@growth-labs/conformance 0.1.0 → 0.3.0

package/src/policy.ts

@@ -1,21 +1,80 @@
-import type { Audience, HeaderMap, RenderMode } from './schema.js'
+import type { AstroConfig } from 'astro'
+import {
+	type Audience,
+	type HeaderMap,
+	type InlineStyleAttributeInventory,
+	inlineStyleAttributeInventorySchema,
+	type RenderMode,
+} from './schema.js'
 
 export const REQUIRED_SECURITY_HEADERS = [
 	'content-security-policy',
 	'strict-transport-security',
+	'cross-origin-opener-policy',
+	'cross-origin-resource-policy',
 	'x-frame-options',
 	'x-content-type-options',
 	'referrer-policy',
 	'permissions-policy',
 ] as const
 
+export type CrossOriginOpenerPolicy = 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none'
+export type CrossOriginResourcePolicy = 'same-origin' | 'same-site' | 'cross-origin'
+
+export interface StrictTransportSecurityOptions {
+	maxAgeSeconds?: number
+	includeSubDomains?: boolean
+	preload?: boolean
+}
+
+export interface ContentSecurityPolicyOptions {
+	nonce?: string
+	reportUri?: string
+	reportTo?: string
+}
+
 export interface HeaderPolicyOptions {
 	renderMode: RenderMode
 	audience: Audience
 	nonce?: string
+	cspReportUri?: string
+	cspReportTo?: string
+	contentSecurityPolicy?: false | ContentSecurityPolicyOptions
+	strictTransportSecurity?: StrictTransportSecurityOptions
+	crossOriginOpenerPolicy?: CrossOriginOpenerPolicy
+	crossOriginResourcePolicy?: CrossOriginResourcePolicy
 	markdownTwinUrl?: string
 }
 
+export interface AstroCspPolicyOptions {
+	scriptSources?: readonly string[]
+	styleSources?: readonly string[]
+	inlineStyleAttributes?: InlineStyleAttributeInventory
+	imgSources?: readonly string[]
+	fontSources?: readonly string[]
+	connectSources?: readonly string[]
+	mediaSources?: readonly string[]
+	frameSources?: readonly string[]
+}
+
+type AstroNativeCspConfig = Exclude<
+	NonNullable<NonNullable<AstroConfig['security']>['csp']>,
+	boolean
+>
+
+type AstroCspDirective = NonNullable<AstroNativeCspConfig['directives']>[number]
+
+export type AstroCspResource = NonNullable<
+	NonNullable<AstroNativeCspConfig['styleDirective']>['resources']
+>[number]
+
+export interface AstroCspConfig {
+	algorithm: 'SHA-256'
+	directives: AstroCspDirective[]
+	scriptDirective: { resources: string[] }
+	styleDirective: { resources: AstroCspResource[] }
+}
+
 export interface CachePolicyOptions {
 	renderMode: RenderMode
 	audience: Audience
@@ -25,8 +84,9 @@ export function buildSharedPublicationHeaders(
 	options: HeaderPolicyOptions,
 ): Record<string, string> {
 	const headers: Record<string, string> = {
-		'Content-Security-Policy': buildContentSecurityPolicy(options.nonce),
-		'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
+		'Strict-Transport-Security': buildStrictTransportSecurity(options.strictTransportSecurity),
+		'Cross-Origin-Opener-Policy': options.crossOriginOpenerPolicy ?? 'same-origin',
+		'Cross-Origin-Resource-Policy': options.crossOriginResourcePolicy ?? 'same-origin',
 		'X-Frame-Options': 'DENY',
 		'X-Content-Type-Options': 'nosniff',
 		'Referrer-Policy': 'strict-origin-when-cross-origin',
@@ -34,6 +94,15 @@ export function buildSharedPublicationHeaders(
 			'accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()',
 		'Cache-Control': buildCacheControl(options),
 	}
+	if (options.contentSecurityPolicy !== false) {
+		headers['Content-Security-Policy'] = buildContentSecurityPolicy(
+			options.contentSecurityPolicy ?? {
+				nonce: options.nonce,
+				reportUri: options.cspReportUri,
+				reportTo: options.cspReportTo,
+			},
+		)
+	}
 
 	if (options.markdownTwinUrl) {
 		headers.Link = `<${options.markdownTwinUrl}>; rel="alternate"; type="text/markdown"`
@@ -42,15 +111,107 @@ export function buildSharedPublicationHeaders(
 	return headers
 }
 
-export function buildContentSecurityPolicy(nonce?: string): string {
+/**
+ * Build framework-owned CSP configuration for Astro 7.1+.
+ * Astro hashes every script and style it emits, while this helper keeps the
+ * consumer's external source inventory exact and fail-closed.
+ */
+export function buildAstroCspConfig(options: AstroCspPolicyOptions = {}): AstroCspConfig {
+	const inlineStyleAttributes = options.inlineStyleAttributes
+		? inlineStyleAttributeInventorySchema.parse(options.inlineStyleAttributes)
+		: undefined
+	const scriptSources = exactCspSources(options.scriptSources)
+	const styleSources = exactCspSources(options.styleSources)
+	const imgSources = exactCspSources(options.imgSources)
+	const fontSources = exactCspSources(options.fontSources)
+	const connectSources = exactCspSources(options.connectSources)
+	const mediaSources = exactCspSources(options.mediaSources)
+	const frameSources = exactCspSources(options.frameSources)
+
+	return {
+		algorithm: 'SHA-256',
+		directives: [
+			"default-src 'self'",
+			cspDirective('img-src', ["'self'", 'data:', 'blob:', ...imgSources]),
+			cspDirective('font-src', ["'self'", 'data:', ...fontSources]),
+			cspDirective('connect-src', ["'self'", ...connectSources]),
+			cspDirective('media-src', ["'self'", 'blob:', ...mediaSources]),
+			cspDirective('frame-src', ["'self'", ...frameSources]),
+			"object-src 'none'",
+			"base-uri 'self'",
+			"frame-ancestors 'none'",
+			"form-action 'self'",
+			'upgrade-insecure-requests',
+		],
+		scriptDirective: {
+			resources: uniqueCspSources(["'self'", ...scriptSources]),
+		},
+		styleDirective: {
+			resources: inlineStyleAttributes
+				? [
+						...uniqueCspSources(["'self'", ...styleSources]).map((resource) => ({
+							resource,
+							kind: 'element' as const,
+						})),
+						{ resource: "'unsafe-inline'", kind: 'attribute' as const },
+					]
+				: uniqueCspSources(["'self'", ...styleSources]),
+		},
+	} satisfies AstroNativeCspConfig
+}
+
+function uniqueCspSources(sources: readonly string[]): string[] {
+	return [...new Set(sources)]
+}
+
+function cspDirective(name: string, sources: readonly string[]): AstroCspDirective {
+	return `${name} ${[...new Set(sources)].join(' ')}` as AstroCspDirective
+}
+
+function exactCspSources(sources: readonly string[] | undefined): string[] {
+	return [...new Set(sources ?? [])].map((source) => {
+		const normalized = source.trim()
+		if (normalized === "'self'") return normalized
+		if (
+			normalized === '' ||
+			normalized.includes('*') ||
+			normalized === 'https:' ||
+			normalized === 'http:' ||
+			normalized.startsWith("'unsafe-")
+		) {
+			throw new Error(`Astro CSP sources must be exact and cannot use ${source}`)
+		}
+
+		let parsed: URL
+		try {
+			parsed = new URL(normalized)
+		} catch {
+			throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`)
+		}
+		if (
+			(parsed.protocol !== 'https:' && parsed.protocol !== 'wss:') ||
+			parsed.username !== '' ||
+			parsed.password !== '' ||
+			parsed.search !== '' ||
+			parsed.hash !== '' ||
+			(parsed.pathname !== '' && parsed.pathname !== '/')
+		) {
+			throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`)
+		}
+		return parsed.origin
+	})
+}
+
+export function buildContentSecurityPolicy(input?: string | ContentSecurityPolicyOptions): string {
+	const options = typeof input === 'string' ? { nonce: input } : (input ?? {})
 	const scriptSources = ["'self'"]
 	const styleSources = ["'self'"]
-	if (nonce) {
-		scriptSources.push(`'nonce-${nonce}'`)
-		styleSources.push(`'nonce-${nonce}'`)
+	if (options.nonce) {
+		scriptSources.push(`'nonce-${options.nonce}'`)
+		styleSources.push(`'nonce-${options.nonce}'`)
 	}
 
-	return [
+	const directives = [
 		"default-src 'self'",
 		`script-src ${scriptSources.join(' ')}`,
 		`style-src ${styleSources.join(' ')}`,
@@ -61,7 +222,28 @@ export function buildContentSecurityPolicy(nonce?: string): string {
 		"base-uri 'self'",
 		"frame-ancestors 'none'",
 		'upgrade-insecure-requests',
-	].join('; ')
+	]
+	if (options.reportTo) directives.push(`report-to ${options.reportTo}`)
+	if (options.reportUri) directives.push(`report-uri ${options.reportUri}`)
+
+	return directives.join('; ')
+}
+
+export function buildStrictTransportSecurity(options: StrictTransportSecurityOptions = {}): string {
+	const maxAgeSeconds = options.maxAgeSeconds ?? 31536000
+	if (!Number.isInteger(maxAgeSeconds) || maxAgeSeconds < 31536000) {
+		throw new Error('Strict-Transport-Security maxAgeSeconds must be at least 31536000')
+	}
+	if (options.preload === true && options.includeSubDomains !== true) {
+		throw new Error(
+			'Strict-Transport-Security preload requires includeSubDomains after host inventory proof',
+		)
+	}
+
+	const directives = [`max-age=${maxAgeSeconds}`]
+	if (options.includeSubDomains === true) directives.push('includeSubDomains')
+	if (options.preload === true) directives.push('preload')
+	return directives.join('; ')
 }
 
 export function buildCacheControl({ renderMode, audience }: CachePolicyOptions): string {
@@ -73,14 +255,23 @@ export function buildCacheControl({ renderMode, audience }: CachePolicyOptions):
 }
 
 export function normalizeHeaders(headers: HeaderMap | undefined): Record<string, string> {
+	const entries = collectHeaders(headers)
 	const normalized: Record<string, string> = {}
-	if (!headers) return normalized
+	for (const [name, values] of Object.entries(entries)) {
+		normalized[name] = values.join(', ')
+	}
+	return normalized
+}
 
+export function collectHeaders(headers: HeaderMap | undefined): Record<string, string[]> {
+	const normalized: Record<string, string[]> = {}
+	if (!headers) return normalized
 	for (const [name, value] of Object.entries(headers)) {
+		const normalizedName = name.toLowerCase()
 		if (typeof value === 'string') {
-			normalized[name.toLowerCase()] = value
+			normalized[normalizedName] = [...(normalized[normalizedName] ?? []), value]
 		} else if (Array.isArray(value)) {
-			normalized[name.toLowerCase()] = value.join(', ')
+			normalized[normalizedName] = [...(normalized[normalizedName] ?? []), ...value]
 		}
 	}