@mindfulauth/core 1.2.1 → 1.3.0

package/dist/config.d.ts

@@ -15,6 +15,10 @@ export declare const PUBLIC_PREFIXES: string[];
  * Configure Mindful Auth security settings including CSP sources and static
  * assets to skip. Returns the options to be passed to getMauthViteDefines().
  *
+ *  IMPORTANT: A nonce must be provided for inline styles to work. Without a nonce, inline styles will be blocked by CSP. If you need 'unsafe-inline' for development or testing, explicitly add it to styleSources in mauthSecurityConfig().
+ *
+ * IMPORTANT: Do not use Astro 6 security.csp in astro.config.mjs alongside this function. Astro's CSP will override these headers. Use mauthSecurityConfig() exclusively.
+ *
  * Call in astro.config.mjs and pass the result to vite.define:
  *
  * @example
@@ -25,7 +29,15 @@ export declare const PUBLIC_PREFIXES: string[];
  *     scriptSources: ['https://analytics.example.com'],
  *     connectSources: ['https://api.example.com'],
  *     frameSources: ['https://stripe.com'],
- *     fontSources: ['https://fonts.googleapis.com']
+ *     fontSources: ['https://fonts.googleapis.com'],
+ *     styleSources: ['https://cdn.example.com/styles'],
+ *     imageSources: ['https://images.example.com'],
+ *     frameAncestors: ["'self'"],
+ *     workerSources: ["'self'"],
+ *     manifestSources: ["'self'"],
+ *     objectSources: ["'none'"],
+ *     baseUris: ["'self'"],
+ *     formActions: ["'self'"]
  *   }
  * });
  *
@@ -40,6 +52,14 @@ export declare function mauthSecurityConfig(options?: {
         connectSources?: string[];
         frameSources?: string[];
         fontSources?: string[];
+        styleSources?: string[];
+        imageSources?: string[];
+        frameAncestors?: string[];
+        workerSources?: string[];
+        manifestSources?: string[];
+        objectSources?: string[];
+        baseUris?: string[];
+        formActions?: string[];
     };
 }): typeof options;
 /**
@@ -54,16 +74,15 @@ export declare function getMauthViteDefines(options?: {
         connectSources?: string[];
         frameSources?: string[];
         fontSources?: string[];
+        styleSources?: string[];
+        imageSources?: string[];
+        frameAncestors?: string[];
+        workerSources?: string[];
+        manifestSources?: string[];
+        objectSources?: string[];
+        baseUris?: string[];
+        formActions?: string[];
     };
 }): Record<string, string>;
-/**
- * Get security headers with CSP sources merged from defaults and build-time
- * custom values injected via vite.define (from getMauthViteDefines()).
- *
- * Pass the per-request `nonce` generated by `generateNonce()` so the
- * Content-Security-Policy includes `'nonce-<value>'` in `script-src`.
- * The same nonce must be set as the `nonce` attribute on every inline
- * `<script>` tag (available via `Astro.locals.cspNonce` in layouts).
- */
 export declare function GET_SECURITY_HEADERS(nonce?: string): Record<string, string>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,eAAO,MAAM,UAAU,gCAAgC,CAAC;AAGxD,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AA0CF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiD3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,eAAO,MAAM,UAAU,gCAAgC,CAAC;AAGxD,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AA2FF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE;QACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACL,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2E3E"}

package/dist/config.js

@@ -74,10 +74,47 @@ const DEFAULT_FONT_SOURCES = [
     "'self'",
     'data:'
 ];
+// Default allowed style sources for CSP
+const DEFAULT_STYLE_SOURCES = [
+    "'self'",
+];
+// Default allowed image sources for CSP
+const DEFAULT_IMAGE_SOURCES = [
+    "'self'",
+    'https:'
+];
+// Default allowed frame ancestors for CSP (clickjacking protection)
+const DEFAULT_FRAME_ANCESTORS = [
+    "'self'"
+];
+// Default allowed worker sources for CSP (Web Workers, Service Workers)
+const DEFAULT_WORKER_SOURCES = [
+    "'self'"
+];
+// Default allowed manifest sources for CSP (web app manifest)
+const DEFAULT_MANIFEST_SOURCES = [
+    "'self'"
+];
+// Default allowed object sources for CSP (disallow plugins like Flash/Java)
+const DEFAULT_OBJECT_SOURCES = [
+    "'none'"
+];
+// Default allowed base URIs for CSP
+const DEFAULT_BASE_URIS = [
+    "'self'"
+];
+// Default allowed form actions for CSP
+const DEFAULT_FORM_ACTIONS = [
+    "'self'"
+];
 /**
  * Configure Mindful Auth security settings including CSP sources and static
  * assets to skip. Returns the options to be passed to getMauthViteDefines().
  *
+ *  IMPORTANT: A nonce must be provided for inline styles to work. Without a nonce, inline styles will be blocked by CSP. If you need 'unsafe-inline' for development or testing, explicitly add it to styleSources in mauthSecurityConfig().
+ *
+ * IMPORTANT: Do not use Astro 6 security.csp in astro.config.mjs alongside this function. Astro's CSP will override these headers. Use mauthSecurityConfig() exclusively.
+ *
  * Call in astro.config.mjs and pass the result to vite.define:
  *
  * @example
@@ -88,7 +125,15 @@ const DEFAULT_FONT_SOURCES = [
  *     scriptSources: ['https://analytics.example.com'],
  *     connectSources: ['https://api.example.com'],
  *     frameSources: ['https://stripe.com'],
- *     fontSources: ['https://fonts.googleapis.com']
+ *     fontSources: ['https://fonts.googleapis.com'],
+ *     styleSources: ['https://cdn.example.com/styles'],
+ *     imageSources: ['https://images.example.com'],
+ *     frameAncestors: ["'self'"],
+ *     workerSources: ["'self'"],
+ *     manifestSources: ["'self'"],
+ *     objectSources: ["'none'"],
+ *     baseUris: ["'self'"],
+ *     formActions: ["'self'"]
  *   }
  * });
  *
@@ -111,27 +156,39 @@ export function getMauthViteDefines(options) {
         __MAUTH_CONNECT_SOURCES__: JSON.stringify(options?.csp?.connectSources ?? []),
         __MAUTH_FRAME_SOURCES__: JSON.stringify(options?.csp?.frameSources ?? []),
         __MAUTH_FONT_SOURCES__: JSON.stringify(options?.csp?.fontSources ?? []),
+        __MAUTH_STYLE_SOURCES__: JSON.stringify(options?.csp?.styleSources ?? []),
+        __MAUTH_IMAGE_SOURCES__: JSON.stringify(options?.csp?.imageSources ?? []),
+        __MAUTH_FRAME_ANCESTORS__: JSON.stringify(options?.csp?.frameAncestors ?? []),
+        __MAUTH_WORKER_SOURCES__: JSON.stringify(options?.csp?.workerSources ?? []),
+        __MAUTH_MANIFEST_SOURCES__: JSON.stringify(options?.csp?.manifestSources ?? []),
+        __MAUTH_OBJECT_SOURCES__: JSON.stringify(options?.csp?.objectSources ?? []),
+        __MAUTH_BASE_URIS__: JSON.stringify(options?.csp?.baseUris ?? []),
+        __MAUTH_FORM_ACTIONS__: JSON.stringify(options?.csp?.formActions ?? []),
     };
 }
-/**
- * Get security headers with CSP sources merged from defaults and build-time
- * custom values injected via vite.define (from getMauthViteDefines()).
- *
- * Pass the per-request `nonce` generated by `generateNonce()` so the
- * Content-Security-Policy includes `'nonce-<value>'` in `script-src`.
- * The same nonce must be set as the `nonce` attribute on every inline
- * `<script>` tag (available via `Astro.locals.cspNonce` in layouts).
- */
 export function GET_SECURITY_HEADERS(nonce) {
     // Custom sources are baked in at build time via vite.define
-    const SCRIPT_SOURCES = [
-        ...DEFAULT_SCRIPT_SOURCES,
-        ...__MAUTH_SCRIPT_SOURCES__,
-        ...(nonce ? [`'nonce-${nonce}'`] : []),
-    ];
-    const CONNECT_SOURCES = [...DEFAULT_CONNECT_SOURCES, ...__MAUTH_CONNECT_SOURCES__];
-    const FRAME_SOURCES = [...DEFAULT_FRAME_SOURCES, ...__MAUTH_FRAME_SOURCES__];
-    const FONT_SOURCES = [...DEFAULT_FONT_SOURCES, ...__MAUTH_FONT_SOURCES__];
+    // Using Set to deduplicate sources while preserving order
+    const SCRIPT_SOURCES = [...new Set([
+            ...DEFAULT_SCRIPT_SOURCES,
+            ...__MAUTH_SCRIPT_SOURCES__,
+            ...(nonce ? [`'nonce-${nonce}'`] : []),
+        ])];
+    const STYLE_SOURCES = [...new Set([
+            ...DEFAULT_STYLE_SOURCES,
+            ...__MAUTH_STYLE_SOURCES__,
+            ...(nonce ? [`'nonce-${nonce}'`] : []),
+        ])];
+    const CONNECT_SOURCES = [...new Set([...DEFAULT_CONNECT_SOURCES, ...__MAUTH_CONNECT_SOURCES__])];
+    const FRAME_SOURCES = [...new Set([...DEFAULT_FRAME_SOURCES, ...__MAUTH_FRAME_SOURCES__])];
+    const FONT_SOURCES = [...new Set([...DEFAULT_FONT_SOURCES, ...__MAUTH_FONT_SOURCES__])];
+    const IMAGE_SOURCES = [...new Set([...DEFAULT_IMAGE_SOURCES, ...__MAUTH_IMAGE_SOURCES__])];
+    const FRAME_ANCESTORS = [...new Set([...DEFAULT_FRAME_ANCESTORS, ...__MAUTH_FRAME_ANCESTORS__])];
+    const WORKER_SOURCES = [...new Set([...DEFAULT_WORKER_SOURCES, ...__MAUTH_WORKER_SOURCES__])];
+    const MANIFEST_SOURCES = [...new Set([...DEFAULT_MANIFEST_SOURCES, ...__MAUTH_MANIFEST_SOURCES__])];
+    const OBJECT_SOURCES = [...new Set([...DEFAULT_OBJECT_SOURCES, ...__MAUTH_OBJECT_SOURCES__])];
+    const BASE_URIS = [...new Set([...DEFAULT_BASE_URIS, ...__MAUTH_BASE_URIS__])];
+    const FORM_ACTIONS = [...new Set([...DEFAULT_FORM_ACTIONS, ...__MAUTH_FORM_ACTIONS__])];
     return {
         'X-Content-Type-Options': 'nosniff',
         'X-Frame-Options': 'SAMEORIGIN',
@@ -139,25 +196,33 @@ export function GET_SECURITY_HEADERS(nonce) {
         'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
         'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
         'Content-Security-Policy': [
-            // Default policy
-            "default-src 'self'",
+            // Deny by default - only allow explicitly defined sources
+            "default-src 'none'",
             // Scripts
             `script-src ${SCRIPT_SOURCES.join(' ')}`,
             // Styles
-            "style-src 'self' 'unsafe-inline'",
+            `style-src ${STYLE_SOURCES.join(' ')}`,
             // Images
-            "img-src 'self' data: https:",
+            `img-src ${IMAGE_SOURCES.join(' ')}`,
             // Connections
             `connect-src ${CONNECT_SOURCES.join(' ')}`,
             // Frames
             `frame-src ${FRAME_SOURCES.join(' ')}`,
+            // Frame ancestors (clickjacking protection)
+            `frame-ancestors ${FRAME_ANCESTORS.join(' ')}`,
             // Fonts
             `font-src ${FONT_SOURCES.join(' ')}`,
+            // Web Workers and Service Workers
+            `worker-src ${WORKER_SOURCES.join(' ')}`,
+            // Web app manifest
+            `manifest-src ${MANIFEST_SOURCES.join(' ')}`,
             // Disallow object/embed tags (Flash, Java, etc.)
-            "object-src 'none'",
+            `object-src ${OBJECT_SOURCES.join(' ')}`,
+            // Base URI
+            `base-uri ${BASE_URIS.join(' ')}`,
+            // Form action
+            `form-action ${FORM_ACTIONS.join(' ')}`,
             // Security directives
-            "base-uri 'self'",
-            "form-action 'self'",
             "upgrade-insecure-requests",
             "block-all-mixed-content"
         ].join('; ')

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,SAAS,mCAmEpB,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,SAAS,mCAyEpB,CAAC"}

package/dist/middleware.js

@@ -20,6 +20,11 @@ function addSecurityHeaders(response, nonce) {
 export const onRequest = defineMiddleware(async (context, next) => {
     const { request, url, redirect, locals } = context;
     const pathname = url.pathname;
+    // Redirect HTTP to HTTPS (skip in dev mode and localhost)
+    if (!import.meta.env.DEV && url.protocol === 'http:' && url.hostname !== 'localhost' && url.hostname !== '127.0.0.1') {
+        const httpsUrl = url.toString().replace('http://', 'https://');
+        return redirect(httpsUrl, 307);
+    }
     // Type assertion for locals (users should extend App.Locals in their project)
     const authLocals = locals;
     // Generate a per-request nonce for CSP. Exposed as locals.cspNonce so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindfulauth/core",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Mindful Auth core authentication library for Astro",
   "type": "module",
   "main": "./dist/index.js",