@hubpav/hwio-web-worker 0.1.0

package/README.md

@@ -0,0 +1,6 @@
+# @hubpav/hwio-web-worker
+
+`hwioWorker(options)` is the fetch handler for a HARDWARIO static site on Cloudflare Workers:
+CSP report collector (`POST /csp-report` → 204 + one JSON log line), optional canonical-host
+301, optional Early Hints for fonts. `@hubpav/hwio-web-worker/headers` builds the security
+headers and renders the `_headers` file the `hwioUi()` Astro integration writes at build time.

package/dist/headers.d.ts

@@ -0,0 +1,36 @@
+/** Options for the security headers a site ships (written into `_headers` at build time). */
+export interface HWioHeadersOptions {
+    /** Consent-gated Google Tag Manager on this site (adds GTM/GA/Ads origins). */
+    gtm?: boolean;
+    /** Cloudflare Turnstile on this site's forms. */
+    turnstile?: boolean;
+    /** The forms Worker endpoint origin, e.g. https://submit.hardwario.com */
+    submitEndpoint?: string;
+    /** Extra frame-src origins (YouTube, HubSpot meetings). */
+    frames?: string[];
+    /** Extra script-src origins. */
+    scripts?: string[];
+    /** Extra connect-src origins. */
+    connect?: string[];
+    /** SHA-256 hashes ('sha256-…') of the inline bootstrap scripts. */
+    scriptHashes?: string[];
+    /** Keep 'unsafe-inline' in script-src (needed until every inline script is hashed). */
+    unsafeInlineScripts?: boolean;
+    /** Ship the CSP as Content-Security-Policy-Report-Only instead of enforcing. */
+    reportOnly?: boolean;
+    /** First-party collector path for CSP reports (the Worker answers it with 204). */
+    reportUri?: string | null;
+    /** HSTS: 'basic' = max-age only (www), 'strict' = includeSubDomains + preload (enerooo). */
+    hsts?: 'basic' | 'strict' | 'none';
+    /** Font files to announce as Early Hints on HTML responses (Cloudflare replays Link headers as 103). */
+    earlyHints?: string[];
+    /** Additional cache rules, path glob -> Cache-Control value. */
+    cache?: Record<string, string>;
+    /** Extra headers on every response (e.g. X-Robots-Tag: noindex). */
+    extra?: Record<string, string>;
+}
+export declare function hwioBuildCsp(o: HWioHeadersOptions): string;
+export declare function hwioSecurityHeaders(o: HWioHeadersOptions): Record<string, string>;
+export declare function hwioEarlyHintLinks(files: string[]): string[];
+/** Renders a Cloudflare `_headers` file: immutable build assets, fonts, media, then the security block on `/*`. */
+export declare function hwioRenderHeadersFile(o: HWioHeadersOptions): string;

package/dist/headers.js

@@ -0,0 +1,74 @@
+const uniq = (list) => Array.from(new Set(list));
+export function hwioBuildCsp(o) {
+    const script = ["'self'", ...(o.unsafeInlineScripts !== false ? ["'unsafe-inline'"] : []), ...(o.scriptHashes ?? []).map((h) => `'${h}'`)];
+    const connect = ["'self'"];
+    const img = ["'self'", 'data:', 'https:'];
+    const frame = [];
+    if (o.turnstile) {
+        script.push('https://challenges.cloudflare.com');
+        connect.push('https://challenges.cloudflare.com');
+        frame.push('https://challenges.cloudflare.com');
+    }
+    if (o.gtm) {
+        script.push('https://www.googletagmanager.com', 'https://www.google-analytics.com', 'https://*.google-analytics.com');
+        connect.push('https://www.googletagmanager.com', 'https://www.google-analytics.com', 'https://*.google-analytics.com', 'https://*.analytics.google.com', 'https://stats.g.doubleclick.net');
+        frame.push('https://www.googletagmanager.com', 'https://td.doubleclick.net');
+    }
+    if (o.submitEndpoint)
+        connect.push(o.submitEndpoint);
+    script.push(...(o.scripts ?? []));
+    connect.push(...(o.connect ?? []));
+    frame.push(...(o.frames ?? []));
+    const directives = [
+        "default-src 'self'",
+        "base-uri 'self'",
+        "object-src 'none'",
+        "form-action 'self'",
+        "frame-ancestors 'self'",
+        `script-src ${uniq(script).join(' ')}`,
+        "style-src 'self' 'unsafe-inline'",
+        `img-src ${uniq(img).join(' ')}`,
+        "font-src 'self' data:",
+        `connect-src ${uniq(connect).join(' ')}`,
+        ...(frame.length ? [`frame-src ${uniq(frame).join(' ')}`] : ["frame-src 'none'"]),
+        'upgrade-insecure-requests',
+    ];
+    if (o.reportUri)
+        directives.push(`report-uri ${o.reportUri}`, 'report-to csp-endpoint');
+    return directives.join('; ');
+}
+export function hwioSecurityHeaders(o) {
+    const headers = {
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'SAMEORIGIN',
+        'Referrer-Policy': 'strict-origin-when-cross-origin',
+        'Permissions-Policy': 'geolocation=(), microphone=(), camera=(), payment=()',
+    };
+    const hsts = o.hsts ?? 'basic';
+    if (hsts === 'basic')
+        headers['Strict-Transport-Security'] = 'max-age=31536000';
+    if (hsts === 'strict')
+        headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload';
+    const reportUri = o.reportUri === undefined ? '/csp-report' : o.reportUri;
+    if (reportUri)
+        headers['Reporting-Endpoints'] = `csp-endpoint="${reportUri}"`;
+    headers[o.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'] = hwioBuildCsp({ ...o, reportUri });
+    return { ...headers, ...(o.extra ?? {}) };
+}
+export function hwioEarlyHintLinks(files) {
+    return files.map((f) => `<${f}>; rel=preload; as=font; type=font/woff2; crossorigin`);
+}
+/** Renders a Cloudflare `_headers` file: immutable build assets, fonts, media, then the security block on `/*`. */
+export function hwioRenderHeadersFile(o) {
+    const cache = {
+        '/_astro/*': 'public, max-age=31536000, immutable',
+        '/fonts/*': 'public, max-age=31536000, immutable',
+        '/images/*': 'public, max-age=2592000, must-revalidate',
+        ...(o.cache ?? {}),
+    };
+    const blocks = Object.entries(cache).map(([path, value]) => `${path}\n  Cache-Control: ${value}`);
+    const security = Object.entries(hwioSecurityHeaders(o)).map(([k, v]) => `  ${k}: ${v}`);
+    const hints = (o.earlyHints ?? []).length ? hwioEarlyHintLinks(o.earlyHints).map((l) => `  Link: ${l}`) : [];
+    blocks.push(`/*\n${[...security, ...hints].join('\n')}`);
+    return `# Generated by @hubpav/hwio-web-worker (hwioRenderHeadersFile). Edit the site's hwioUi() options, not this file.\n${blocks.join('\n\n')}\n`;
+}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export * from './headers.js';
+export interface HWioWorkerOptions {
+    /** Redirect anything that is not https://<canonicalHost> with one 301 (Astro hub sites). Null on micro-sites. */
+    canonicalHost?: string | null;
+    /** Answer POST /csp-report with 204 after logging one JSON line (Workers Logs). */
+    cspReport?: boolean;
+    /** Font files to announce as Early Hints on HTML responses served through the Worker. */
+    earlyHints?: string[];
+    /** Name of the static assets binding. */
+    assetsBinding?: string;
+}
+/**
+ * Fetch handler for an Astro static site on Cloudflare Workers with static assets.
+ * Sites with `run_worker_first: ["/csp-report"]` only route the collector here; hub sites with
+ * `run_worker_first: true` also get the canonical redirect and Early Hints.
+ */
+export declare function hwioWorker(options?: HWioWorkerOptions): {
+    fetch(request: Request, env: Record<string, unknown>): Promise<Response>;
+};

package/dist/index.js

@@ -0,0 +1,42 @@
+import { hwioEarlyHintLinks } from './headers.js';
+export * from './headers.js';
+/**
+ * Fetch handler for an Astro static site on Cloudflare Workers with static assets.
+ * Sites with `run_worker_first: ["/csp-report"]` only route the collector here; hub sites with
+ * `run_worker_first: true` also get the canonical redirect and Early Hints.
+ */
+export function hwioWorker(options = {}) {
+    const { canonicalHost = null, cspReport = true, earlyHints = [], assetsBinding = 'ASSETS' } = options;
+    return {
+        async fetch(request, env) {
+            const url = new URL(request.url);
+            if (cspReport && url.pathname === '/csp-report') {
+                if (request.method === 'POST') {
+                    try {
+                        const text = (await request.text()).slice(0, 8192);
+                        console.log(JSON.stringify({ kind: 'csp-report', ua: request.headers.get('user-agent') ?? '', report: JSON.parse(text) }));
+                    }
+                    catch {
+                        console.log(JSON.stringify({ kind: 'csp-report', parse: 'failed' }));
+                    }
+                }
+                return new Response(null, { status: 204 });
+            }
+            if (canonicalHost && (url.protocol !== 'https:' || url.hostname !== canonicalHost)) {
+                url.protocol = 'https:';
+                url.hostname = canonicalHost;
+                return Response.redirect(url.toString(), 301);
+            }
+            const assets = env[assetsBinding];
+            if (!assets)
+                return new Response('assets binding missing', { status: 500 });
+            const res = await assets.fetch(request);
+            if (earlyHints.length && res.status === 200 && (res.headers.get('content-type') ?? '').includes('text/html')) {
+                const withHints = new Response(res.body, res);
+                hwioEarlyHintLinks(earlyHints).forEach((l) => withHints.headers.append('Link', l));
+                return withHints;
+            }
+            return res;
+        },
+    };
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@hubpav/hwio-web-worker",
+  "version": "0.1.0",
+  "description": "Shared Cloudflare Worker handler and security-header builder for the HARDWARIO static sites: canonical-host redirect, CSP report collector, Early Hints, _headers generation.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hardwario/website-ui.git",
+    "directory": "packages/web-worker"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./headers": {
+      "types": "./dist/headers.d.ts",
+      "default": "./dist/headers.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test \"test/**/*.test.mjs\""
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "sideEffects": false
+}