@mindfulauth/core 1.1.0 → 1.2.0

package/dist/config.d.ts

@@ -59,6 +59,11 @@ export declare function getMauthViteDefines(options?: {
 /**
  * Get security headers with CSP sources merged from defaults and build-time
  * custom values injected via vite.define (from getMauthViteDefines()).
+ *
+ * Pass the per-request `nonce` generated by `generateNonce()` so the
+ * Content-Security-Policy includes `'nonce-<value>'` in `script-src`.
+ * The same nonce must be set as the `nonce` attribute on every inline
+ * `<script>` tag (available via `Astro.locals.cspNonce` in layouts).
  */
-export declare function GET_SECURITY_HEADERS(): Record<string, string>;
+export declare function GET_SECURITY_HEADERS(nonce?: string): Record<string, string>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,eAAO,MAAM,UAAU,gCAAgC,CAAC;AAGxD,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AAyCF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6C7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,eAAO,MAAM,UAAU,gCAAgC,CAAC;AAGxD,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AA0CF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiD3E"}

package/dist/config.js

@@ -54,6 +54,7 @@ export const PUBLIC_PREFIXES = [
 const DEFAULT_SCRIPT_SOURCES = [
     "'self'",
     'https://*.cloudflare.com',
+    'https://*.cloudflareinsights.com',
     'https://cdn.mindfulauth.com',
     'https://api.mindfulauth.com'
 ];
@@ -115,10 +116,19 @@ export function getMauthViteDefines(options) {
 /**
  * Get security headers with CSP sources merged from defaults and build-time
  * custom values injected via vite.define (from getMauthViteDefines()).
+ *
+ * Pass the per-request `nonce` generated by `generateNonce()` so the
+ * Content-Security-Policy includes `'nonce-<value>'` in `script-src`.
+ * The same nonce must be set as the `nonce` attribute on every inline
+ * `<script>` tag (available via `Astro.locals.cspNonce` in layouts).
  */
-export function GET_SECURITY_HEADERS() {
+export function GET_SECURITY_HEADERS(nonce) {
     // Custom sources are baked in at build time via vite.define
-    const SCRIPT_SOURCES = [...DEFAULT_SCRIPT_SOURCES, ...__MAUTH_SCRIPT_SOURCES__];
+    const SCRIPT_SOURCES = [
+        ...DEFAULT_SCRIPT_SOURCES,
+        ...__MAUTH_SCRIPT_SOURCES__,
+        ...(nonce ? [`'nonce-${nonce}'`] : []),
+    ];
     const CONNECT_SOURCES = [...DEFAULT_CONNECT_SOURCES, ...__MAUTH_CONNECT_SOURCES__];
     const FRAME_SOURCES = [...DEFAULT_FRAME_SOURCES, ...__MAUTH_FRAME_SOURCES__];
     const FONT_SOURCES = [...DEFAULT_FONT_SOURCES, ...__MAUTH_FONT_SOURCES__];

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,SAAS,mCA8DpB,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,SAAS,mCAmEpB,CAAC"}

package/dist/middleware.js

@@ -2,16 +2,16 @@
 // Runs before all route handlers to enforce authentication
 import { defineMiddleware } from 'astro:middleware';
 import { PUBLIC_ROUTES, PUBLIC_PREFIXES, GET_SECURITY_HEADERS, GET_SKIP_ASSETS } from './config';
-import { sanitizePath } from './security';
+import { sanitizePath, generateNonce } from './security';
 import { validateSession, validateMemberIdInUrl } from './auth';
 /** Check if a path is a public route (no auth required) */
 function isPublicRoute(pathname) {
     return PUBLIC_ROUTES.includes(pathname) ||
         PUBLIC_PREFIXES.some(prefix => pathname.startsWith(prefix));
 }
-/** Add security headers to a response */
-function addSecurityHeaders(response) {
-    Object.entries(GET_SECURITY_HEADERS()).forEach(([key, value]) => {
+/** Add security headers (including CSP nonce) to a response */
+function addSecurityHeaders(response, nonce) {
+    Object.entries(GET_SECURITY_HEADERS(nonce)).forEach(([key, value]) => {
         response.headers.set(key, value);
     });
     return response;
@@ -22,6 +22,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
     const pathname = url.pathname;
     // Type assertion for locals (users should extend App.Locals in their project)
     const authLocals = locals;
+    // Generate a per-request nonce for CSP. Exposed as locals.cspNonce so
+    // layouts can add nonce={Astro.locals.cspNonce} to inline <script> tags.
+    const nonce = generateNonce();
+    authLocals.cspNonce = nonce;
     // Skip middleware for static assets FIRST (before dev mode)
     if (GET_SKIP_ASSETS().includes(pathname)) {
         return next();
@@ -46,7 +50,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     // Public routes - no auth needed
     if (isPublicRoute(safePath)) {
         authLocals.recordId = null;
-        return addSecurityHeaders(await next());
+        return addSecurityHeaders(await next(), nonce);
     }
     // Protected route - validate session
     const internalApiKey = authLocals.runtime?.env?.INTERNAL_API_KEY || import.meta.env.INTERNAL_API_KEY;
@@ -68,5 +72,5 @@ export const onRequest = defineMiddleware(async (context, next) => {
         return new Response('Forbidden: Invalid user ID in URL', { status: 403 });
     }
     authLocals.recordId = session.recordId;
-    return addSecurityHeaders(await next());
+    return addSecurityHeaders(await next(), nonce);
 });

package/dist/security.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Generate a cryptographically secure random nonce for use in CSP headers.
+ * The same nonce must be added as a `nonce` attribute on every inline <script>
+ * tag so the browser allows it to execute.
+ */
+export declare function generateNonce(): string;
 /** Sanitize endpoint path (prevents ../ traversal and encoded variants) */
 export declare function sanitizeEndpoint(endpoint: string): string | null;
 /** Sanitize URL path (prevents ../ traversal and encoded variants) */

package/dist/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAkBA,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAgBD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D"}

package/dist/security.js

@@ -1,5 +1,15 @@
-// Security utilities - path traversal prevention
+// Security utilities - path traversal prevention, nonce generation
 const MAX_PATH_LENGTH = 2048;
+/**
+ * Generate a cryptographically secure random nonce for use in CSP headers.
+ * The same nonce must be added as a `nonce` attribute on every inline <script>
+ * tag so the browser allows it to execute.
+ */
+export function generateNonce() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return btoa(String.fromCharCode(...bytes));
+}
 /** Decode and check for traversal attacks */
 function decodeAndValidate(str) {
     if (!str || typeof str !== 'string' || str.length > MAX_PATH_LENGTH)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindfulauth/core",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Mindful Auth core authentication library for Astro",
   "type": "module",
   "main": "./dist/index.js",