@maestro-js/init 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   buildProjectTree,
   getInitVersion,
   scaffold
-} from "./chunk-52NA54G4.js";
+} from "./chunk-FO3IYFDW.js";
 
 // src/bin.ts
 import crypto from "crypto";

package/dist/{chunk-52NA54G4.js → chunk-FO3IYFDW.js}

@@ -909,34 +909,93 @@ export function getRequestContext(context: Readonly<RouterContextProvider>) {
   return request
 }
 `;
-var csrfMiddlewareServer = `import type { MiddlewareFunction } from 'react-router'
+var csrfMiddlewareServer = `import { timingSafeEqual } from 'node:crypto'
+import type { MiddlewareFunction } from 'react-router'
 import { getRequestContext } from './request-context.server'
 
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+
 export const csrfMiddleware: MiddlewareFunction<Response> = async ({ request, context }, next) => {
-  const mutatingMethods = ['POST', 'PUT', 'DELETE']
-  if (mutatingMethods.includes(request.method)) {
-    const cloned = request.clone()
-    const formDataForMiddleware = await cloned.formData()
-    const clientCsrfToken = formDataForMiddleware.get('__csrfToken')
-    const requestContext = getRequestContext(context)
-    const sessionCsrfToken = requestContext.session.getCsrfToken()
-    if (clientCsrfToken !== sessionCsrfToken) {
-      throw new Response('Invalid CSRF token', { status: 403 })
+  if (!MUTATING_METHODS.has(request.method)) {
+    return next()
+  }
+
+  // Routes accepting JSON or other non-form bodies use an X-CSRF-Token header
+  // instead of a hidden form field. Either way, never throw 500 from this
+  // middleware on a malformed body \u2014 return a clean 403.
+  const contentType = request.headers.get('content-type') ?? ''
+  let clientCsrfToken: string | null = null
+  if (contentType.startsWith('application/x-www-form-urlencoded') || contentType.startsWith('multipart/form-data')) {
+    try {
+      const cloned = request.clone()
+      const formData = await cloned.formData()
+      const value = formData.get('__csrfToken')
+      clientCsrfToken = typeof value === 'string' ? value : null
+    } catch {
+      clientCsrfToken = null
     }
+  } else {
+    clientCsrfToken = request.headers.get('x-csrf-token')
+  }
+
+  const requestContext = getRequestContext(context)
+  const sessionCsrfToken = requestContext.session.getCsrfToken()
+
+  if (!clientCsrfToken || !constantTimeEqual(clientCsrfToken, sessionCsrfToken)) {
+    throw new Response('Invalid CSRF token', { status: 403 })
   }
   return next()
 }
+
+function constantTimeEqual(a: string, b: string): boolean {
+  const aBuf = Buffer.from(a)
+  const bBuf = Buffer.from(b)
+  if (aBuf.length !== bBuf.length) return false
+  return timingSafeEqual(aBuf, bBuf)
+}
 `;
 var securityHeadersMiddlewareServer = `import type { MiddlewareFunction } from 'react-router'
 
+// Security-headers middleware must be the OUTERMOST middleware so that headers
+// are applied to thrown Responses (e.g. 403s from csrfMiddleware) as well as
+// returned ones \u2014 try/finally ensures both code paths get the headers.
 export const securityHeadersMiddleware: MiddlewareFunction<Response> = async (_args, next) => {
-  const response = await next()
-  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
-  response.headers.set('X-Content-Type-Options', 'nosniff')
-  response.headers.set('X-Frame-Options', 'DENY')
-  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+  let response: Response
+  try {
+    response = await next()
+  } catch (thrown) {
+    if (thrown instanceof Response) {
+      applySecurityHeaders(thrown.headers)
+    }
+    throw thrown
+  }
+  applySecurityHeaders(response.headers)
   return response
 }
+
+function applySecurityHeaders(headers: Headers) {
+  headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
+  headers.set('X-Content-Type-Options', 'nosniff')
+  headers.set('X-Frame-Options', 'DENY')
+  headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+  // Default-deny CSP. Tighten with route-level nonces for inline <script>/<style>.
+  // Apps that need third-party origins (analytics, fonts, CDNs) should extend
+  // this list \u2014 ship something restrictive by default rather than leaving it
+  // off entirely.
+  if (!headers.has('Content-Security-Policy')) {
+    headers.set(
+      'Content-Security-Policy',
+      "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; " +
+        "script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
+    )
+  }
+  headers.set(
+    'Permissions-Policy',
+    'camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()'
+  )
+  headers.set('Cross-Origin-Opener-Policy', 'same-origin')
+  headers.set('Cross-Origin-Resource-Policy', 'same-origin')
+}
 `;
 var customErrorStatusCodeMiddlewareServer = `import * as Sentry from '@sentry/react-router'
 import { type MiddlewareFunction } from 'react-router'

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   buildProjectTree,
   getInitVersion,
   scaffold
-} from "./chunk-52NA54G4.js";
+} from "./chunk-FO3IYFDW.js";
 export {
   buildProjectTree,
   getInitVersion,

package/package.json

@@ -14,7 +14,7 @@
   "devDependencies": {
     "@types/node": "^22.19.11"
   },
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.23",
   "publishConfig": {
     "access": "restricted"
   },