@growth-labs/conformance 0.2.0 → 0.3.1

package/src/schema.ts

@@ -19,6 +19,7 @@ export const REQUIRED_NEGATIVE_FIXTURE_CODES = {
 	'csp-unsafe-eval': 'security.csp.unsafe_eval',
 	'csp-inline-executable-without-nonce-or-hash':
 		'security.csp.inline_executable_without_nonce_or_hash',
+	'csp-style-attr-inline-without-inventory': 'security.csp.style_attr_inline_inventory_missing',
 	'conflicting-duplicate-security-header': 'security.header.conflicting_values',
 	'missing-functional-probe-receipt': 'security.functional_probe.missing',
 	'missing-csp-report-receipt': 'security.csp_report.missing',
@@ -98,10 +99,20 @@ export const cspReportReceiptSchema = z.object({
 	capabilityBoundary: z.string().min(1).optional(),
 })
 
+export const inlineStyleAttributeInventorySchema = z.object({
+	commitSha: z.string().regex(/^[0-9a-f]{40}$/),
+	occurrenceCount: z.number().int().positive(),
+	evidence: z.object({
+		tool: z.string().regex(/^[a-z0-9][a-z0-9:@/._-]*$/i),
+		outputHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+	}),
+})
+
 export const securityReceiptsSchema = z
 	.object({
 		functionalProbes: z.array(securityFunctionalProbeReceiptSchema).default([]),
 		cspReports: z.array(cspReportReceiptSchema).default([]),
+		inlineStyleAttributes: inlineStyleAttributeInventorySchema.optional(),
 	})
 	.default({ functionalProbes: [], cspReports: [] })
 
@@ -114,10 +125,81 @@ export const buildEvidenceSchema = z.object({
 	ssrHeaderPolicy: z.boolean().default(false),
 })
 
+const frameAncestorSourceSchema = z.string().superRefine((source, context) => {
+	if (source === "'none'" || source === "'self'" || source === 'https:') return
+	let parsed: URL
+	try {
+		parsed = new URL(source)
+	} catch {
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Expected 'none', 'self', https:, or an exact HTTPS origin.",
+		})
+		return
+	}
+	if (
+		parsed.protocol !== 'https:' ||
+		parsed.username !== '' ||
+		parsed.password !== '' ||
+		parsed.search !== '' ||
+		parsed.hash !== '' ||
+		source !== parsed.origin
+	) {
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Expected 'none', 'self', https:, or an exact HTTPS origin.",
+		})
+	}
+})
+
+const framePolicySchema = z
+	.object({
+		ancestors: z
+			.array(frameAncestorSourceSchema)
+			.min(1)
+			.refine((sources) => new Set(sources).size === sources.length, {
+				message: 'Frame ancestor sources must be unique.',
+			}),
+		legacyHeader: z.enum(['DENY', 'SAMEORIGIN', 'omit']),
+	})
+	.superRefine((policy, context) => {
+		if (policy.ancestors.includes("'none'") && policy.ancestors.length !== 1) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['ancestors'],
+				message: "The 'none' frame ancestor cannot be combined with other sources.",
+			})
+		}
+		if (
+			policy.legacyHeader === 'DENY' &&
+			(policy.ancestors.length !== 1 || policy.ancestors[0] !== "'none'")
+		) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['legacyHeader'],
+				message: "DENY is compatible only with frame-ancestors 'none'.",
+			})
+		}
+		if (
+			policy.legacyHeader === 'SAMEORIGIN' &&
+			(policy.ancestors.length !== 1 || policy.ancestors[0] !== "'self'")
+		) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['legacyHeader'],
+				message: "SAMEORIGIN is compatible only with frame-ancestors 'self'.",
+			})
+		}
+	})
+
 export const conformanceExpectedSchema = z.object({
 	canonicalUrl: z.string().url().optional(),
 	schemaTypes: z.array(z.string().min(1)).default([]),
 	discoverEligible: z.boolean().default(true),
+	framePolicy: framePolicySchema.default({
+		ancestors: ["'none'"],
+		legacyHeader: 'DENY',
+	}),
 })
 
 export const conformanceFixtureSchema = z.object({
@@ -190,6 +272,7 @@ export type PublicationSurfaceEvidence = z.infer<typeof publicationSurfaceSchema
 export type CacheVariant = z.infer<typeof cacheVariantSchema>
 export type SecurityFunctionalProbeReceipt = z.infer<typeof securityFunctionalProbeReceiptSchema>
 export type CspReportReceipt = z.infer<typeof cspReportReceiptSchema>
+export type InlineStyleAttributeInventory = z.infer<typeof inlineStyleAttributeInventorySchema>
 export type SecurityReceipts = z.infer<typeof securityReceiptsSchema>
 export type BuildEvidence = z.infer<typeof buildEvidenceSchema>
 export type ConformanceFixtureInput = z.input<typeof conformanceFixtureSchema>