@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/csp/import.js

@@ -0,0 +1,291 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importPolicy = exports.coveringSource = exports.readPolicy = exports.parseJsonPolicy = exports.policiesInServerConfig = exports.parsePolicyText = void 0;
+const allowlist_1 = require("./allowlist");
+/** Directives the generated policy sets itself. */
+const FIXED = {
+    'default-src': "the generated policy uses default-src 'self'",
+    'object-src': "the generated policy uses object-src 'none'",
+    'base-uri': "the generated policy uses base-uri 'self'",
+    'style-src-attr': "the generated policy uses style-src-attr 'unsafe-inline'",
+    'upgrade-insecure-requests': 'the generated policy upgrades insecure requests',
+};
+/** What each fixed directive already allows (anything else is reported). */
+const FIXED_ALLOWS = {
+    'default-src': ["'self'", "'none'"],
+    'object-src': ["'none'"],
+    'base-uri': ["'self'", "'none'"],
+    'style-src-attr': ["'unsafe-inline'", "'self'", "'none'"],
+    'upgrade-insecure-requests': [],
+};
+/** Directives that fall back to default-src when a policy does not set them. */
+const DEFAULT_SRC_FALLBACK = [
+    'script-src',
+    'style-src',
+    'img-src',
+    'font-src',
+    'connect-src',
+    'media-src',
+    'frame-src',
+    'worker-src',
+    'manifest-src',
+];
+const lower = (s) => (s.startsWith("'") ? s.toLowerCase() : s);
+/** Sources the generated policy already has, or that the server adds per request. */
+function implied(directive, source) {
+    const s = lower(source);
+    if (/^'(nonce|sha256|sha384|sha512)-/.test(s))
+        return true;
+    if (s === "'self'" && directive !== 'frame-ancestors')
+        return true;
+    const base = allowlist_1.CSP_DIRECTIVES[directive]?.base;
+    return !!base && base.includes(s) && s !== "'none'";
+}
+/** A raw `Content-Security-Policy` value: `directive source source; directive …`. */
+function parsePolicyText(text) {
+    const out = {};
+    for (const part of text.split(';')) {
+        const [name, ...sources] = part.trim().split(/\s+/).filter(Boolean);
+        if (!name)
+            continue;
+        const directive = name.toLowerCase();
+        out[directive] = [...(out[directive] ?? []), ...sources];
+    }
+    return out;
+}
+exports.parsePolicyText = parsePolicyText;
+/** Apache/Nginx header lines that set a Content-Security-Policy (not Report-Only). */
+const HEADER_LINE = /(?:^|[\n{;])[ \t]*(?:Header\s+(?:(?:always|onsuccess)\s+)?(?:set|add|append|merge)|add_header|more_set_headers)\s+["']?Content-Security-Policy:?["']?\s*(?:"((?:[^"\\]|\\[\s\S])*)"|'([^']*)')/gi;
+/**
+ * Every Content-Security-Policy set in an Apache (`Header … Content-Security-Policy "…"`) or
+ * Nginx (`add_header Content-Security-Policy "…"`) config, also inside one-line blocks and across
+ * `\` line continuations; Report-Only headers are not read.
+ */
+function policiesInServerConfig(text) {
+    const joined = text.replace(/\\\r?\n[ \t]*/g, ' ');
+    const out = [];
+    HEADER_LINE.lastIndex = 0;
+    let m;
+    while ((m = HEADER_LINE.exec(joined)) !== null) {
+        out.push((m[1] ?? m[2] ?? '').replace(/\\"/g, '"'));
+    }
+    return out;
+}
+exports.policiesInServerConfig = policiesInServerConfig;
+/** Keys of csp-allowlist.json that are not directives. */
+const NOT_DIRECTIVES = new Set(['permissions-policy']);
+/** directive → sources from JSON: an object of lists or strings, under `directives` or `suggestedPolicy.directives` too. */
+function parseJsonPolicy(value, notes = []) {
+    let obj = value;
+    const suggested = obj?.['suggestedPolicy'];
+    if (suggested && typeof suggested === 'object')
+        obj = suggested;
+    if (obj?.['directives'] && typeof obj['directives'] === 'object') {
+        obj = obj['directives'];
+    }
+    if (!obj || typeof obj !== 'object' || Array.isArray(obj)) {
+        throw new Error('the JSON is not an object of directives');
+    }
+    const out = {};
+    for (const [key, v] of Object.entries(obj)) {
+        const directive = key.toLowerCase();
+        if (NOT_DIRECTIVES.has(directive))
+            continue;
+        if (Array.isArray(v)) {
+            const strings = v.filter((s) => typeof s === 'string');
+            if (strings.length !== v.length)
+                notes.push(`${key}: entries that are not text were ignored`);
+            out[directive] = strings.flatMap((s) => s.split(/\s+/).filter(Boolean));
+        }
+        else if (typeof v === 'string') {
+            out[directive] = v.split(/\s+/).filter(Boolean);
+        }
+        else if (/-(src|uri|ancestors|action)$/.test(directive)) {
+            notes.push(`${key}: not a list or text, ignored`);
+        }
+    }
+    return out;
+}
+exports.parseJsonPolicy = parseJsonPolicy;
+/** Reads a policy from file content or text, detecting the format. */
+function readPolicy(text) {
+    const trimmed = text.trim();
+    const notes = [];
+    if (trimmed.startsWith('{')) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (err) {
+            throw new Error(`not valid JSON (${err.message})`);
+        }
+        return { format: 'json', policy: parseJsonPolicy(parsed, notes), policies: 1, notes };
+    }
+    if (/(?:Header\s+(?:(?:always|onsuccess)\s+)?\w+|add_header|more_set_headers)\s+["']?Content-Security-Policy/i.test(trimmed)) {
+        const found = policiesInServerConfig(trimmed);
+        const policy = {};
+        for (const p of found) {
+            for (const [d, s] of Object.entries(parsePolicyText(p))) {
+                policy[d] = [...(policy[d] ?? []), ...s];
+            }
+        }
+        if (found.length > 1) {
+            notes.push(`${found.length} Content-Security-Policy headers found; their sources were merged. A ` +
+                'browser enforces each of them, so the merged allowlist may allow more than any one did.');
+        }
+        return { format: 'server-config', policy, policies: found.length, notes };
+    }
+    const body = trimmed.replace(/^Content-Security-Policy:\s*/i, '');
+    return { format: 'policy', policy: parsePolicyText(body), policies: 1, notes };
+}
+exports.readPolicy = readPolicy;
+function parseHost(source) {
+    const m = /^(?:([a-z]+):\/\/)?(\*\.)?([A-Za-z0-9.-]+)(?::(\d+|\*))?(\/.*)?$/i.exec(source);
+    if (!m || source.endsWith(':'))
+        return undefined;
+    return {
+        scheme: (m[1] ?? '').toLowerCase(),
+        host: `${m[2] ?? ''}${m[3]}`.toLowerCase().replace(/\.$/, ''),
+        port: m[4] ?? '',
+        path: m[5] ?? '',
+    };
+}
+/** A source compared without case in its scheme and host. */
+function sourceKey(source) {
+    const h = parseHost(source);
+    if (!h)
+        return lower(source);
+    return `${h.scheme}://${h.host}:${h.port}${h.path}`;
+}
+/** The source in `list` that already allows `source` (a broader host entry), if any. */
+function coveringSource(source, list) {
+    const s = parseHost(source);
+    if (!s)
+        return undefined;
+    return list.find((other) => {
+        if (other === source)
+            return false;
+        const o = parseHost(other);
+        if (!o)
+            return false;
+        // Without a scheme a host source means the page's scheme (https); it does not reliably
+        // cover wss:// in every browser, so only https (or another scheme-less entry) counts.
+        if (o.scheme !== s.scheme && !(o.scheme === '' && s.scheme === 'https'))
+            return false;
+        if (o.port !== '*' && o.port !== s.port)
+            return false; // no port = the default port only
+        const hostOk = o.host === s.host || (o.host.startsWith('*.') && s.host.endsWith(o.host.slice(1)));
+        if (!hostOk)
+            return false;
+        // A path ending in / covers everything below it; a host without a path covers all paths.
+        if (o.path === '' || o.path === '/')
+            return s.path !== '' || o.host !== s.host;
+        return o.path.endsWith('/') && s.path.startsWith(o.path) && s.path !== o.path;
+    });
+}
+exports.coveringSource = coveringSource;
+/**
+ * Merges an imported policy into the allowlist sources: sources the strict policy refuses, and
+ * directives it does not take, are skipped with the reason; imported sources that an entry
+ * already allows are not added. Existing entries are never removed.
+ */
+function importPolicy(policy, existing) {
+    const skipped = [];
+    const notes = [];
+    const incoming = {};
+    for (const [directive, sources] of Object.entries(policy)) {
+        if (directive in FIXED) {
+            const extra = sources.filter((s) => !FIXED_ALLOWS[directive].includes(lower(s)));
+            if (extra.length > 0) {
+                skipped.push({
+                    directive,
+                    kind: 'not-taken',
+                    reason: `${FIXED[directive]}; not imported: ${extra.join(' ')}`,
+                });
+            }
+            continue;
+        }
+        if (directive === 'report-uri' || directive === 'report-to') {
+            skipped.push({
+                directive,
+                kind: 'not-taken',
+                reason: `violation reports (${sources.join(' ')}) are not part of the generated policy; ` +
+                    'add the reporting header to the server config by hand if you need them',
+            });
+            continue;
+        }
+        if (!(directive in allowlist_1.CSP_DIRECTIVES)) {
+            const real = sources.filter((s) => !implied(directive, s) && lower(s) !== "'none'");
+            skipped.push({
+                directive,
+                kind: 'not-taken',
+                reason: 'not a directive of the generated policy' +
+                    (real.length > 0 ? `; its sources were not imported: ${real.join(' ')}` : ''),
+            });
+            continue;
+        }
+        for (const source of sources) {
+            if (implied(directive, source))
+                continue;
+            if (directive === 'frame-ancestors' && lower(source) === "'none'")
+                continue;
+            const value = lower(source);
+            const problem = (0, allowlist_1.sourceProblem)(directive, value);
+            if (problem) {
+                skipped.push({ directive, source, kind: 'refused', reason: problem });
+                continue;
+            }
+            incoming[directive] = [...(incoming[directive] ?? []), value];
+        }
+    }
+    // A policy with default-src extras also allowed them for fetch directives it did not set.
+    const fallback = (policy['default-src'] ?? []).filter((s) => !FIXED_ALLOWS['default-src'].includes(lower(s)));
+    if (fallback.length > 0) {
+        const missing = DEFAULT_SRC_FALLBACK.filter((d) => !(d in policy));
+        if (missing.length > 0) {
+            notes.push(`default-src allowed ${fallback.join(' ')} for ${missing.join(', ')} (not set in the ` +
+                'imported policy); add what these need with --add=<directive>:<source>');
+        }
+    }
+    const covered = [];
+    const sources = {};
+    const added = {};
+    const directives = new Set([...Object.keys(existing), ...Object.keys(incoming)]);
+    for (const directive of directives) {
+        const kept = [...(existing[directive] ?? [])];
+        const keys = new Set(kept.map(sourceKey));
+        for (const source of incoming[directive] ?? []) {
+            if (keys.has(sourceKey(source)))
+                continue; // already there (any case)
+            const by = coveringSource(source, kept);
+            if (by) {
+                covered.push({ directive, source, by });
+                continue;
+            }
+            kept.push(source);
+            keys.add(sourceKey(source));
+            (added[directive] ??= []).push(source);
+        }
+        // An imported source may cover one imported before it: drop those (never existing ones).
+        const fresh = new Set(added[directive] ?? []);
+        const final = kept.filter((source) => {
+            if (!fresh.has(source))
+                return true;
+            const by = coveringSource(source, kept);
+            if (!by)
+                return true;
+            covered.push({ directive, source, by });
+            added[directive] = (added[directive] ?? []).filter((s) => s !== source);
+            return false;
+        });
+        if (added[directive]?.length === 0)
+            delete added[directive];
+        if (final.length > 0)
+            sources[directive] = final;
+    }
+    if (Object.keys(policy).length === 0)
+        notes.push('no Content-Security-Policy found in the input');
+    return { sources, added, skipped, covered, notes };
+}
+exports.importPolicy = importPolicy;
+//# sourceMappingURL=import.js.map

package/dist/src/lib/csp/import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../../../src/lib/csp/import.ts"],"names":[],"mappings":";;;AAAA,2CAAwF;AAkCxF,mDAAmD;AACnD,MAAM,KAAK,GAA2B;IACpC,aAAa,EAAE,8CAA8C;IAC7D,YAAY,EAAE,6CAA6C;IAC3D,UAAU,EAAE,2CAA2C;IACvD,gBAAgB,EAAE,0DAA0D;IAC5E,2BAA2B,EAAE,iDAAiD;CAC/E,CAAC;AAEF,4EAA4E;AAC5E,MAAM,YAAY,GAA6B;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACnC,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAChC,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACzD,2BAA2B,EAAE,EAAE;CAChC,CAAC;AAEF,gFAAgF;AAChF,MAAM,oBAAoB,GAAmB;IAC3C,YAAY;IACZ,WAAW;IACX,SAAS;IACT,UAAU;IACV,aAAa;IACb,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;CACf,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,qFAAqF;AACrF,SAAS,OAAO,CAAC,SAAiB,EAAE,MAAc;IAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,KAAK,QAAQ,IAAI,SAAS,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,IAAI,GAAI,0BAA8D,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC9F,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;AACtD,CAAC;AAED,qFAAqF;AACrF,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAClC,MAAM,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;KAC1D;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AATD,0CASC;AAED,sFAAsF;AACtF,MAAM,WAAW,GACf,kMAAkM,CAAC;AAErM;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;KACrD;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AATD,wDASC;AAED,0DAA0D;AAC1D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEvD,4HAA4H;AAC5H,SAAgB,eAAe,CAAC,KAAc,EAAE,QAAkB,EAAE;IAClE,IAAI,GAAG,GAAG,KAAgC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,GAAG,SAAoC,CAAC;IAC3F,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE;QAChE,GAAG,GAAG,GAAG,CAAC,YAAY,CAA4B,CAAC;KACpD;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACzD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IACD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACpB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,0CAA0C,CAAC,CAAC;YAC9F,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;SACzE;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjD;aAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,CAAC,CAAC;SACnD;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAzBD,0CAyBC;AAED,sEAAsE;AACtE,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC3B,IAAI,MAAe,CAAC;QACpB,IAAI;YACF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SAC9B;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAoB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;SAC/D;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;KACvF;IACD,IACE,0GAA0G,CAAC,IAAI,CAC7G,OAAO,CACR,EACD;QACA,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;aAC1C;SACF;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;YACpB,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,MAAM,uEAAuE;gBACpF,yFAAyF,CAC5F,CAAC;SACH;QACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;KAC3E;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC;AAlCD,gCAkCC;AASD,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,CAAC,GAAG,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAClC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,SAAgB,cAAc,CAAC,MAAc,EAAE,IAAc;IAC3D,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,uFAAuF;QACvF,sFAAsF;QACtF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;QACzF,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,yFAAyF;QACzF,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAlBD,wCAkBC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAiB,EAAE,QAAiC;IAC/E,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACzD,IAAI,SAAS,IAAI,KAAK,EAAE;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpB,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS;oBACT,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBAChE,CAAC,CAAC;aACJ;YACD,SAAS;SACV;QACD,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,WAAW,EAAE;YAC3D,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,IAAI,EAAE,WAAW;gBACjB,MAAM,EACJ,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C;oBACjF,wEAAwE;aAC3E,CAAC,CAAC;YACH,SAAS;SACV;QACD,IAAI,CAAC,CAAC,SAAS,IAAI,0BAAc,CAAC,EAAE;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,IAAI,EAAE,WAAW;gBACjB,MAAM,EACJ,yCAAyC;oBACzC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oCAAoC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAC,CAAC;YACH,SAAS;SACV;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;YAC5B,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,SAAS;YACzC,IAAI,SAAS,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAA,yBAAa,EAAC,SAAyB,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,SAAS;aACV;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;SAC/D;KACF;IAED,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;YACtB,KAAK,CAAC,IAAI,CACR,uBAAuB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;gBACpF,uEAAuE,CAC1E,CAAC;SACH;KACF;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAA6B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE;QAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS,CAAC,2BAA2B;YACtE,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,EAAE,EAAE;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxC,SAAS;aACV;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SACxC;QACD,yFAAyF;QACzF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,SAAyB,CAAC,GAAG,KAAK,CAAC;KAClE;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAClG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAlGD,oCAkGC"}

package/dist/src/lib/csp/render.d.ts

@@ -0,0 +1,19 @@
+import { CspAllowlist } from './allowlist';
+/** First line of every file `pstack csp` writes; files without it are hand-written. */
+export declare const GENERATED_MARKER = "# Generated by pstack csp from csp-allowlist.json";
+/** What the release build (secure: true) writes where the nonce goes. */
+export declare const CSP_NONCE_SSI = "<!--#echo var=\"CSP_NONCE\" -->";
+/**
+ * Apache: SPA routing relative to this folder (works under any base href), a per-request nonce
+ * (UNIQUE_ID with "@" replaced, which a CSP nonce may not hold) filled into index.html by SSI and
+ * used in the CSP header, the security headers, and a long cache for hashed files.
+ * Needs mod_rewrite, mod_headers, mod_include, mod_unique_id and mod_setenvif, and
+ * `AllowOverride FileInfo Options=IncludesNOEXEC` (or All) for the folder.
+ */
+export declare function renderHtaccess(app: string, a: CspAllowlist): string;
+/**
+ * Nginx: SPA routing, the nonce from $request_id substituted into HTML and used in the CSP
+ * header, the security headers in every location (add_header is not inherited once a location
+ * sets one), index.html not cached, hashed files cached long.
+ */
+export declare function renderNginx(app: string, a: CspAllowlist): string;

package/dist/src/lib/csp/render.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderNginx = exports.renderHtaccess = exports.CSP_NONCE_SSI = exports.GENERATED_MARKER = void 0;
+const allowlist_1 = require("./allowlist");
+/** First line of every file `pstack csp` writes; files without it are hand-written. */
+exports.GENERATED_MARKER = '# Generated by pstack csp from csp-allowlist.json';
+/** What the release build (secure: true) writes where the nonce goes. */
+exports.CSP_NONCE_SSI = '<!--#echo var="CSP_NONCE" -->';
+/** Times "@" is replaced in Apache's UNIQUE_ID (27 characters, so more is vanishingly rare). */
+const AT_REPLACEMENTS = 8;
+/** A header value inside double quotes in either config (only `"` needs escaping; validated). */
+const quoted = (v) => v.replace(/"/g, '\\"');
+const SECURITY_HEADERS = (a) => [
+    ['X-Frame-Options', 'SAMEORIGIN'],
+    ['X-Content-Type-Options', 'nosniff'],
+    ['Referrer-Policy', 'strict-origin-when-cross-origin'],
+    ['Strict-Transport-Security', 'max-age=31536000; includeSubDomains'],
+    ['Permissions-Policy', a.permissionsPolicy],
+];
+const header = (app) => `${exports.GENERATED_MARKER} — edit it and run \`pstack csp --app=${app}\`.`;
+/**
+ * Apache: SPA routing relative to this folder (works under any base href), a per-request nonce
+ * (UNIQUE_ID with "@" replaced, which a CSP nonce may not hold) filled into index.html by SSI and
+ * used in the CSP header, the security headers, and a long cache for hashed files.
+ * Needs mod_rewrite, mod_headers, mod_include, mod_unique_id and mod_setenvif, and
+ * `AllowOverride FileInfo Options=IncludesNOEXEC` (or All) for the folder.
+ */
+function renderHtaccess(app, a) {
+    const policy = (0, allowlist_1.buildPolicy)(a).replace(/\{N\}/g, '%{CSP_NONCE}e');
+    const lines = [
+        header(app),
+        '# Needs mod_rewrite, mod_headers, mod_include, mod_unique_id and mod_setenvif, and',
+        '# AllowOverride FileInfo Options=IncludesNOEXEC (or All) for this folder.',
+        '',
+        '# Single-page app: anything that is not a file, a folder or a hashed build file gets index.html.',
+        'RewriteEngine On',
+        'RewriteCond %{REQUEST_FILENAME} !-f',
+        'RewriteCond %{REQUEST_FILENAME} !-d',
+        'RewriteCond %{REQUEST_URI} !\\.[0-9a-f]{8,}\\.(js|css)$',
+        'RewriteRule ^ index.html [L]',
+        '',
+        '# Per-request CSP nonce: UNIQUE_ID without "@" (not allowed in a nonce). reqenv() reads the',
+        '# environment only, so request headers cannot set it.',
+        `SetEnvIfExpr "reqenv('UNIQUE_ID') =~ /^(.+)$/" CSP_NONCE=$1`,
+        ...Array.from({ length: AT_REPLACEMENTS }, () => `SetEnvIfExpr "reqenv('CSP_NONCE') =~ /^([^@]*)@(.*)$/" CSP_NONCE=$1_$2`),
+        '',
+        `# index.html: the release build (secure: true) leaves ${exports.CSP_NONCE_SSI} where the nonce goes.`,
+        'Options +IncludesNOEXEC',
+        '<Files "index.html">',
+        '    SetOutputFilter INCLUDES',
+        '    Header always set Cache-Control "no-store"',
+        '</Files>',
+        '',
+        '# Security headers',
+        ...SECURITY_HEADERS(a).map(([k, v]) => `Header always set ${k} "${quoted(v)}"`),
+        `Header always set Content-Security-Policy "${policy}"`,
+        '',
+        '# Long-lived cache for content-hashed files',
+        '<FilesMatch "\\.[0-9a-f]{8,}\\.(js|css)$">',
+        '    Header set Cache-Control "public, max-age=31536000, immutable"',
+        '</FilesMatch>',
+        '',
+    ];
+    return lines.join('\n');
+}
+exports.renderHtaccess = renderHtaccess;
+/**
+ * Nginx: SPA routing, the nonce from $request_id substituted into HTML and used in the CSP
+ * header, the security headers in every location (add_header is not inherited once a location
+ * sets one), index.html not cached, hashed files cached long.
+ */
+function renderNginx(app, a) {
+    const policy = (0, allowlist_1.buildPolicy)(a).replace(/\{N\}/g, '$request_id');
+    const headers = (indent, extra = []) => [
+        ...SECURITY_HEADERS(a).map(([k, v]) => [k, v, true]),
+        ['Content-Security-Policy', policy, true],
+        ...extra,
+    ]
+        .map(([k, v, always]) => `${indent}add_header ${k} "${quoted(v)}"${always ? ' always' : ''};`)
+        .join('\n');
+    return [
+        header(app),
+        '# Serve the app at "/"; under a base href (e.g. /portal/) change root/location to match.',
+        '',
+        'server {',
+        '    listen 80;',
+        '    server_name _;',
+        '    root /usr/share/nginx/html;',
+        '    index index.html;',
+        '',
+        `    # Per-request CSP nonce: the release build (secure: true) leaves ${exports.CSP_NONCE_SSI}`,
+        '    # where the nonce goes.',
+        '    sub_filter_once off;',
+        `    sub_filter '${exports.CSP_NONCE_SSI}' $request_id;`,
+        '',
+        '    location / {',
+        '        try_files $uri $uri/ /index.html;',
+        headers('        '),
+        '    }',
+        '',
+        '    location = /index.html {',
+        headers('        ', [['Cache-Control', 'no-store', true]]),
+        '    }',
+        '',
+        '    # Long-lived cache for content-hashed files',
+        '    # (quoted: a regex holding braces must be)',
+        '    location ~* "\\.[0-9a-f]{8,}\\.(js|css)$" {',
+        '        # Without "always": a 404 for a file not yet uploaded must not be cached for a year.',
+        headers('        ', [['Cache-Control', 'public, max-age=31536000, immutable', false]]),
+        '    }',
+        '}',
+        '',
+    ].join('\n');
+}
+exports.renderNginx = renderNginx;
+//# sourceMappingURL=render.js.map

package/dist/src/lib/csp/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../../../src/lib/csp/render.ts"],"names":[],"mappings":";;;AAAA,2CAAwD;AAExD,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,mDAAmD,CAAC;AAEpF,yEAAyE;AAC5D,QAAA,aAAa,GAAG,+BAA+B,CAAC;AAE7D,gGAAgG;AAChG,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,iGAAiG;AACjG,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAErD,MAAM,gBAAgB,GAAG,CAAC,CAAe,EAAsB,EAAE,CAAC;IAChE,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,wBAAwB,EAAE,SAAS,CAAC;IACrC,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;IACtD,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;IACpE,CAAC,oBAAoB,EAAE,CAAC,CAAC,iBAAiB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,GAAG,wBAAgB,yCAAyC,GAAG,KAAK,CAAC;AAEvE;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAW,EAAE,CAAe;IACzD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,GAAG,CAAC;QACX,oFAAoF;QACpF,2EAA2E;QAC3E,EAAE;QACF,kGAAkG;QAClG,kBAAkB;QAClB,qCAAqC;QACrC,qCAAqC;QACrC,yDAAyD;QACzD,8BAA8B;QAC9B,EAAE;QACF,6FAA6F;QAC7F,uDAAuD;QACvD,6DAA6D;QAC7D,GAAG,KAAK,CAAC,IAAI,CACX,EAAE,MAAM,EAAE,eAAe,EAAE,EAC3B,GAAG,EAAE,CAAC,wEAAwE,CAC/E;QACD,EAAE;QACF,yDAAyD,qBAAa,wBAAwB;QAC9F,yBAAyB;QACzB,sBAAsB;QACtB,8BAA8B;QAC9B,gDAAgD;QAChD,UAAU;QACV,EAAE;QACF,oBAAoB;QACpB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/E,8CAA8C,MAAM,GAAG;QACvD,EAAE;QACF,6CAA6C;QAC7C,4CAA4C;QAC5C,oEAAoE;QACpE,eAAe;QACf,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAxCD,wCAwCC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,GAAW,EAAE,CAAe;IACtD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,QAAqC,EAAE,EAAE,EAAE,CAC1E;QACE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAA8B,CAAC;QACjF,CAAC,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAA8B;QACtE,GAAG,KAAK;KACT;SACE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,cAAc,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;SAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO;QACL,MAAM,CAAC,GAAG,CAAC;QACX,0FAA0F;QAC1F,EAAE;QACF,UAAU;QACV,gBAAgB;QAChB,oBAAoB;QACpB,iCAAiC;QACjC,uBAAuB;QACvB,EAAE;QACF,wEAAwE,qBAAa,EAAE;QACvF,6BAA6B;QAC7B,0BAA0B;QAC1B,mBAAmB,qBAAa,gBAAgB;QAChD,EAAE;QACF,kBAAkB;QAClB,2CAA2C;QAC3C,OAAO,CAAC,UAAU,CAAC;QACnB,OAAO;QACP,EAAE;QACF,8BAA8B;QAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,OAAO;QACP,EAAE;QACF,iDAAiD;QACjD,gDAAgD;QAChD,iDAAiD;QACjD,8FAA8F;QAC9F,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC,CAAC;QACtF,OAAO;QACP,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AA3CD,kCA2CC"}

package/dist/src/lib/env/derive.d.ts

@@ -0,0 +1,38 @@
+import { EnvEncryptionConfig } from '../env-encryption/config';
+export interface DeriveOptions {
+    /** New environment name, e.g. qa. */
+    env: string;
+    /** App name: part of the placeholder names. */
+    app: string;
+    /** Env project (folder under environments/), for listed-mode keys. */
+    envProject: string;
+    cfg: EnvEncryptionConfig;
+    /** Replaces http(s) values of fields whose key mentions "api" (e.g. apiBaseUrl). */
+    apiUrl?: string;
+    /** Sets a `production: true|false` field. */
+    production?: boolean;
+    /** Turn secret values into placeholders (default true); false copies them. */
+    placeholders?: boolean;
+}
+export interface Derived {
+    text: string;
+    /** Placeholder names written for secret fields, e.g. PL_QA_PASSWORD. */
+    placeholders: string[];
+    /** Fields set to new values (envName, api urls, production). */
+    set: string[];
+    /** Things the caller should tell the user (values copied as is, fields not found). */
+    notes: string[];
+}
+/** Keys holding the API base URL (apiBaseUrl, apiUrl, baseApiUrl, API_BASE_URL, apiEndpoint…). */
+export declare function isApiUrlKey(key: string): boolean;
+/** `${<APP>_<ENV>_<KEY>}` name for a secret field. */
+export declare function placeholderName(app: string, env: string, key: string): string;
+/**
+ * A new env file from an existing one: the same fields, `envName` set to the new env, api urls
+ * replaced when given, and every field env encryption treats as secret (listed keys, or in
+ * `all` mode every string field except publicKeys and the build stamp) turned into a
+ * `${APP_ENV_KEY}` placeholder that the build fills from CI or .env.local. URL values are copied.
+ */
+export declare function deriveEnvFile(source: string, o: DeriveOptions): Derived;
+/** A Flutter env/<env>.json from an existing one: env name fields and the api url updated. */
+export declare function deriveFlutterEnv(source: Record<string, unknown>, env: string, apiUrl?: string): Record<string, unknown>;

package/dist/src/lib/env/derive.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveFlutterEnv = exports.deriveEnvFile = exports.placeholderName = exports.isApiUrlKey = void 0;
+const config_1 = require("../env-encryption/config");
+const encrypt_1 = require("../env-encryption/encrypt");
+const env_file_1 = require("../env-encryption/env-file");
+const sensitive_1 = require("../env-encryption/sensitive");
+/** Keys holding the API base URL (apiBaseUrl, apiUrl, baseApiUrl, API_BASE_URL, apiEndpoint…). */
+function isApiUrlKey(key) {
+    return /^(api(base)?(url|uri|endpoint)|base(api)?url)$/i.test(key.replace(/[_-]/g, ''));
+}
+exports.isApiUrlKey = isApiUrlKey;
+const snake = (s) => s
+    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+    .replace(/[^A-Za-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .toUpperCase();
+/** `${<APP>_<ENV>_<KEY>}` name for a secret field. */
+function placeholderName(app, env, key) {
+    return `${snake(app)}_${snake(env)}_${snake(key)}`;
+}
+exports.placeholderName = placeholderName;
+const URL_LIKE = /^https?:\/\//i;
+const PLACEHOLDER_ONLY = /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+/**
+ * A new env file from an existing one: the same fields, `envName` set to the new env, api urls
+ * replaced when given, and every field env encryption treats as secret (listed keys, or in
+ * `all` mode every string field except publicKeys and the build stamp) turned into a
+ * `${APP_ENV_KEY}` placeholder that the build fills from CI or .env.local. URL values are copied.
+ */
+function deriveEnvFile(source, o) {
+    const fields = (0, env_file_1.environmentFields)(source);
+    const stamp = new Set([o.cfg.stamp?.timeField, o.cfg.stamp?.branchField].filter(Boolean));
+    const listed = new Set((0, config_1.listedKeys)(o.cfg, o.envProject));
+    const plain = (0, encrypt_1.plainKeys)(o.cfg);
+    // listed: the listed keys. all: non-public string fields that look sensitive (password, token,
+    // key, …) or already hold a placeholder; plain settings (appName, defaultLang) are copied.
+    const secret = (key, value) => o.cfg.mode === 'listed'
+        ? listed.has(key)
+        : !plain.has(key) && !stamp.has(key) && ((0, sensitive_1.isSensitiveKey)(key) || PLACEHOLDER_ONLY.test(value));
+    const usePlaceholders = o.placeholders ?? true;
+    const notes = [];
+    if (!(0, env_file_1.scanEnvironment)(source).found) {
+        notes.push('no `environment = { … }` object found; the file was copied unchanged');
+    }
+    const values = {};
+    const placeholders = [];
+    const set = [];
+    for (const f of fields) {
+        if (f.kind !== 'string')
+            continue;
+        const current = f.text ?? '';
+        if (f.key === 'envName') {
+            values[f.key] = o.env;
+            set.push(f.key);
+        }
+        else if (o.apiUrl && isApiUrlKey(f.key) && URL_LIKE.test(current)) {
+            values[f.key] = o.apiUrl;
+            set.push(f.key);
+        }
+        else if (usePlaceholders &&
+            secret(f.key, current) &&
+            current !== '' &&
+            !URL_LIKE.test(current)) {
+            const name = placeholderName(o.app, o.env, f.key);
+            values[f.key] = `\${${name}}`;
+            placeholders.push(name);
+        }
+    }
+    let { text } = (0, encrypt_1.setStringFields)(source, values);
+    if (o.production !== undefined) {
+        // Any value (true, !0, Boolean(…)) is replaced by the literal.
+        const prod = (0, env_file_1.environmentFields)(text).find((f) => f.key === 'production');
+        if (prod) {
+            text = text.slice(0, prod.start) + String(o.production) + text.slice(prod.end);
+            set.push('production');
+        }
+        else {
+            notes.push('no top-level `production` field; --production was not applied');
+        }
+    }
+    if (fields.length > 0 && !set.includes('envName'))
+        notes.push('no `envName` field to set');
+    if (o.apiUrl && !fields.some((f) => isApiUrlKey(f.key))) {
+        notes.push('no api url field (apiBaseUrl, apiUrl, …) for --api-url');
+    }
+    if (usePlaceholders && o.cfg.mode === 'listed') {
+        // Listed keys deeper in the file (e.g. auth.clientSecret) are encrypted but not replaced here.
+        const top = new Set(fields.map((f) => f.key));
+        const nested = [...listed].filter((k) => !top.has(k) &&
+            new RegExp(`(?<![\\w$])${k.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*:`).test(source));
+        if (nested.length > 0) {
+            notes.push(`nested ${nested.join(', ')} copied as is from the source file; change them`);
+        }
+    }
+    return { text, placeholders, set, notes };
+}
+exports.deriveEnvFile = deriveEnvFile;
+/** A Flutter env/<env>.json from an existing one: env name fields and the api url updated. */
+function deriveFlutterEnv(source, env, apiUrl) {
+    const out = { ...source };
+    for (const key of Object.keys(out)) {
+        if (/^(FLUTTER_ENV|ENV_NAME|ENV|APP_ENV)$/i.test(key))
+            out[key] = env;
+        else if (apiUrl &&
+            isApiUrlKey(key) &&
+            typeof out[key] === 'string' &&
+            URL_LIKE.test(out[key])) {
+            out[key] = apiUrl;
+        }
+    }
+    return out;
+}
+exports.deriveFlutterEnv = deriveFlutterEnv;
+//# sourceMappingURL=derive.js.map

package/dist/src/lib/env/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../../src/lib/env/derive.ts"],"names":[],"mappings":";;;AAAA,qDAA2E;AAC3E,uDAAuE;AACvE,yDAAgF;AAChF,2DAA6D;AA4B7D,kGAAkG;AAClG,SAAgB,WAAW,CAAC,GAAW;IACrC,OAAO,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAFD,kCAEC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAC1B,CAAC;KACE,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;KACtC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;KAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,WAAW,EAAE,CAAC;AAEnB,sDAAsD;AACtD,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACnE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAFD,0CAEC;AAED,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAE1D;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,MAAc,EAAE,CAAgB;IAC5D,MAAM,MAAM,GAAG,IAAA,4BAAiB,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAA,mBAAU,EAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAA,mBAAS,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,+FAA+F;IAC/F,2FAA2F;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,CAC5C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;QACrB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAA,0BAAc,EAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC,KAAK,EAAE;QAClC,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;KACpF;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE;YACvB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACjB;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YACnE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACjB;aAAM,IACL,eAAe;YACf,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC;YACtB,OAAO,KAAK,EAAE;YACd,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EACvB;YACA,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;YAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACzB;KACF;IACD,IAAI,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE;QAC9B,+DAA+D;QAC/D,MAAM,IAAI,GAAG,IAAA,4BAAiB,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,IAAI,EAAE;YACR,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxB;aAAM;YACL,KAAK,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;SAC7E;KACF;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;QACvD,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;KACtE;IACD,IAAI,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE;QAC9C,+FAA+F;QAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACX,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CACzF,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;YACrB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;SAC1F;KACF;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AArED,sCAqEC;AAED,8FAA8F;AAC9F,SAAgB,gBAAgB,CAC9B,MAA+B,EAC/B,GAAW,EACX,MAAe;IAEf,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAClC,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;aACjE,IACH,MAAM;YACN,WAAW,CAAC,GAAG,CAAC;YAChB,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC,EACjC;YACA,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;SACnB;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAlBD,4CAkBC"}