginState = new OriginState(
+    db,
+    newFetcher,
+    enrollment_hash,
+    cachePartition
+  );
+  details.state.pendingOrigin = newOriginState;
+  await newOriginState.fetcher.awaitAll();
+  return;
+}
+export {
+  enforceHTTPS,
+  validateOrigin,
+  validateProtocolAndPort
+};

package/dist/lib/webcat/resources.d.ts

@@ -0,0 +1,3 @@
+export declare const FRAME_TYPES: browser.webRequest.ResourceType[];
+export declare const NON_FRAME_TYPES: browser.webRequest.ResourceType[];
+export declare const PASS_THROUGH_TYPES: Set<browser.webRequest.ResourceType>;