@inizioevoke/evosynth 2.2.0 → 2.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inizioevoke/evosynth",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "author": "",
   "license": "ISC",
   "description": "",

package/readme.md

@@ -154,6 +154,83 @@ export async function uat(): Promise<WebStaticServerlessAppConfig> {
 }
 ```
 
+### Content Security Policy Headers
+
+You can configure Content Security Policy (CSP) headers through the `cloudfront.cspHeaders` option. CSP headers can be defined as either an object or a string format.
+
+#### Inline CSP Headers (Object Format)
+
+Define CSP directives as an object where each key is a directive and values are arrays of policies:
+
+```typescript
+cloudfront: {
+  cspHeaders: {
+    'default-src': ["'self'"],
+    'script-src': ["'self'", "'unsafe-inline'", 'https://trusted.com'],
+    'style-src': ["'self'", "'unsafe-inline'"],
+    'img-src': ["'self'", 'data:', 'https:']
+  }
+}
+```
+
+#### Inline CSP Headers (String Format)
+
+Alternatively, define CSP as a single string:
+
+```typescript
+cloudfront: {
+  cspHeaders: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"
+}
+```
+
+#### Import from TypeScript/JavaScript File
+
+Create a separate file with your CSP configuration and import it:
+
+```typescript
+// csp.ts
+export default {
+  'default-src': ["'self'"],
+  'script-src': ["'self'", "'unsafe-inline'"]
+};
+
+// .evosynth.dev.ts
+import cspHeaders from './csp';
+
+export default async function(): Promise<WebStaticServerlessAppConfig> {
+  return {
+    // ... other config
+    cloudfront: {
+      cspHeaders
+    }
+  }
+}
+```
+
+#### Import from CSV File
+
+You can also load CSP headers from a CSV file. See [samples/csp.csv](samples/csp.csv) for the expected format:
+
+```typescript
+// .evosynth.dev.ts
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+export default async function(): Promise<WebStaticServerlessAppConfig> {
+  const cspHeaders = await readFile(
+    join(import.meta.dirname, 'csp.csv'),
+    'utf8'
+  );
+
+  return {
+    // ... other config
+    cloudfront: {
+      cspHeaders
+    }
+  }
+}
+```
+
 ## CDK App
 
 Use evosynth in a traditional CDK app script by instantiating a stage or stack. Use individual constructs for custom apps.

package/samples/.evosynth.env.ts

@@ -19,20 +19,15 @@ export default async function(): Promise<WebStaticServerlessAppConfig> {
       basicAuthParam: '/evosynth/web/security/basicauth',
       webAclParam: '/evosynth/web/security/webacl'
     },
-    // cloudfront: {
-    //   redirects: {
-    //     paths: {
-    //       '/hello': '/world',
-    //       '/redirect': ['/here', 302]
-    //     }
-    //   }
-    // },
     pipeline: {
       source: {
         codestarConnectionParam: '/evosynth/provider/codeconnection',
         owner: 'orgname',
         repo: 'myproject-v1',
         branch: 'develop'
+      },
+      build: {
+        buildImageNodeJS: 24
       }
     }
   }

package/samples/.evosynth.ts

@@ -1,5 +1,12 @@
 import type { WebStaticServerlessAppConfig } from '@inizioevoke/evosynth';
 
+// import CSP headers from an external typescript/javascript file
+// import cspHeaders from './csp';
+// OR import from a CSV file
+// import { readFile } from 'node:fs/promises';
+// import { join } from 'node:path';
+// const cspHeaders = await readFile(join(import.meta.dirname, 'csp.csv'), 'utf8');
+
 const config: Omit<WebStaticServerlessAppConfig, 'dns'> = {
   type: 'web-static-serverless',
   name: 'my-project',
@@ -19,11 +26,9 @@ const config: Omit<WebStaticServerlessAppConfig, 'dns'> = {
     cspHeaders: {
       'default-src': [
         "'self'"
-      ],
-      'script-src': [
-        "'self'"
       ]
-    }
+    },
+    // cspHeaders: "default-src 'self';"
   },
   security: {
     basicAuthParam: '/evosynth/web/security/basicauth',

package/samples/csp.csv

@@ -0,0 +1,7 @@
+source,default-src,connect-src,font-src,frame-src,img-src,media-src,object-src,script-src,style-src
+'self',x,x,x,,x,,,x,x
+'unsafe-inline',,,,,,,,,x
+data:,,,x,,,,,,
+p.typekit.net,,,,,x,,,,x
+performance.typekit.net,,x,,,,,,,
+use.typekit.net,,,x,,,,,x,x

package/samples/csp.ts

@@ -4,9 +4,29 @@ const cspHeaders: CspHeaders = {
   'default-src': [
     "'self'"
   ],
+  'connect-src': [
+    "'self'",
+    'performance.typekit.net',
+  ],
+  'font-src': [
+    "'self'",
+    'data:',
+    'use.typekit.net'
+  ],
+  'img-src': [
+    "'self'",
+    'p.typekit.net'
+  ],
   'script-src': [
-    "'self'"
+    "'self'",
+    'use.typekit.net',
+  ],
+  'style-src': [
+    "'self'",
+    "'unsafe-inline'",
+    'p.typekit.net',
+    'use.typekit.net'
   ]
-}
+};
 
-export default cspHeaders;
+export default cspHeaders;