@hubpav/hwio-web-worker 0.7.1 → 0.7.2

package/README.md

@@ -1,6 +1,8 @@
 # @hubpav/hwio-web-worker
 
 `hwioWorker(options)` is the fetch handler for a HARDWARIO static site on Cloudflare Workers:
-CSP report collector (`POST /csp-report` → 204 + one JSON log line), optional canonical-host
-301, optional Early Hints for fonts. `@hubpav/hwio-web-worker/headers` builds the security
+CSP report collector (`POST /csp-report` → 204; Reporting API batches and legacy `report-uri`
+bodies up to 256 KB, one JSON log line per distinct violation, URLs without query strings; parse
+them yourself with `hwioParseCspReports`), optional canonical-host 301, optional Early Hints for
+fonts. Query the collected reports in Workers Logs with the filter `kind = csp-report`. `@hubpav/hwio-web-worker/headers` builds the security
 headers and renders the `_headers` file the `hwioUi()` Astro integration writes at build time.

package/dist/headers.d.ts

@@ -2,6 +2,12 @@
 export interface HWioHeadersOptions {
     /** Consent-gated Google Tag Manager on this site (adds GTM/GA/Ads origins). */
     gtm?: boolean;
+    /**
+     * Country Google domains GA4 with Ads features calls (`www.google.<tld>/ads/ga-audiences`); a CSP
+     * source cannot wildcard the TLD, so each is listed. Only used with `gtm`. Default: the markets
+     * the sites are written for.
+     */
+    googleTlds?: string[];
     /** Cloudflare Turnstile on this site's forms. */
     turnstile?: boolean;
     /** The forms Worker endpoint origin, e.g. https://submit.hardwario.com */
@@ -35,6 +41,14 @@ export interface HWioHeadersOptions {
      */
     previewNoindex?: boolean;
 }
+/** Default `googleTlds`: the countries of the sites' languages (cs, sk, de, pl) plus DACH neighbours. */
+export declare const HWIO_GOOGLE_TLDS: string[];
+/**
+ * connect-src origins for GA4 with Ads features via GTM, after Google's tag CSP guide
+ * (developers.google.com/tag-platform/security/guides/csp). `*.google.com` also covers
+ * `analytics.google.com/g/collect`, which `*.analytics.google.com` does not match.
+ */
+export declare function hwioGtmConnectOrigins(tlds?: string[]): string[];
 export declare function hwioBuildCsp(o: HWioHeadersOptions): string;
 export declare function hwioSecurityHeaders(o: HWioHeadersOptions): Record<string, string>;
 export declare function hwioEarlyHintLinks(files: string[]): string[];

package/dist/headers.js

@@ -1,4 +1,23 @@
 const uniq = (list) => Array.from(new Set(list));
+/** Default `googleTlds`: the countries of the sites' languages (cs, sk, de, pl) plus DACH neighbours. */
+export const HWIO_GOOGLE_TLDS = ['cz', 'sk', 'de', 'at', 'ch', 'pl'];
+/**
+ * connect-src origins for GA4 with Ads features via GTM, after Google's tag CSP guide
+ * (developers.google.com/tag-platform/security/guides/csp). `*.google.com` also covers
+ * `analytics.google.com/g/collect`, which `*.analytics.google.com` does not match.
+ */
+export function hwioGtmConnectOrigins(tlds = HWIO_GOOGLE_TLDS) {
+    return [
+        'https://www.googletagmanager.com',
+        'https://www.google-analytics.com',
+        'https://*.google-analytics.com',
+        'https://*.analytics.google.com',
+        'https://*.google.com',
+        ...tlds.map((tld) => `https://*.google.${tld}`),
+        'https://*.g.doubleclick.net',
+        'https://pagead2.googlesyndication.com',
+    ];
+}
 export function hwioBuildCsp(o) {
     const script = ["'self'", ...(o.unsafeInlineScripts !== false ? ["'unsafe-inline'"] : []), ...(o.scriptHashes ?? []).map((h) => `'${h}'`)];
     const connect = ["'self'"];
@@ -11,7 +30,7 @@ export function hwioBuildCsp(o) {
     }
     if (o.gtm) {
         script.push('https://www.googletagmanager.com', 'https://www.google-analytics.com', 'https://*.google-analytics.com');
-        connect.push('https://www.googletagmanager.com', 'https://www.google-analytics.com', 'https://*.google-analytics.com', 'https://*.analytics.google.com', 'https://stats.g.doubleclick.net');
+        connect.push(...hwioGtmConnectOrigins(o.googleTlds));
         frame.push('https://www.googletagmanager.com', 'https://td.doubleclick.net');
     }
     if (o.submitEndpoint)

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from './headers.js';
 export interface HWioWorkerOptions {
     /** Redirect anything that is not https://<canonicalHost> with one 301 (Astro hub sites). Null on micro-sites. */
     canonicalHost?: string | null;
-    /** Answer POST /csp-report with 204 after logging one JSON line (Workers Logs). */
+    /** Answer POST /csp-report with 204 after logging one JSON line per distinct violation (Workers Logs). */
     cspReport?: boolean;
     /** Font files to announce as Early Hints on HTML responses served through the Worker. */
     earlyHints?: string[];
@@ -15,6 +15,25 @@ export interface HWioWorkerOptions {
      */
     previewHosts?: string[];
 }
+/** One CSP violation, normalized from either report format; URLs keep origin and path only. */
+export interface HWioCspViolation {
+    directive: string;
+    blocked: string;
+    document: string;
+    source: string;
+    line: number | null;
+    column: number | null;
+    disposition: string;
+    sample: string;
+    count: number;
+}
+/**
+ * Parses a CSP report body: the Reporting API batch (`application/reports+json`, an array of
+ * `{ type: 'csp-violation', body }`, sent for `report-to`) or the legacy `report-uri` object
+ * (`application/csp-report`, `{ 'csp-report': { … } }`). Identical violations are merged into one
+ * entry with a count. Throws on malformed JSON.
+ */
+export declare function hwioParseCspReports(text: string): HWioCspViolation[];
 /**
  * Fetch handler for an Astro static site on Cloudflare Workers with static assets.
  * Sites with `run_worker_first: ["/csp-report"]` only route the collector here; hub sites with

package/dist/index.js

@@ -1,5 +1,94 @@
 import { hwioEarlyHintLinks } from './headers.js';
 export * from './headers.js';
+/** Report bodies above this size are not parsed (Chrome batches reach ~100 KB). */
+const CSP_MAX_BODY = 256 * 1024;
+/** Distinct violations logged per request; the rest is summarized as `dropped`. */
+const CSP_MAX_LINES = 50;
+/** Origin + path of a URL, so query strings (form fields, click ids) never reach the logs. */
+function cspUrl(value) {
+    if (typeof value !== 'string' || !value)
+        return '';
+    try {
+        const u = new URL(value);
+        return u.protocol === 'http:' || u.protocol === 'https:' ? `${u.origin}${u.pathname}` : u.protocol;
+    }
+    catch {
+        return value.slice(0, 200);
+    }
+}
+const cspText = (value, max = 200) => (typeof value === 'string' ? value.slice(0, max) : '');
+const cspNumber = (value) => (Number.isFinite(Number(value)) && value !== null && value !== '' ? Number(value) : null);
+/**
+ * Parses a CSP report body: the Reporting API batch (`application/reports+json`, an array of
+ * `{ type: 'csp-violation', body }`, sent for `report-to`) or the legacy `report-uri` object
+ * (`application/csp-report`, `{ 'csp-report': { … } }`). Identical violations are merged into one
+ * entry with a count. Throws on malformed JSON.
+ */
+export function hwioParseCspReports(text) {
+    const data = JSON.parse(text);
+    const raw = [];
+    if (Array.isArray(data)) {
+        for (const item of data) {
+            if (item && typeof item === 'object' && item.type === 'csp-violation') {
+                const body = item.body;
+                if (body && typeof body === 'object')
+                    raw.push(body);
+            }
+        }
+    }
+    else if (data && typeof data === 'object') {
+        const legacy = data['csp-report'];
+        if (legacy && typeof legacy === 'object')
+            raw.push(legacy);
+    }
+    const merged = new Map();
+    for (const r of raw) {
+        const v = {
+            directive: cspText(r.effectiveDirective ?? r['effective-directive'] ?? r['violated-directive'], 80),
+            blocked: cspUrl(r.blockedURL ?? r['blocked-uri']),
+            document: cspUrl(r.documentURL ?? r['document-uri']),
+            source: cspUrl(r.sourceFile ?? r['source-file']),
+            line: cspNumber(r.lineNumber ?? r['line-number']),
+            column: cspNumber(r.columnNumber ?? r['column-number']),
+            disposition: cspText(r.disposition, 20),
+            sample: cspText(r.sample ?? r['script-sample'], 80),
+            count: 1,
+        };
+        const key = [v.directive, v.blocked, v.document, v.source, v.line, v.column, v.disposition].join('|');
+        const seen = merged.get(key);
+        if (seen)
+            seen.count += 1;
+        else
+            merged.set(key, v);
+    }
+    return [...merged.values()];
+}
+async function logCspReport(request) {
+    const ua = cspText(request.headers.get('user-agent'), 160);
+    const declared = Number(request.headers.get('content-length') ?? 0);
+    if (declared > CSP_MAX_BODY) {
+        console.log(JSON.stringify({ kind: 'csp-report', parse: 'too-large', bytes: declared, ua }));
+        return;
+    }
+    let violations;
+    try {
+        const text = await request.text();
+        if (text.length > CSP_MAX_BODY) {
+            console.log(JSON.stringify({ kind: 'csp-report', parse: 'too-large', bytes: text.length, ua }));
+            return;
+        }
+        violations = hwioParseCspReports(text);
+    }
+    catch {
+        console.log(JSON.stringify({ kind: 'csp-report', parse: 'failed', ua }));
+        return;
+    }
+    for (const v of violations.slice(0, CSP_MAX_LINES))
+        console.log(JSON.stringify({ kind: 'csp-report', ...v, ua }));
+    if (violations.length > CSP_MAX_LINES) {
+        console.log(JSON.stringify({ kind: 'csp-report', dropped: violations.length - CSP_MAX_LINES, ua }));
+    }
+}
 /**
  * Fetch handler for an Astro static site on Cloudflare Workers with static assets.
  * Sites with `run_worker_first: ["/csp-report"]` only route the collector here; hub sites with
@@ -12,15 +101,8 @@ export function hwioWorker(options = {}) {
             const url = new URL(request.url);
             const preview = previewHosts.some((suffix) => url.hostname.endsWith(suffix));
             if (cspReport && url.pathname === '/csp-report') {
-                if (request.method === 'POST') {
-                    try {
-                        const text = (await request.text()).slice(0, 8192);
-                        console.log(JSON.stringify({ kind: 'csp-report', ua: request.headers.get('user-agent') ?? '', report: JSON.parse(text) }));
-                    }
-                    catch {
-                        console.log(JSON.stringify({ kind: 'csp-report', parse: 'failed' }));
-                    }
-                }
+                if (request.method === 'POST')
+                    await logCspReport(request);
                 return new Response(null, { status: 204 });
             }
             if (canonicalHost && !preview && (url.protocol !== 'https:' || url.hostname !== canonicalHost)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hubpav/hwio-web-worker",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Shared Cloudflare Worker handler and security-header builder for the HARDWARIO static sites: canonical-host redirect, CSP report collector, Early Hints, _headers generation.",
   "license": "MIT",
   "type": "module",