@growth-labs/conformance 0.1.0 → 0.3.0

package/src/schema.ts

@@ -1,9 +1,29 @@
 import { z } from 'zod'
 
-export const EVIDENCE_SCHEMA_VERSION = 'growth-labs.conformance.v1'
+export const EVIDENCE_SCHEMA_VERSION = 'growth-labs.conformance.v2'
+export const REQUIRED_FUNCTIONAL_PROBE_NAMES = [
+	'oauth',
+	'media',
+	'images',
+	'analytics',
+	'embeds',
+	'error-pages',
+] as const
 
 export const REQUIRED_NEGATIVE_FIXTURE_CODES = {
 	'csp-unsafe-inline': 'security.csp.unsafe_inline',
+	'missing-coop': 'security.header.missing',
+	'missing-corp': 'security.header.missing',
+	'hsts-below-one-year': 'security.hsts.max_age_too_low',
+	'csp-wildcard-default-src': 'security.csp.default_src_wildcard',
+	'csp-unsafe-eval': 'security.csp.unsafe_eval',
+	'csp-inline-executable-without-nonce-or-hash':
+		'security.csp.inline_executable_without_nonce_or_hash',
+	'csp-style-attr-inline-without-inventory': 'security.csp.style_attr_inline_inventory_missing',
+	'conflicting-duplicate-security-header': 'security.header.conflicting_values',
+	'missing-functional-probe-receipt': 'security.functional_probe.missing',
+	'missing-csp-report-receipt': 'security.csp_report.missing',
+	'failed-csp-report-receipt': 'security.csp_report.failed',
 	'headers-static-only-while-ssr-missing': 'security.headers.static_only_for_ssr',
 	'undeclared-na': 'publication.na.undeclared',
 	'stringified-is-accessible-for-free': 'structured_data.is_accessible_for_free.stringified',
@@ -62,6 +82,40 @@ export const cacheVariantSchema = z.object({
 	headers: headerMapSchema.default({}),
 })
 
+export const securityFunctionalProbeReceiptSchema = z.object({
+	name: z.string().min(1),
+	status: checkStatusSchema,
+	checkedAt: z.string().min(1).optional(),
+	evidence: z.string().min(1).optional(),
+	capabilityBoundary: z.string().min(1).optional(),
+})
+
+export const cspReportReceiptSchema = z.object({
+	name: z.string().min(1),
+	status: checkStatusSchema,
+	checkedAt: z.string().min(1).optional(),
+	evidence: z.string().min(1).optional(),
+	endpoint: z.string().min(1).optional(),
+	capabilityBoundary: z.string().min(1).optional(),
+})
+
+export const inlineStyleAttributeInventorySchema = z.object({
+	commitSha: z.string().regex(/^[0-9a-f]{40}$/),
+	occurrenceCount: z.number().int().positive(),
+	evidence: z.object({
+		tool: z.string().regex(/^[a-z0-9][a-z0-9:@/._-]*$/i),
+		outputHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+	}),
+})
+
+export const securityReceiptsSchema = z
+	.object({
+		functionalProbes: z.array(securityFunctionalProbeReceiptSchema).default([]),
+		cspReports: z.array(cspReportReceiptSchema).default([]),
+		inlineStyleAttributes: inlineStyleAttributeInventorySchema.optional(),
+	})
+	.default({ functionalProbes: [], cspReports: [] })
+
 export const buildEvidenceSchema = z.object({
 	commitSha: z.string().min(7).optional(),
 	artifactId: z.string().min(1).optional(),
@@ -71,10 +125,81 @@ export const buildEvidenceSchema = z.object({
 	ssrHeaderPolicy: z.boolean().default(false),
 })
 
+const frameAncestorSourceSchema = z.string().superRefine((source, context) => {
+	if (source === "'none'" || source === "'self'" || source === 'https:') return
+	let parsed: URL
+	try {
+		parsed = new URL(source)
+	} catch {
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Expected 'none', 'self', https:, or an exact HTTPS origin.",
+		})
+		return
+	}
+	if (
+		parsed.protocol !== 'https:' ||
+		parsed.username !== '' ||
+		parsed.password !== '' ||
+		parsed.search !== '' ||
+		parsed.hash !== '' ||
+		source !== parsed.origin
+	) {
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Expected 'none', 'self', https:, or an exact HTTPS origin.",
+		})
+	}
+})
+
+const framePolicySchema = z
+	.object({
+		ancestors: z
+			.array(frameAncestorSourceSchema)
+			.min(1)
+			.refine((sources) => new Set(sources).size === sources.length, {
+				message: 'Frame ancestor sources must be unique.',
+			}),
+		legacyHeader: z.enum(['DENY', 'SAMEORIGIN', 'omit']),
+	})
+	.superRefine((policy, context) => {
+		if (policy.ancestors.includes("'none'") && policy.ancestors.length !== 1) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['ancestors'],
+				message: "The 'none' frame ancestor cannot be combined with other sources.",
+			})
+		}
+		if (
+			policy.legacyHeader === 'DENY' &&
+			(policy.ancestors.length !== 1 || policy.ancestors[0] !== "'none'")
+		) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['legacyHeader'],
+				message: "DENY is compatible only with frame-ancestors 'none'.",
+			})
+		}
+		if (
+			policy.legacyHeader === 'SAMEORIGIN' &&
+			(policy.ancestors.length !== 1 || policy.ancestors[0] !== "'self'")
+		) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['legacyHeader'],
+				message: "SAMEORIGIN is compatible only with frame-ancestors 'self'.",
+			})
+		}
+	})
+
 export const conformanceExpectedSchema = z.object({
 	canonicalUrl: z.string().url().optional(),
 	schemaTypes: z.array(z.string().min(1)).default([]),
 	discoverEligible: z.boolean().default(true),
+	framePolicy: framePolicySchema.default({
+		ancestors: ["'none'"],
+		legacyHeader: 'DENY',
+	}),
 })
 
 export const conformanceFixtureSchema = z.object({
@@ -88,6 +213,7 @@ export const conformanceFixtureSchema = z.object({
 	expected: conformanceExpectedSchema.default({}),
 	publicationSurfaces: z.array(publicationSurfaceSchema).default([]),
 	cacheVariants: z.array(cacheVariantSchema).default([]),
+	securityReceipts: securityReceiptsSchema,
 	buildEvidence: buildEvidenceSchema.optional(),
 	expectedFailingCode: z.string().min(1).optional(),
 })
@@ -125,6 +251,7 @@ export const siteEvidenceBundleSchema = z.object({
 	summary: evidenceSummarySchema,
 	checks: z.array(conformanceCheckReceiptSchema),
 	findings: z.array(conformanceFindingSchema),
+	securityReceipts: securityReceiptsSchema,
 })
 
 export const fleetEvidenceBundleSchema = z.object({
@@ -143,6 +270,10 @@ export type HeaderMap = z.infer<typeof headerMapSchema>
 export type SurfaceResponse = z.infer<typeof surfaceResponseSchema>
 export type PublicationSurfaceEvidence = z.infer<typeof publicationSurfaceSchema>
 export type CacheVariant = z.infer<typeof cacheVariantSchema>
+export type SecurityFunctionalProbeReceipt = z.infer<typeof securityFunctionalProbeReceiptSchema>
+export type CspReportReceipt = z.infer<typeof cspReportReceiptSchema>
+export type InlineStyleAttributeInventory = z.infer<typeof inlineStyleAttributeInventorySchema>
+export type SecurityReceipts = z.infer<typeof securityReceiptsSchema>
 export type BuildEvidence = z.infer<typeof buildEvidenceSchema>
 export type ConformanceFixtureInput = z.input<typeof conformanceFixtureSchema>
 export type ConformanceFixture = z.infer<typeof conformanceFixtureSchema>