@lwrjs/security 0.13.0-alpha.8 → 0.13.0

package/build/cjs/headers.cjs

@@ -26,7 +26,6 @@ __markAsModule(exports);
 __export(exports, {
   resolveHeaders: () => resolveHeaders
 });
-var import_crypto = __toModule(require("crypto"));
 var import_shared_utils = __toModule(require("@lwrjs/shared-utils"));
 var import_content_security_policy = __toModule(require("./headers/content-security-policy.cjs"));
 var import_referrer_policy = __toModule(require("./headers/referrer-policy.cjs"));
@@ -40,22 +39,26 @@ function getResources(viewDefinition) {
   if (viewRecord.bootstrapModule?.resources) {
     resources.push(...viewRecord.bootstrapModule.resources);
   }
+  if (viewRecord.moduleResources) {
+    resources.push(...viewRecord.moduleResources);
+  }
   return resources;
 }
-function hash(source) {
-  return `'sha256-${(0, import_crypto.createHash)("sha256").update(source).digest("base64")}'`;
-}
 async function hashResources(resources) {
   const hashes = [];
   for (const resource of resources) {
-    if (!resource.inline || resource.type !== "application/javascript")
+    if (!resource.inline || resource.type !== "application/javascript") {
+      if (resource.integrity) {
+        hashes.push(`'${resource.integrity}'`);
+      }
       continue;
+    }
     if (resource.content) {
-      hashes.push(hash(resource.content));
+      hashes.push(`'${(0, import_shared_utils.createIntegrityHash)(resource.content)}'`);
     }
     if (resource.stream) {
       const content = await (0, import_shared_utils.streamToString)(resource.stream());
-      hashes.push(hash(content));
+      hashes.push(`'${(0, import_shared_utils.createIntegrityHash)(content)}'`);
     }
   }
   return hashes;
@@ -67,7 +70,7 @@ async function getResourceHashes(viewResponse) {
   const {viewDefinition} = viewResponse.metadata;
   const resources = getResources(viewDefinition);
   const hashes = await hashResources(resources);
-  if (viewDefinition.nonce) {
+  if ((0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE && viewDefinition.nonce) {
     hashes.push(`'nonce-${viewDefinition.nonce}'`);
   }
   return hashes;

package/build/cjs/wrapper.cjs

@@ -51,6 +51,9 @@ function secure(routeHandler, options) {
       return routeHandlerResponse;
     }
     if (isViewDefinitionResponse(routeHandlerResponse)) {
+      if (routeHandlerResponse.locale) {
+        routeHandlerResponse.view.locale = routeHandlerResponse.locale;
+      }
       const viewResponse = await context.viewApi.getViewResponse(routeHandlerResponse.view, routeHandlerResponse.viewParams, routeHandlerResponse.renderOptions);
       viewResponse.headers = {
         ...viewResponse.headers,

package/build/es/headers.js

@@ -1,5 +1,4 @@
-import { createHash } from 'crypto';
-import { streamToString } from '@lwrjs/shared-utils';
+import { createIntegrityHash, getFeatureFlags, streamToString } from '@lwrjs/shared-utils';
 import contentSecurityPolicy from './headers/content-security-policy.js';
 import referrerPolicy from './headers/referrer-policy.js';
 import strictTransportSecurity from './headers/strict-transport-security.js';
@@ -12,24 +11,29 @@ function getResources(viewDefinition) {
     if (viewRecord.bootstrapModule?.resources) {
         resources.push(...viewRecord.bootstrapModule.resources);
     }
+    if (viewRecord.moduleResources) {
+        resources.push(...viewRecord.moduleResources);
+    }
     return resources;
 }
-function hash(source) {
-    return `'sha256-${createHash('sha256').update(source).digest('base64')}'`;
-}
 async function hashResources(resources) {
     const hashes = [];
     for (const resource of resources) {
         // TODO: support other inlined resource types
-        if (!resource.inline || resource.type !== 'application/javascript')
+        if (!resource.inline || resource.type !== 'application/javascript') {
+            // If there is a integrity add that to the CSP hashes
+            if (resource.integrity) {
+                hashes.push(`'${resource.integrity}'`);
+            }
             continue;
+        }
         if (resource.content) {
-            hashes.push(hash(resource.content));
+            hashes.push(`'${createIntegrityHash(resource.content)}'`);
         }
         if (resource.stream) {
             // eslint-disable-next-line no-await-in-loop
             const content = await streamToString(resource.stream());
-            hashes.push(hash(content));
+            hashes.push(`'${createIntegrityHash(content)}'`);
         }
     }
     return hashes;
@@ -42,7 +46,7 @@ async function getResourceHashes(viewResponse) {
     const resources = getResources(viewDefinition);
     const hashes = await hashResources(resources);
     // Add nonce hash
-    if (viewDefinition.nonce) {
+    if (getFeatureFlags().ENABLE_NONCE && viewDefinition.nonce) {
         hashes.push(`'nonce-${viewDefinition.nonce}'`);
     }
     return hashes;

package/build/es/wrapper.js

@@ -37,6 +37,10 @@ export function secure(routeHandler, options) {
             return routeHandlerResponse;
         }
         if (isViewDefinitionResponse(routeHandlerResponse)) {
+            // We have to do this here because we are calling the getViewResponse here. Rather than after the routeHandler was returned
+            if (routeHandlerResponse.locale) {
+                routeHandlerResponse.view.locale = routeHandlerResponse.locale;
+            }
             // resolve the view based on the route handler response
             const viewResponse = await context.viewApi.getViewResponse(routeHandlerResponse.view, routeHandlerResponse.viewParams, routeHandlerResponse.renderOptions);
             viewResponse.headers = {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lwrjs/security",
-    "version": "0.13.0-alpha.8",
+    "version": "0.13.0",
     "license": "MIT",
     "type": "module",
     "types": "build/es/index.d.ts",
@@ -28,14 +28,17 @@
         "build/**/*.cjs",
         "build/**/*.d.ts"
     ],
+    "scripts": {
+        "build": "tsc -b"
+    },
     "dependencies": {
-        "@lwrjs/shared-utils": "0.13.0-alpha.8"
+        "@lwrjs/shared-utils": "0.13.0"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.13.0-alpha.8"
+        "@lwrjs/types": "0.13.0"
     },
     "engines": {
         "node": ">=18.0.0"
     },
-    "gitHead": "91e731eae1457bbbebeb274fa0ea5574705c51a2"
+    "gitHead": "21dc6b8ffd2e633f36b46daf9e1563992c5143b9"
 }