@fuzdev/fuz_ui 0.169.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +93 -0
- package/dist/Alert.svelte +108 -0
- package/dist/Alert.svelte.d.ts +16 -0
- package/dist/Alert.svelte.d.ts.map +1 -0
- package/dist/ApiDeclarationList.svelte +35 -0
- package/dist/ApiDeclarationList.svelte.d.ts +9 -0
- package/dist/ApiDeclarationList.svelte.d.ts.map +1 -0
- package/dist/ApiIndex.svelte +65 -0
- package/dist/ApiIndex.svelte.d.ts +23 -0
- package/dist/ApiIndex.svelte.d.ts.map +1 -0
- package/dist/ApiModule.svelte +124 -0
- package/dist/ApiModule.svelte.d.ts +22 -0
- package/dist/ApiModule.svelte.d.ts.map +1 -0
- package/dist/Breadcrumb.svelte +83 -0
- package/dist/Breadcrumb.svelte.d.ts +23 -0
- package/dist/Breadcrumb.svelte.d.ts.map +1 -0
- package/dist/Card.svelte +157 -0
- package/dist/Card.svelte.d.ts +13 -0
- package/dist/Card.svelte.d.ts.map +1 -0
- package/dist/ColorSchemeInput.svelte +65 -0
- package/dist/ColorSchemeInput.svelte.d.ts +11 -0
- package/dist/ColorSchemeInput.svelte.d.ts.map +1 -0
- package/dist/Contextmenu.svelte +30 -0
- package/dist/Contextmenu.svelte.d.ts +32 -0
- package/dist/Contextmenu.svelte.d.ts.map +1 -0
- package/dist/ContextmenuEntry.svelte +74 -0
- package/dist/ContextmenuEntry.svelte.d.ts +12 -0
- package/dist/ContextmenuEntry.svelte.d.ts.map +1 -0
- package/dist/ContextmenuLinkEntry.svelte +112 -0
- package/dist/ContextmenuLinkEntry.svelte.d.ts +12 -0
- package/dist/ContextmenuLinkEntry.svelte.d.ts.map +1 -0
- package/dist/ContextmenuRoot.svelte +372 -0
- package/dist/ContextmenuRoot.svelte.d.ts +71 -0
- package/dist/ContextmenuRoot.svelte.d.ts.map +1 -0
- package/dist/ContextmenuRootForSafariCompatibility.svelte +541 -0
- package/dist/ContextmenuRootForSafariCompatibility.svelte.d.ts +79 -0
- package/dist/ContextmenuRootForSafariCompatibility.svelte.d.ts.map +1 -0
- package/dist/ContextmenuSeparator.svelte +16 -0
- package/dist/ContextmenuSeparator.svelte.d.ts +4 -0
- package/dist/ContextmenuSeparator.svelte.d.ts.map +1 -0
- package/dist/ContextmenuSubmenu.svelte +116 -0
- package/dist/ContextmenuSubmenu.svelte.d.ts +10 -0
- package/dist/ContextmenuSubmenu.svelte.d.ts.map +1 -0
- package/dist/ContextmenuTextEntry.svelte +21 -0
- package/dist/ContextmenuTextEntry.svelte.d.ts +10 -0
- package/dist/ContextmenuTextEntry.svelte.d.ts.map +1 -0
- package/dist/CopyToClipboard.svelte +81 -0
- package/dist/CopyToClipboard.svelte.d.ts +18 -0
- package/dist/CopyToClipboard.svelte.d.ts.map +1 -0
- package/dist/DeclarationDetail.svelte +340 -0
- package/dist/DeclarationDetail.svelte.d.ts +8 -0
- package/dist/DeclarationDetail.svelte.d.ts.map +1 -0
- package/dist/DeclarationLink.svelte +50 -0
- package/dist/DeclarationLink.svelte.d.ts +8 -0
- package/dist/DeclarationLink.svelte.d.ts.map +1 -0
- package/dist/Details.svelte +51 -0
- package/dist/Details.svelte.d.ts +20 -0
- package/dist/Details.svelte.d.ts.map +1 -0
- package/dist/Dialog.svelte +217 -0
- package/dist/Dialog.svelte.d.ts +30 -0
- package/dist/Dialog.svelte.d.ts.map +1 -0
- package/dist/Dialogs.svelte +28 -0
- package/dist/Dialogs.svelte.d.ts +11 -0
- package/dist/Dialogs.svelte.d.ts.map +1 -0
- package/dist/Docs.svelte +179 -0
- package/dist/Docs.svelte.d.ts +13 -0
- package/dist/Docs.svelte.d.ts.map +1 -0
- package/dist/DocsContent.svelte +40 -0
- package/dist/DocsContent.svelte.d.ts +14 -0
- package/dist/DocsContent.svelte.d.ts.map +1 -0
- package/dist/DocsFooter.svelte +64 -0
- package/dist/DocsFooter.svelte.d.ts +15 -0
- package/dist/DocsFooter.svelte.d.ts.map +1 -0
- package/dist/DocsLink.svelte +41 -0
- package/dist/DocsLink.svelte.d.ts +12 -0
- package/dist/DocsLink.svelte.d.ts.map +1 -0
- package/dist/DocsList.svelte +44 -0
- package/dist/DocsList.svelte.d.ts +11 -0
- package/dist/DocsList.svelte.d.ts.map +1 -0
- package/dist/DocsMenu.svelte +55 -0
- package/dist/DocsMenu.svelte.d.ts +11 -0
- package/dist/DocsMenu.svelte.d.ts.map +1 -0
- package/dist/DocsMenuHeader.svelte +15 -0
- package/dist/DocsMenuHeader.svelte.d.ts +9 -0
- package/dist/DocsMenuHeader.svelte.d.ts.map +1 -0
- package/dist/DocsModulesList.svelte +32 -0
- package/dist/DocsModulesList.svelte.d.ts +7 -0
- package/dist/DocsModulesList.svelte.d.ts.map +1 -0
- package/dist/DocsPageLinks.svelte +61 -0
- package/dist/DocsPageLinks.svelte.d.ts +8 -0
- package/dist/DocsPageLinks.svelte.d.ts.map +1 -0
- package/dist/DocsPrimaryNav.svelte +93 -0
- package/dist/DocsPrimaryNav.svelte.d.ts +11 -0
- package/dist/DocsPrimaryNav.svelte.d.ts.map +1 -0
- package/dist/DocsSearch.svelte +48 -0
- package/dist/DocsSearch.svelte.d.ts +11 -0
- package/dist/DocsSearch.svelte.d.ts.map +1 -0
- package/dist/DocsSecondaryNav.svelte +63 -0
- package/dist/DocsSecondaryNav.svelte.d.ts +9 -0
- package/dist/DocsSecondaryNav.svelte.d.ts.map +1 -0
- package/dist/DocsTertiaryNav.svelte +118 -0
- package/dist/DocsTertiaryNav.svelte.d.ts +10 -0
- package/dist/DocsTertiaryNav.svelte.d.ts.map +1 -0
- package/dist/EcosystemLinks.svelte +53 -0
- package/dist/EcosystemLinks.svelte.d.ts +7 -0
- package/dist/EcosystemLinks.svelte.d.ts.map +1 -0
- package/dist/EcosystemLinksPanel.svelte +22 -0
- package/dist/EcosystemLinksPanel.svelte.d.ts +8 -0
- package/dist/EcosystemLinksPanel.svelte.d.ts.map +1 -0
- package/dist/GithubLink.svelte +75 -0
- package/dist/GithubLink.svelte.d.ts +14 -0
- package/dist/GithubLink.svelte.d.ts.map +1 -0
- package/dist/Glyph.svelte +28 -0
- package/dist/Glyph.svelte.d.ts +9 -0
- package/dist/Glyph.svelte.d.ts.map +1 -0
- package/dist/Hashlink.svelte +41 -0
- package/dist/Hashlink.svelte.d.ts +8 -0
- package/dist/Hashlink.svelte.d.ts.map +1 -0
- package/dist/HiddenPersonalLinks.svelte +6 -0
- package/dist/HiddenPersonalLinks.svelte.d.ts +27 -0
- package/dist/HiddenPersonalLinks.svelte.d.ts.map +1 -0
- package/dist/HueInput.svelte +127 -0
- package/dist/HueInput.svelte.d.ts +11 -0
- package/dist/HueInput.svelte.d.ts.map +1 -0
- package/dist/ImgOrSvg.svelte +58 -0
- package/dist/ImgOrSvg.svelte.d.ts +25 -0
- package/dist/ImgOrSvg.svelte.d.ts.map +1 -0
- package/dist/LibraryDetail.svelte +297 -0
- package/dist/LibraryDetail.svelte.d.ts +15 -0
- package/dist/LibraryDetail.svelte.d.ts.map +1 -0
- package/dist/LibrarySummary.svelte +151 -0
- package/dist/LibrarySummary.svelte.d.ts +16 -0
- package/dist/LibrarySummary.svelte.d.ts.map +1 -0
- package/dist/MdnLink.svelte +40 -0
- package/dist/MdnLink.svelte.d.ts +8 -0
- package/dist/MdnLink.svelte.d.ts.map +1 -0
- package/dist/Mdz.svelte +30 -0
- package/dist/Mdz.svelte.d.ts +10 -0
- package/dist/Mdz.svelte.d.ts.map +1 -0
- package/dist/MdzNodeView.svelte +93 -0
- package/dist/MdzNodeView.svelte.d.ts +9 -0
- package/dist/MdzNodeView.svelte.d.ts.map +1 -0
- package/dist/ModuleLink.svelte +48 -0
- package/dist/ModuleLink.svelte.d.ts +8 -0
- package/dist/ModuleLink.svelte.d.ts.map +1 -0
- package/dist/PasteFromClipboard.svelte +35 -0
- package/dist/PasteFromClipboard.svelte.d.ts +9 -0
- package/dist/PasteFromClipboard.svelte.d.ts.map +1 -0
- package/dist/PendingAnimation.svelte +62 -0
- package/dist/PendingAnimation.svelte.d.ts +13 -0
- package/dist/PendingAnimation.svelte.d.ts.map +1 -0
- package/dist/PendingButton.svelte +75 -0
- package/dist/PendingButton.svelte.d.ts +17 -0
- package/dist/PendingButton.svelte.d.ts.map +1 -0
- package/dist/ProjectLinks.svelte +54 -0
- package/dist/ProjectLinks.svelte.d.ts +19 -0
- package/dist/ProjectLinks.svelte.d.ts.map +1 -0
- package/dist/Redirect.svelte +44 -0
- package/dist/Redirect.svelte.d.ts +23 -0
- package/dist/Redirect.svelte.d.ts.map +1 -0
- package/dist/Spiders.svelte +57 -0
- package/dist/Spiders.svelte.d.ts +9 -0
- package/dist/Spiders.svelte.d.ts.map +1 -0
- package/dist/Svg.svelte +99 -0
- package/dist/Svg.svelte.d.ts +54 -0
- package/dist/Svg.svelte.d.ts.map +1 -0
- package/dist/Teleport.svelte +48 -0
- package/dist/Teleport.svelte.d.ts +15 -0
- package/dist/Teleport.svelte.d.ts.map +1 -0
- package/dist/ThemeInput.svelte +75 -0
- package/dist/ThemeInput.svelte.d.ts +15 -0
- package/dist/ThemeInput.svelte.d.ts.map +1 -0
- package/dist/Themed.svelte +101 -0
- package/dist/Themed.svelte.d.ts +24 -0
- package/dist/Themed.svelte.d.ts.map +1 -0
- package/dist/TomeContent.svelte +67 -0
- package/dist/TomeContent.svelte.d.ts +12 -0
- package/dist/TomeContent.svelte.d.ts.map +1 -0
- package/dist/TomeHeader.svelte +56 -0
- package/dist/TomeHeader.svelte.d.ts +4 -0
- package/dist/TomeHeader.svelte.d.ts.map +1 -0
- package/dist/TomeLink.svelte +29 -0
- package/dist/TomeLink.svelte.d.ts +10 -0
- package/dist/TomeLink.svelte.d.ts.map +1 -0
- package/dist/TomeSection.svelte +65 -0
- package/dist/TomeSection.svelte.d.ts +24 -0
- package/dist/TomeSection.svelte.d.ts.map +1 -0
- package/dist/TomeSectionHeader.svelte +90 -0
- package/dist/TomeSectionHeader.svelte.d.ts +13 -0
- package/dist/TomeSectionHeader.svelte.d.ts.map +1 -0
- package/dist/TypeLink.svelte +19 -0
- package/dist/TypeLink.svelte.d.ts +7 -0
- package/dist/TypeLink.svelte.d.ts.map +1 -0
- package/dist/alert.d.ts +7 -0
- package/dist/alert.d.ts.map +1 -0
- package/dist/alert.js +6 -0
- package/dist/api_search.svelte.d.ts +16 -0
- package/dist/api_search.svelte.d.ts.map +1 -0
- package/dist/api_search.svelte.js +61 -0
- package/dist/constants.d.ts +2 -0
- package/dist/constants.d.ts.map +1 -0
- package/dist/constants.js +3 -0
- package/dist/context_helpers.d.ts +17 -0
- package/dist/context_helpers.d.ts.map +1 -0
- package/dist/context_helpers.js +19 -0
- package/dist/contextmenu_helpers.d.ts +16 -0
- package/dist/contextmenu_helpers.d.ts.map +1 -0
- package/dist/contextmenu_helpers.js +39 -0
- package/dist/contextmenu_state.svelte.d.ts +152 -0
- package/dist/contextmenu_state.svelte.d.ts.map +1 -0
- package/dist/contextmenu_state.svelte.js +424 -0
- package/dist/csp.d.ts +160 -0
- package/dist/csp.d.ts.map +1 -0
- package/dist/csp.js +354 -0
- package/dist/csp_of_ryanatkn.d.ts +6 -0
- package/dist/csp_of_ryanatkn.d.ts.map +1 -0
- package/dist/csp_of_ryanatkn.js +14 -0
- package/dist/declaration.svelte.d.ts +84 -0
- package/dist/declaration.svelte.d.ts.map +1 -0
- package/dist/declaration.svelte.js +66 -0
- package/dist/declaration_contextmenu.d.ts +4 -0
- package/dist/declaration_contextmenu.d.ts.map +1 -0
- package/dist/declaration_contextmenu.js +14 -0
- package/dist/dialog.d.ts +24 -0
- package/dist/dialog.d.ts.map +1 -0
- package/dist/dialog.js +12 -0
- package/dist/dimensions.svelte.d.ts +5 -0
- package/dist/dimensions.svelte.d.ts.map +1 -0
- package/dist/dimensions.svelte.js +4 -0
- package/dist/docs_helpers.svelte.d.ts +48 -0
- package/dist/docs_helpers.svelte.d.ts.map +1 -0
- package/dist/docs_helpers.svelte.js +99 -0
- package/dist/helpers.d.ts +2 -0
- package/dist/helpers.d.ts.map +1 -0
- package/dist/helpers.js +16 -0
- package/dist/intersect.svelte.d.ts +47 -0
- package/dist/intersect.svelte.d.ts.map +1 -0
- package/dist/intersect.svelte.js +92 -0
- package/dist/library.svelte.d.ts +197 -0
- package/dist/library.svelte.d.ts.map +1 -0
- package/dist/library.svelte.js +130 -0
- package/dist/library_gen.d.ts +34 -0
- package/dist/library_gen.d.ts.map +1 -0
- package/dist/library_gen.js +123 -0
- package/dist/library_gen_helpers.d.ts +85 -0
- package/dist/library_gen_helpers.d.ts.map +1 -0
- package/dist/library_gen_helpers.js +188 -0
- package/dist/library_helpers.d.ts +54 -0
- package/dist/library_helpers.d.ts.map +1 -0
- package/dist/library_helpers.js +102 -0
- package/dist/logos.d.ts +134 -0
- package/dist/logos.d.ts.map +1 -0
- package/dist/logos.js +281 -0
- package/dist/mdz.d.ts +106 -0
- package/dist/mdz.d.ts.map +1 -0
- package/dist/mdz.js +1481 -0
- package/dist/mdz_components.d.ts +37 -0
- package/dist/mdz_components.d.ts.map +1 -0
- package/dist/mdz_components.js +12 -0
- package/dist/module.svelte.d.ts +47 -0
- package/dist/module.svelte.d.ts.map +1 -0
- package/dist/module.svelte.js +56 -0
- package/dist/module_contextmenu.d.ts +4 -0
- package/dist/module_contextmenu.d.ts.map +1 -0
- package/dist/module_contextmenu.js +14 -0
- package/dist/module_helpers.d.ts +69 -0
- package/dist/module_helpers.d.ts.map +1 -0
- package/dist/module_helpers.js +87 -0
- package/dist/rune_helpers.svelte.d.ts +6 -0
- package/dist/rune_helpers.svelte.d.ts.map +1 -0
- package/dist/rune_helpers.svelte.js +10 -0
- package/dist/storage.d.ts +13 -0
- package/dist/storage.d.ts.map +1 -0
- package/dist/storage.js +43 -0
- package/dist/svelte_helpers.d.ts +37 -0
- package/dist/svelte_helpers.d.ts.map +1 -0
- package/dist/svelte_helpers.js +245 -0
- package/dist/themer.svelte.d.ts +24 -0
- package/dist/themer.svelte.d.ts.map +1 -0
- package/dist/themer.svelte.js +43 -0
- package/dist/tome.d.ts +80 -0
- package/dist/tome.d.ts.map +1 -0
- package/dist/tome.js +27 -0
- package/dist/ts_helpers.d.ts +110 -0
- package/dist/ts_helpers.d.ts.map +1 -0
- package/dist/ts_helpers.js +533 -0
- package/dist/tsdoc_helpers.d.ts +98 -0
- package/dist/tsdoc_helpers.d.ts.map +1 -0
- package/dist/tsdoc_helpers.js +221 -0
- package/package.json +128 -0
- package/src/lib/alert.ts +14 -0
- package/src/lib/api_search.svelte.ts +85 -0
- package/src/lib/constants.ts +3 -0
- package/src/lib/context_helpers.ts +47 -0
- package/src/lib/contextmenu_helpers.ts +63 -0
- package/src/lib/contextmenu_state.svelte.ts +515 -0
- package/src/lib/csp.ts +576 -0
- package/src/lib/csp_of_ryanatkn.ts +16 -0
- package/src/lib/declaration.svelte.ts +102 -0
- package/src/lib/declaration_contextmenu.ts +22 -0
- package/src/lib/dialog.ts +35 -0
- package/src/lib/dimensions.svelte.ts +4 -0
- package/src/lib/docs_helpers.svelte.ts +149 -0
- package/src/lib/helpers.ts +10 -0
- package/src/lib/intersect.svelte.ts +152 -0
- package/src/lib/library.svelte.ts +162 -0
- package/src/lib/library_gen.ts +160 -0
- package/src/lib/library_gen_helpers.ts +262 -0
- package/src/lib/library_helpers.ts +123 -0
- package/src/lib/logos.ts +302 -0
- package/src/lib/mdz.ts +1819 -0
- package/src/lib/mdz_components.ts +34 -0
- package/src/lib/module.svelte.ts +78 -0
- package/src/lib/module_contextmenu.ts +20 -0
- package/src/lib/module_helpers.ts +113 -0
- package/src/lib/rune_helpers.svelte.ts +10 -0
- package/src/lib/storage.ts +48 -0
- package/src/lib/svelte_helpers.ts +303 -0
- package/src/lib/themer.svelte.ts +68 -0
- package/src/lib/tome.ts +38 -0
- package/src/lib/ts_helpers.ts +662 -0
- package/src/lib/tsdoc_helpers.ts +259 -0
package/src/lib/csp.ts
ADDED
|
@@ -0,0 +1,576 @@
|
|
|
1
|
+
import type {ArrayElement, Defined} from '@fuzdev/fuz_util/types.js';
|
|
2
|
+
|
|
3
|
+
// TODO schemas, but I may be moving to ArkType from Zod if precompilation looks good
|
|
4
|
+
|
|
5
|
+
export interface CreateCspDirectivesOptions {
|
|
6
|
+
/**
|
|
7
|
+
* Override or transform specific directives.
|
|
8
|
+
* Returning `null` or `undefined` from a transform function will remove the directive.
|
|
9
|
+
*/
|
|
10
|
+
directives?: {
|
|
11
|
+
[K in CspDirective]?:
|
|
12
|
+
| CspDirectiveValue<K> // Static value replacement
|
|
13
|
+
| null // Removes the directive
|
|
14
|
+
// Transform function returning one of the previous types
|
|
15
|
+
| ((value: CspDirectiveValue<K>) => CspDirectiveValue<K> | null);
|
|
16
|
+
};
|
|
17
|
+
|
|
18
|
+
/**
|
|
19
|
+
* Sources to include based on their trust levels.
|
|
20
|
+
*/
|
|
21
|
+
trusted_sources?: Array<CspSourceSpec>;
|
|
22
|
+
|
|
23
|
+
/**
|
|
24
|
+
* Override default values for specific directives,
|
|
25
|
+
* merging with `value_defaults_base` (or replacing if that directive is null in the base).
|
|
26
|
+
*/
|
|
27
|
+
value_defaults?: Partial<typeof csp_directive_value_defaults>;
|
|
28
|
+
|
|
29
|
+
/**
|
|
30
|
+
* Base values for directive defaults.
|
|
31
|
+
* Set to `null` or `{}` to start with no defaults.
|
|
32
|
+
* Defaults to `csp_directive_value_defaults`.
|
|
33
|
+
*/
|
|
34
|
+
value_defaults_base?: Partial<typeof csp_directive_value_defaults> | null;
|
|
35
|
+
|
|
36
|
+
/**
|
|
37
|
+
* Override trust requirements for specific directives,
|
|
38
|
+
* merging with `required_trust_defaults_base` (or replacing if that directive is null in the base).
|
|
39
|
+
*/
|
|
40
|
+
required_trust_defaults?: Partial<typeof csp_directive_required_trust_defaults>;
|
|
41
|
+
|
|
42
|
+
/**
|
|
43
|
+
* Base values for directive trust requirements.
|
|
44
|
+
* Set to `null` or `{}` to start with no trust requirements.
|
|
45
|
+
* Defaults to `csp_directive_required_trust_defaults`.
|
|
46
|
+
*/
|
|
47
|
+
required_trust_defaults_base?: Partial<typeof csp_directive_required_trust_defaults> | null;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
/**
|
|
51
|
+
* This is designed for compatibility with SvelteKit
|
|
52
|
+
* and maps to the `KitConfig` `directives` option.
|
|
53
|
+
* The goal is to provide an ergonomic, modern, and safe API
|
|
54
|
+
* for Content Security Policy (CSP) creation
|
|
55
|
+
* that's simple to write and audit, and isn't error-prone.
|
|
56
|
+
*
|
|
57
|
+
* Things like validation and rendering to a string
|
|
58
|
+
* are out of scope and left to SvelteKit.
|
|
59
|
+
*/
|
|
60
|
+
export function create_csp_directives(options: CreateCspDirectivesOptions = {}): CspDirectives {
|
|
61
|
+
const {
|
|
62
|
+
directives: directives_option,
|
|
63
|
+
trusted_sources,
|
|
64
|
+
value_defaults_base = csp_directive_value_defaults,
|
|
65
|
+
value_defaults: value_defaults_option,
|
|
66
|
+
required_trust_defaults_base = csp_directive_required_trust_defaults,
|
|
67
|
+
required_trust_defaults: required_trust_defaults_option,
|
|
68
|
+
} = options;
|
|
69
|
+
|
|
70
|
+
const directives: CspDirectives = {};
|
|
71
|
+
|
|
72
|
+
// Shallowly merge any provided defaults with the base defaults
|
|
73
|
+
const value_defaults = {...value_defaults_base, ...value_defaults_option};
|
|
74
|
+
|
|
75
|
+
// Merge required trust defaults with the base
|
|
76
|
+
const required_trust_defaults = {
|
|
77
|
+
...required_trust_defaults_base,
|
|
78
|
+
...required_trust_defaults_option,
|
|
79
|
+
};
|
|
80
|
+
|
|
81
|
+
// Apply defaults from directive specs
|
|
82
|
+
for (const spec of csp_directive_specs) {
|
|
83
|
+
const default_value = value_defaults[spec.name];
|
|
84
|
+
if (default_value == null) continue; // omit null and undefined
|
|
85
|
+
|
|
86
|
+
directives[spec.name] = Array.isArray(default_value)
|
|
87
|
+
? [...default_value]
|
|
88
|
+
: (default_value as CspDirectiveValue<any>);
|
|
89
|
+
}
|
|
90
|
+
|
|
91
|
+
// Get trust requirements (with overrides applied)
|
|
92
|
+
const trust_requirements: Map<CspDirective, CspTrustLevel | null> = new Map();
|
|
93
|
+
for (const spec of csp_directive_specs) {
|
|
94
|
+
const required_trust = required_trust_defaults[spec.name];
|
|
95
|
+
if (required_trust == null) continue; // omit null and undefined
|
|
96
|
+
|
|
97
|
+
trust_requirements.set(spec.name, required_trust);
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
// Validate trusted_sources directives
|
|
101
|
+
if (trusted_sources?.length) {
|
|
102
|
+
for (const spec of trusted_sources) {
|
|
103
|
+
if (spec.directives) {
|
|
104
|
+
for (const directive of spec.directives) {
|
|
105
|
+
if (parse_csp_directive(directive) === null) {
|
|
106
|
+
throw new Error(`Invalid directive in trusted_sources: ${directive}`);
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
|
|
113
|
+
// Apply trusted sources to directives
|
|
114
|
+
if (trusted_sources?.length) {
|
|
115
|
+
for (const [key, value] of Object.entries(directives)) {
|
|
116
|
+
const directive = parse_csp_directive(key);
|
|
117
|
+
if (directive === null) {
|
|
118
|
+
throw new Error(`Invalid directive in options.directives: ${key}`);
|
|
119
|
+
}
|
|
120
|
+
|
|
121
|
+
// Skip if directive is ['none'] or not an array
|
|
122
|
+
if (is_none_directive(value) || !Array.isArray(value)) {
|
|
123
|
+
continue;
|
|
124
|
+
}
|
|
125
|
+
|
|
126
|
+
// Get required trust for this directive
|
|
127
|
+
const required_trust = trust_requirements.get(directive);
|
|
128
|
+
if (required_trust == null) continue;
|
|
129
|
+
|
|
130
|
+
// Add matching sources - separate the filtering into trust-based and directive-based inclusion
|
|
131
|
+
const sources_to_add = trusted_sources
|
|
132
|
+
.filter((spec) => {
|
|
133
|
+
// Check for explicit inclusion in directives list
|
|
134
|
+
const explicitly_included = spec.directives?.includes(directive) ?? false;
|
|
135
|
+
|
|
136
|
+
// Check for trust level based inclusion
|
|
137
|
+
const has_trust_level = spec.trust !== undefined;
|
|
138
|
+
const include_by_trust = has_trust_level && is_csp_trusted(required_trust, spec.trust);
|
|
139
|
+
|
|
140
|
+
// Include the source if either condition is met
|
|
141
|
+
return explicitly_included || include_by_trust;
|
|
142
|
+
})
|
|
143
|
+
.map((spec) => spec.source);
|
|
144
|
+
|
|
145
|
+
if (sources_to_add.length > 0) {
|
|
146
|
+
directives[directive] = [...value, ...sources_to_add] as CspDirectiveValue<any>;
|
|
147
|
+
}
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
|
|
151
|
+
// Apply directive overrides/transformations
|
|
152
|
+
if (directives_option) {
|
|
153
|
+
for (const [key, value_or_fn] of Object.entries(directives_option)) {
|
|
154
|
+
const directive = parse_csp_directive(key);
|
|
155
|
+
if (directive === null) {
|
|
156
|
+
throw new Error(`Invalid directive in options.directives: ${key}`);
|
|
157
|
+
}
|
|
158
|
+
|
|
159
|
+
const current = directives[directive] as CspDirectiveValue<any>;
|
|
160
|
+
|
|
161
|
+
const result = typeof value_or_fn === 'function' ? value_or_fn(current) : value_or_fn;
|
|
162
|
+
|
|
163
|
+
// Handle `undefined` too just in case
|
|
164
|
+
if (result == null) {
|
|
165
|
+
delete directives[directive]; // eslint-disable-line @typescript-eslint/no-dynamic-delete
|
|
166
|
+
} else {
|
|
167
|
+
directives[directive] = structuredClone(result) as CspDirectiveValue<any>;
|
|
168
|
+
}
|
|
169
|
+
}
|
|
170
|
+
}
|
|
171
|
+
|
|
172
|
+
return directives;
|
|
173
|
+
}
|
|
174
|
+
|
|
175
|
+
export type CspDirective = keyof CspDirectives;
|
|
176
|
+
|
|
177
|
+
export const parse_csp_directive = (directive: unknown): CspDirective | null =>
|
|
178
|
+
typeof directive === 'string' && csp_directive_spec_by_name.has(directive as CspDirective)
|
|
179
|
+
? (directive as CspDirective)
|
|
180
|
+
: null;
|
|
181
|
+
|
|
182
|
+
export type CspDirectiveValue<T extends CspDirective> = Defined<CspDirectives[T]>;
|
|
183
|
+
|
|
184
|
+
export const csp_trust_levels = ['low', 'medium', 'high'] as const;
|
|
185
|
+
|
|
186
|
+
/**
|
|
187
|
+
* Numeric values for CSP trust levels, `csp_trust_levels`.
|
|
188
|
+
* Lower is less trusted.
|
|
189
|
+
* Includes `undefined` in the type for safety.
|
|
190
|
+
*/
|
|
191
|
+
export const csp_trust_level_value: Record<CspTrustLevel, number | undefined> = {
|
|
192
|
+
low: 0,
|
|
193
|
+
medium: 1,
|
|
194
|
+
high: 2,
|
|
195
|
+
};
|
|
196
|
+
|
|
197
|
+
/**
|
|
198
|
+
* Trust levels for CSP sources.
|
|
199
|
+
*
|
|
200
|
+
* With the base defaults, trust levels roughly correspond to:
|
|
201
|
+
*
|
|
202
|
+
* - `low` – Passive resources only (no script execution, no styling or UI control).
|
|
203
|
+
* Examples: `img-src`, `font-src`.
|
|
204
|
+
* - `medium` – Content that may affect layout, styling, or embed external browsing contexts,
|
|
205
|
+
* but cannot directly run code in the page's JS execution environment or
|
|
206
|
+
* perform other high-risk actions. Examples: `style-src`, `frame-src`, `frame-ancestors`.
|
|
207
|
+
* - `high` – Sources that can execute code in the page's context or open powerful network
|
|
208
|
+
* channels. Examples: `script-src`, `connect-src`, `child-src`.
|
|
209
|
+
* - `null` – No trust. This is used for directives that don't support sources.
|
|
210
|
+
*
|
|
211
|
+
*/
|
|
212
|
+
export type CspTrustLevel = ArrayElement<typeof csp_trust_levels>;
|
|
213
|
+
|
|
214
|
+
/**
|
|
215
|
+
* Validates and extracts a CSP trust level from an unknown value.
|
|
216
|
+
*/
|
|
217
|
+
export const parse_csp_trust_level = (trust: unknown): CspTrustLevel | null =>
|
|
218
|
+
csp_trust_levels.includes(trust as any) ? (trust as CspTrustLevel) : null;
|
|
219
|
+
|
|
220
|
+
export interface CspSourceSpec {
|
|
221
|
+
source: CspSource;
|
|
222
|
+
trust?: CspTrustLevel;
|
|
223
|
+
directives?: Array<CspDirective>;
|
|
224
|
+
}
|
|
225
|
+
|
|
226
|
+
export interface CspDirectiveSpec {
|
|
227
|
+
name: CspDirective;
|
|
228
|
+
fallback: Array<CspDirective> | null;
|
|
229
|
+
fallback_of: Array<CspDirective> | null;
|
|
230
|
+
}
|
|
231
|
+
|
|
232
|
+
/**
|
|
233
|
+
* Determines if a granted trust level is sufficient to satisfy a required trust level.
|
|
234
|
+
*
|
|
235
|
+
* Trust levels have the following hierarchy:
|
|
236
|
+
* - 'high' sources can be used in high, medium, and low trust directives (highest privilege)
|
|
237
|
+
* - 'medium' sources can be used in medium and low trust directives
|
|
238
|
+
* - 'low' sources can only be used in low trust directives (lowest privilege)
|
|
239
|
+
*/
|
|
240
|
+
export const is_csp_trusted = (
|
|
241
|
+
required_trust: CspTrustLevel | null | undefined,
|
|
242
|
+
granted_trust: CspTrustLevel | null | undefined,
|
|
243
|
+
): boolean => {
|
|
244
|
+
const required_value = required_trust && csp_trust_level_value[required_trust];
|
|
245
|
+
const granted_value = granted_trust && csp_trust_level_value[granted_trust];
|
|
246
|
+
|
|
247
|
+
if (required_value == null || granted_value == null) {
|
|
248
|
+
return false;
|
|
249
|
+
}
|
|
250
|
+
|
|
251
|
+
// A source with higher trust privilege (higher value)
|
|
252
|
+
// can be used in a directive with less privilege (lower value).
|
|
253
|
+
return granted_value >= required_value;
|
|
254
|
+
};
|
|
255
|
+
|
|
256
|
+
/**
|
|
257
|
+
* Helper to check if a directive value is `['none']`,
|
|
258
|
+
* or more precisely for robustness with malformed values, checks for an array with `'none'`.
|
|
259
|
+
*/
|
|
260
|
+
const is_none_directive = (value: unknown): boolean =>
|
|
261
|
+
Array.isArray(value) && value.includes('none');
|
|
262
|
+
|
|
263
|
+
export const COLOR_SCHEME_SCRIPT_HASH = 'sha256-QOxqn7EUzb3ydF9SALJoJGWSvywW9R0AfTDSenB83Z8=';
|
|
264
|
+
|
|
265
|
+
/**
|
|
266
|
+
* The base CSP directive defaults.
|
|
267
|
+
* Prioritizes safety but loosens around media and styles, relying on defense-in-depth.
|
|
268
|
+
* Customizable via `CreateCspDirectivesOptions.defaults`.
|
|
269
|
+
*/
|
|
270
|
+
export const csp_directive_value_defaults: Record<
|
|
271
|
+
CspDirective,
|
|
272
|
+
CspDirectiveValue<CspDirective> | null
|
|
273
|
+
> = {
|
|
274
|
+
'default-src': ['none'],
|
|
275
|
+
'script-src': ['self', COLOR_SCHEME_SCRIPT_HASH], // Eval is opt-in, scripting is locked down except for self and the color scheme loader script
|
|
276
|
+
'script-src-elem': ['self', COLOR_SCHEME_SCRIPT_HASH], // Block script elements except for self and the color scheme loader
|
|
277
|
+
'script-src-attr': ['none'], // Block scripts in HTML attributes
|
|
278
|
+
'style-src': ['self', 'unsafe-inline'], // Main style directive (uses unsafe-inline but network connections are disallowed by other directives)
|
|
279
|
+
'style-src-elem': ['self', 'unsafe-inline'], // Style elements (standalone stylesheets)
|
|
280
|
+
'style-src-attr': ['unsafe-inline'], // Style attributes
|
|
281
|
+
'img-src': ['self', 'data:', 'blob:', 'filesystem:'], // Images
|
|
282
|
+
'media-src': ['self', 'data:', 'blob:', 'mediastream:', 'filesystem:'], // Audio/video
|
|
283
|
+
'font-src': ['self', 'data:'], // Fonts
|
|
284
|
+
'manifest-src': ['self'], // Web app manifests
|
|
285
|
+
'child-src': ['none'], // Not trusted, extends default-src so worker-src and frame-src are additionally blocked
|
|
286
|
+
'connect-src': ['self'], // Fetch, WebSockets
|
|
287
|
+
'frame-src': ['self'], // Frames/iframes
|
|
288
|
+
'frame-ancestors': ['self'], // Control what can embed this page
|
|
289
|
+
'form-action': ['self'], // Form submission targets
|
|
290
|
+
'worker-src': ['self', 'blob:'], // Web workers
|
|
291
|
+
'object-src': ['none'], // Block plugins (Flash, Java, etc.)
|
|
292
|
+
'base-uri': ['none'], // Prevent base tag hijacking
|
|
293
|
+
'upgrade-insecure-requests': true, // Upgrade http to https
|
|
294
|
+
'report-to': null, // Report violations (e.g. `'/csp-violation-report'`)
|
|
295
|
+
'require-trusted-types-for': null,
|
|
296
|
+
'trusted-types': null,
|
|
297
|
+
sandbox: null,
|
|
298
|
+
};
|
|
299
|
+
|
|
300
|
+
/**
|
|
301
|
+
* Sources that meet this trust requirement are included for it by default.
|
|
302
|
+
* If null, no trusted sources are added to the directive automatically.
|
|
303
|
+
* Directives that don't support sources or default to `['none']` are null.
|
|
304
|
+
*
|
|
305
|
+
* Feedback is welcome, please see the issues - https://github.com/ryanatkn/fuz/issues
|
|
306
|
+
*/
|
|
307
|
+
export const csp_directive_required_trust_defaults: Record<CspDirective, CspTrustLevel | null> = {
|
|
308
|
+
'default-src': null,
|
|
309
|
+
'script-src': 'high',
|
|
310
|
+
'script-src-elem': 'high',
|
|
311
|
+
'script-src-attr': null,
|
|
312
|
+
'style-src': 'medium',
|
|
313
|
+
'style-src-elem': 'medium',
|
|
314
|
+
'style-src-attr': 'medium',
|
|
315
|
+
'img-src': 'low',
|
|
316
|
+
'media-src': 'low',
|
|
317
|
+
'font-src': 'low',
|
|
318
|
+
'manifest-src': null,
|
|
319
|
+
'child-src': null,
|
|
320
|
+
'connect-src': 'medium',
|
|
321
|
+
'frame-src': 'medium',
|
|
322
|
+
'frame-ancestors': 'medium',
|
|
323
|
+
'form-action': 'medium',
|
|
324
|
+
'worker-src': 'medium',
|
|
325
|
+
'object-src': null,
|
|
326
|
+
'base-uri': null,
|
|
327
|
+
'upgrade-insecure-requests': null,
|
|
328
|
+
'report-to': null,
|
|
329
|
+
'require-trusted-types-for': null,
|
|
330
|
+
'trusted-types': null,
|
|
331
|
+
sandbox: null,
|
|
332
|
+
};
|
|
333
|
+
|
|
334
|
+
/**
|
|
335
|
+
* Static data descriptors for the CSP directives.
|
|
336
|
+
* Fuz excludes deprecated directives, so those are intentionally omitted,
|
|
337
|
+
* but any newer missing directives are bugs.
|
|
338
|
+
*
|
|
339
|
+
* Could be moved to `csp.ts` but is currently here to keep that module smaller.
|
|
340
|
+
*
|
|
341
|
+
* @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
|
|
342
|
+
*/
|
|
343
|
+
export const csp_directive_specs: Array<CspDirectiveSpec> = [
|
|
344
|
+
{
|
|
345
|
+
name: 'default-src',
|
|
346
|
+
fallback: null,
|
|
347
|
+
fallback_of: [
|
|
348
|
+
'script-src',
|
|
349
|
+
'script-src-elem',
|
|
350
|
+
'script-src-attr',
|
|
351
|
+
'style-src',
|
|
352
|
+
'style-src-elem',
|
|
353
|
+
'style-src-attr',
|
|
354
|
+
'img-src',
|
|
355
|
+
'media-src',
|
|
356
|
+
'font-src',
|
|
357
|
+
'manifest-src',
|
|
358
|
+
'child-src',
|
|
359
|
+
'connect-src',
|
|
360
|
+
'worker-src',
|
|
361
|
+
'object-src',
|
|
362
|
+
],
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
name: 'script-src',
|
|
366
|
+
fallback: ['default-src'],
|
|
367
|
+
fallback_of: ['script-src-elem', 'script-src-attr', 'worker-src'],
|
|
368
|
+
},
|
|
369
|
+
{
|
|
370
|
+
name: 'script-src-elem',
|
|
371
|
+
fallback: ['script-src', 'default-src'],
|
|
372
|
+
fallback_of: null,
|
|
373
|
+
},
|
|
374
|
+
{
|
|
375
|
+
name: 'script-src-attr',
|
|
376
|
+
fallback: ['script-src', 'default-src'],
|
|
377
|
+
fallback_of: null,
|
|
378
|
+
},
|
|
379
|
+
{
|
|
380
|
+
name: 'style-src',
|
|
381
|
+
fallback: ['default-src'],
|
|
382
|
+
fallback_of: ['style-src-elem', 'style-src-attr'],
|
|
383
|
+
},
|
|
384
|
+
{
|
|
385
|
+
name: 'style-src-elem',
|
|
386
|
+
fallback: ['style-src', 'default-src'],
|
|
387
|
+
fallback_of: null,
|
|
388
|
+
},
|
|
389
|
+
{
|
|
390
|
+
name: 'style-src-attr',
|
|
391
|
+
fallback: ['style-src', 'default-src'],
|
|
392
|
+
fallback_of: null,
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
name: 'img-src',
|
|
396
|
+
fallback: ['default-src'],
|
|
397
|
+
fallback_of: null,
|
|
398
|
+
},
|
|
399
|
+
{
|
|
400
|
+
name: 'media-src',
|
|
401
|
+
fallback: ['default-src'],
|
|
402
|
+
fallback_of: null,
|
|
403
|
+
},
|
|
404
|
+
{
|
|
405
|
+
name: 'font-src',
|
|
406
|
+
fallback: ['default-src'],
|
|
407
|
+
fallback_of: null,
|
|
408
|
+
},
|
|
409
|
+
{
|
|
410
|
+
name: 'manifest-src',
|
|
411
|
+
fallback: ['default-src'],
|
|
412
|
+
fallback_of: null,
|
|
413
|
+
},
|
|
414
|
+
{
|
|
415
|
+
name: 'child-src',
|
|
416
|
+
fallback: ['default-src'],
|
|
417
|
+
fallback_of: ['frame-src', 'worker-src'],
|
|
418
|
+
},
|
|
419
|
+
{
|
|
420
|
+
name: 'connect-src',
|
|
421
|
+
fallback: ['default-src'],
|
|
422
|
+
fallback_of: null,
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
name: 'frame-src',
|
|
426
|
+
fallback: ['child-src'],
|
|
427
|
+
fallback_of: null,
|
|
428
|
+
},
|
|
429
|
+
{
|
|
430
|
+
name: 'frame-ancestors',
|
|
431
|
+
fallback: null,
|
|
432
|
+
fallback_of: null,
|
|
433
|
+
},
|
|
434
|
+
{
|
|
435
|
+
name: 'form-action',
|
|
436
|
+
fallback: null,
|
|
437
|
+
fallback_of: null,
|
|
438
|
+
},
|
|
439
|
+
{
|
|
440
|
+
name: 'worker-src',
|
|
441
|
+
fallback: ['child-src', 'script-src', 'default-src'],
|
|
442
|
+
fallback_of: null,
|
|
443
|
+
},
|
|
444
|
+
{
|
|
445
|
+
name: 'object-src',
|
|
446
|
+
fallback: ['default-src'],
|
|
447
|
+
fallback_of: null,
|
|
448
|
+
},
|
|
449
|
+
{
|
|
450
|
+
name: 'base-uri',
|
|
451
|
+
fallback: null,
|
|
452
|
+
fallback_of: null,
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
name: 'upgrade-insecure-requests',
|
|
456
|
+
fallback: null,
|
|
457
|
+
fallback_of: null,
|
|
458
|
+
},
|
|
459
|
+
{
|
|
460
|
+
name: 'report-to',
|
|
461
|
+
fallback: null,
|
|
462
|
+
fallback_of: null,
|
|
463
|
+
},
|
|
464
|
+
{
|
|
465
|
+
name: 'require-trusted-types-for',
|
|
466
|
+
fallback: null,
|
|
467
|
+
fallback_of: null,
|
|
468
|
+
},
|
|
469
|
+
{
|
|
470
|
+
name: 'trusted-types',
|
|
471
|
+
fallback: null,
|
|
472
|
+
fallback_of: null,
|
|
473
|
+
},
|
|
474
|
+
{
|
|
475
|
+
name: 'sandbox',
|
|
476
|
+
fallback: null,
|
|
477
|
+
fallback_of: null,
|
|
478
|
+
},
|
|
479
|
+
];
|
|
480
|
+
|
|
481
|
+
export const csp_directive_spec_by_name: Map<CspDirective, CspDirectiveSpec> = new Map(
|
|
482
|
+
csp_directive_specs.map((s) => [s.name, s]),
|
|
483
|
+
);
|
|
484
|
+
|
|
485
|
+
// CSP types from SvelteKit, adapted with changes from @sveltejs/kit/src/types/private.d.ts
|
|
486
|
+
//
|
|
487
|
+
// Based on https://github.com/sveltejs/kit/blob/main/packages/kit/src/types/private.d.ts
|
|
488
|
+
//
|
|
489
|
+
// Based on https://github.com/josh-hemphill/csp-typed-directives/blob/latest/src/csp.types.ts
|
|
490
|
+
//
|
|
491
|
+
// MIT License
|
|
492
|
+
//
|
|
493
|
+
// Copyright (c) 2021-present, Joshua Hemphill
|
|
494
|
+
// Copyright (c) 2021, Tecnico Corporation
|
|
495
|
+
//
|
|
496
|
+
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
497
|
+
// of this software and associated documentation files (the "Software"), to deal
|
|
498
|
+
// in the Software without restriction, including without limitation the rights
|
|
499
|
+
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
500
|
+
// copies of the Software, and to permit persons to whom the Software is
|
|
501
|
+
// furnished to do so, subject to the following conditions:
|
|
502
|
+
//
|
|
503
|
+
// The above copyright notice and this permission notice shall be included in all
|
|
504
|
+
// copies or substantial portions of the Software.
|
|
505
|
+
//
|
|
506
|
+
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
507
|
+
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
508
|
+
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
509
|
+
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
510
|
+
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
511
|
+
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
512
|
+
// SOFTWARE.
|
|
513
|
+
export type CspActionSource = 'strict-dynamic' | 'report-sample';
|
|
514
|
+
export type CspBaseSource =
|
|
515
|
+
| 'self'
|
|
516
|
+
| 'unsafe-eval'
|
|
517
|
+
| 'unsafe-hashes'
|
|
518
|
+
| 'unsafe-inline'
|
|
519
|
+
| 'wasm-unsafe-eval'
|
|
520
|
+
| 'none';
|
|
521
|
+
export type CspCryptoSource = `${'nonce' | 'sha256' | 'sha384' | 'sha512'}-${string}`;
|
|
522
|
+
export type CspFrameSource = CspHostSource | CspSchemeSource | 'self' | 'none';
|
|
523
|
+
export type CspHostNameScheme = `${string}.${string}` | 'localhost';
|
|
524
|
+
export type CspHostSource = `${CspHostProtocolSchemes}${CspHostNameScheme}${CspPortScheme}`;
|
|
525
|
+
export type CspHostProtocolSchemes = `${string}://` | '';
|
|
526
|
+
export type CspPortScheme = `:${number}` | '' | ':*';
|
|
527
|
+
export type CspSchemeSource =
|
|
528
|
+
| 'http:'
|
|
529
|
+
| 'https:'
|
|
530
|
+
| 'data:'
|
|
531
|
+
| 'mediastream:'
|
|
532
|
+
| 'blob:'
|
|
533
|
+
| 'filesystem:';
|
|
534
|
+
export type CspSource = CspHostSource | CspSchemeSource | CspCryptoSource | CspBaseSource;
|
|
535
|
+
export type CspSources = Array<CspSource>;
|
|
536
|
+
|
|
537
|
+
export interface CspDirectives {
|
|
538
|
+
'default-src'?: Array<CspSource | CspActionSource>;
|
|
539
|
+
'script-src'?: Array<CspSource | CspActionSource>;
|
|
540
|
+
'script-src-elem'?: CspSources;
|
|
541
|
+
'script-src-attr'?: CspSources;
|
|
542
|
+
'style-src'?: Array<CspSource | CspActionSource>;
|
|
543
|
+
'style-src-elem'?: CspSources;
|
|
544
|
+
'style-src-attr'?: CspSources;
|
|
545
|
+
'img-src'?: CspSources;
|
|
546
|
+
'media-src'?: CspSources;
|
|
547
|
+
'font-src'?: CspSources;
|
|
548
|
+
'manifest-src'?: CspSources;
|
|
549
|
+
'child-src'?: CspSources;
|
|
550
|
+
'connect-src'?: CspSources;
|
|
551
|
+
'frame-src'?: CspSources;
|
|
552
|
+
'frame-ancestors'?: Array<CspFrameSource>;
|
|
553
|
+
'form-action'?: Array<CspSource | CspActionSource>;
|
|
554
|
+
'worker-src'?: CspSources;
|
|
555
|
+
'object-src'?: CspSources;
|
|
556
|
+
'base-uri'?: Array<CspSource | CspActionSource>;
|
|
557
|
+
'upgrade-insecure-requests'?: boolean;
|
|
558
|
+
'report-to'?: Array<string>;
|
|
559
|
+
'require-trusted-types-for'?: Array<'script'>;
|
|
560
|
+
'trusted-types'?: Array<'none' | 'allow-duplicates' | '*' | string>; // eslint-disable-line @typescript-eslint/no-redundant-type-constituents
|
|
561
|
+
sandbox?: Array<
|
|
562
|
+
| 'allow-downloads-without-user-activation'
|
|
563
|
+
| 'allow-forms'
|
|
564
|
+
| 'allow-modals'
|
|
565
|
+
| 'allow-orientation-lock'
|
|
566
|
+
| 'allow-pointer-lock'
|
|
567
|
+
| 'allow-popups'
|
|
568
|
+
| 'allow-popups-to-escape-sandbox'
|
|
569
|
+
| 'allow-presentation'
|
|
570
|
+
| 'allow-same-origin'
|
|
571
|
+
| 'allow-scripts'
|
|
572
|
+
| 'allow-storage-access-by-user-activation'
|
|
573
|
+
| 'allow-top-navigation'
|
|
574
|
+
| 'allow-top-navigation-by-user-activation'
|
|
575
|
+
>;
|
|
576
|
+
}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
import type {CspSourceSpec} from './csp.js';
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* Trusted sources owned by ryanatkn.
|
|
5
|
+
*/
|
|
6
|
+
export const csp_trusted_sources_of_ryanatkn: Array<CspSourceSpec> = [
|
|
7
|
+
{source: 'https://*.ryanatkn.com/', trust: 'low'},
|
|
8
|
+
{source: 'https://*.spiderspace.org/', trust: 'low'},
|
|
9
|
+
{source: 'https://*.webdevladder.net/', trust: 'low'},
|
|
10
|
+
{source: 'https://*.dealt.dev/', trust: 'low'},
|
|
11
|
+
{source: 'https://*.fuz.dev/', trust: 'low'},
|
|
12
|
+
{source: 'https://*.ztack.net/', trust: 'low'},
|
|
13
|
+
{source: 'https://*.zzz.software/', trust: 'low'},
|
|
14
|
+
{source: 'https://*.cosmicplayground.org/', trust: 'low'},
|
|
15
|
+
{source: 'https://ryanatkn.github.io/', trust: 'low'},
|
|
16
|
+
];
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
import {
|
|
2
|
+
type DeclarationJson,
|
|
3
|
+
declaration_generate_import,
|
|
4
|
+
declaration_get_display_name,
|
|
5
|
+
} from '@fuzdev/fuz_util/source_json.js';
|
|
6
|
+
|
|
7
|
+
import type {Module} from './module.svelte.js';
|
|
8
|
+
import {url_github_file} from './library_helpers.js';
|
|
9
|
+
|
|
10
|
+
/**
|
|
11
|
+
* Rich runtime representation of an exported declaration.
|
|
12
|
+
*/
|
|
13
|
+
export class Declaration {
|
|
14
|
+
readonly module: Module = $state.raw()!;
|
|
15
|
+
readonly declaration_json: DeclarationJson = $state.raw()!;
|
|
16
|
+
|
|
17
|
+
library = $derived(this.module.library);
|
|
18
|
+
|
|
19
|
+
/**
|
|
20
|
+
* Module path where this declaration is defined.
|
|
21
|
+
*/
|
|
22
|
+
module_path = $derived(this.module.path);
|
|
23
|
+
|
|
24
|
+
name = $derived(this.declaration_json.name);
|
|
25
|
+
kind = $derived(this.declaration_json.kind);
|
|
26
|
+
|
|
27
|
+
/**
|
|
28
|
+
* GitHub source URL with line number.
|
|
29
|
+
*/
|
|
30
|
+
url_github = $derived(
|
|
31
|
+
this.library.repo_url && this.declaration_json.source_line
|
|
32
|
+
? url_github_file(
|
|
33
|
+
this.library.repo_url,
|
|
34
|
+
`src/lib/${this.module_path}`,
|
|
35
|
+
this.declaration_json.source_line,
|
|
36
|
+
)
|
|
37
|
+
: undefined,
|
|
38
|
+
);
|
|
39
|
+
|
|
40
|
+
/**
|
|
41
|
+
* API documentation URL.
|
|
42
|
+
*/
|
|
43
|
+
url_api = $derived(`/docs/api/${this.module_path}#${this.name}`);
|
|
44
|
+
|
|
45
|
+
/**
|
|
46
|
+
* Generated TypeScript import statement.
|
|
47
|
+
*/
|
|
48
|
+
import_statement = $derived(
|
|
49
|
+
declaration_generate_import(
|
|
50
|
+
this.declaration_json,
|
|
51
|
+
this.module_path,
|
|
52
|
+
this.library.package_json.name,
|
|
53
|
+
),
|
|
54
|
+
);
|
|
55
|
+
|
|
56
|
+
/**
|
|
57
|
+
* Public documentation link (if homepage_url is available).
|
|
58
|
+
*/
|
|
59
|
+
url_api_full = $derived(
|
|
60
|
+
this.library.homepage_url
|
|
61
|
+
? `${this.library.homepage_url.replace(/\/$/, '')}/docs/api/${this.module_path}#${this.name}`
|
|
62
|
+
: undefined,
|
|
63
|
+
);
|
|
64
|
+
|
|
65
|
+
/**
|
|
66
|
+
* Display name with generic parameters.
|
|
67
|
+
*/
|
|
68
|
+
display_name = $derived(declaration_get_display_name(this.declaration_json));
|
|
69
|
+
|
|
70
|
+
type_signature = $derived(this.declaration_json.type_signature);
|
|
71
|
+
doc_comment = $derived(this.declaration_json.doc_comment);
|
|
72
|
+
deprecated_message = $derived(this.declaration_json.deprecated_message);
|
|
73
|
+
parameters = $derived(this.declaration_json.parameters);
|
|
74
|
+
props = $derived(this.declaration_json.props);
|
|
75
|
+
return_type = $derived(this.declaration_json.return_type);
|
|
76
|
+
return_description = $derived(this.declaration_json.return_description);
|
|
77
|
+
generic_params = $derived(this.declaration_json.generic_params);
|
|
78
|
+
extends = $derived(this.declaration_json.extends);
|
|
79
|
+
implements = $derived(this.declaration_json.implements);
|
|
80
|
+
throws = $derived(this.declaration_json.throws);
|
|
81
|
+
since = $derived(this.declaration_json.since);
|
|
82
|
+
examples = $derived(this.declaration_json.examples);
|
|
83
|
+
see_also = $derived(this.declaration_json.see_also);
|
|
84
|
+
members: Array<DeclarationJson> | undefined = $derived(
|
|
85
|
+
this.declaration_json.members as Array<DeclarationJson> | undefined,
|
|
86
|
+
);
|
|
87
|
+
properties: Array<DeclarationJson> | undefined = $derived(
|
|
88
|
+
this.declaration_json.properties as Array<DeclarationJson> | undefined,
|
|
89
|
+
);
|
|
90
|
+
|
|
91
|
+
has_examples = $derived(!!(this.examples && this.examples.length > 0));
|
|
92
|
+
is_deprecated = $derived(!!this.deprecated_message);
|
|
93
|
+
has_documentation = $derived(!!this.doc_comment);
|
|
94
|
+
has_parameters = $derived(!!(this.parameters && this.parameters.length > 0));
|
|
95
|
+
has_props = $derived(!!(this.props && this.props.length > 0));
|
|
96
|
+
has_generics = $derived(!!(this.generic_params && this.generic_params.length > 0));
|
|
97
|
+
|
|
98
|
+
constructor(module: Module, declaration_json: DeclarationJson) {
|
|
99
|
+
this.module = module;
|
|
100
|
+
this.declaration_json = declaration_json;
|
|
101
|
+
}
|
|
102
|
+
}
|