@myelophone/nuxt 0.18.2

package/app/server/middleware/security-headers.ts

@@ -0,0 +1,147 @@
+import type { NuxtSecurityRouteRules } from 'nuxt-security';
+
+type SecurityHeaders = NonNullable<NuxtSecurityRouteRules['headers']>;
+type SecurityHeaderKey = keyof SecurityHeaders;
+
+const headerNames: Partial<Record<SecurityHeaderKey, string>> = {
+	contentSecurityPolicy: 'Content-Security-Policy',
+	crossOriginEmbedderPolicy: 'Cross-Origin-Embedder-Policy',
+	crossOriginOpenerPolicy: 'Cross-Origin-Opener-Policy',
+	crossOriginResourcePolicy: 'Cross-Origin-Resource-Policy',
+	originAgentCluster: 'Origin-Agent-Cluster',
+	referrerPolicy: 'Referrer-Policy',
+	strictTransportSecurity: 'Strict-Transport-Security',
+	xContentTypeOptions: 'X-Content-Type-Options',
+	xDNSPrefetchControl: 'X-DNS-Prefetch-Control',
+	xDownloadOptions: 'X-Download-Options',
+	xFrameOptions: 'X-Frame-Options',
+	xPermittedCrossDomainPolicies: 'X-Permitted-Cross-Domain-Policies',
+	xXSSProtection: 'X-XSS-Protection',
+	permissionsPolicy: 'Permissions-Policy',
+};
+
+const resolveCsp = (
+	value: Exclude<SecurityHeaders['contentSecurityPolicy'], false | undefined>,
+	nonce?: string,
+) =>
+	Object.fromEntries(
+		Object.entries(value).map(([directive, sources]) => {
+			const sourceValue = sources as boolean | string | string[];
+
+			if (typeof sourceValue === 'boolean') {
+				return [directive, sourceValue];
+			}
+
+			const tokens = (
+				typeof sourceValue === 'string'
+					? sourceValue.split(' ')
+					: sourceValue
+			)
+				.map((source) => source.trim())
+				.filter(Boolean)
+				.map((source) =>
+					source === "'nonce-{{nonce}}'" && nonce
+						? `'nonce-${nonce}'`
+						: source,
+				)
+				.filter((source) => source !== "'nonce-{{nonce}}'");
+
+			return [directive, tokens];
+		}),
+	);
+
+const stringifyHeader = (key: SecurityHeaderKey, value: unknown): string => {
+	if (key === 'contentSecurityPolicy') {
+		return Object.entries(value as Record<string, boolean | string[]>)
+			.filter(([, sources]) => sources !== false)
+			.map(([directive, sources]) =>
+				directive === 'upgrade-insecure-requests'
+					? 'upgrade-insecure-requests;'
+					: `${directive} ${Array.isArray(sources) ? sources.join(' ') : sources};`,
+			)
+			.join(' ');
+	}
+
+	if (key === 'strictTransportSecurity') {
+		const policies = value as {
+			maxAge: number;
+			includeSubdomains?: boolean;
+			preload?: boolean;
+		};
+
+		return [
+			`max-age=${policies.maxAge}`,
+			policies.includeSubdomains && 'includeSubDomains',
+			policies.preload && 'preload',
+		]
+			.filter(Boolean)
+			.join('; ');
+	}
+
+	if (key === 'permissionsPolicy') {
+		return Object.entries(
+			value as Record<string, string | string[] | false>,
+		)
+			.filter(([, sources]) => sources !== false)
+			.map(([directive, sources]) =>
+				typeof sources === 'string'
+					? `${directive}=${sources}`
+					: `${directive}=(${(sources as string[]).join(' ')})`,
+			)
+			.join(', ');
+	}
+
+	return String(value);
+};
+
+export default defineEventHandler((event) => {
+	const rules = event.context.security?.rules as
+		NuxtSecurityRouteRules | undefined;
+
+	if (!rules?.enabled) {
+		return;
+	}
+
+	if (rules.hidePoweredBy) {
+		removeResponseHeader(event, 'x-powered-by');
+	}
+
+	if (!rules.headers) {
+		return;
+	}
+
+	for (const [rawKey, rawValue] of Object.entries(rules.headers)) {
+		const key = rawKey as SecurityHeaderKey;
+		const headerName =
+			key === 'contentSecurityPolicy' &&
+			rules.contentSecurityPolicyReportOnly
+				? 'Content-Security-Policy-Report-Only'
+				: headerNames[key];
+
+		if (!headerName) {
+			continue;
+		}
+
+		if (rawValue === false) {
+			const routeHeader = getRouteRules(event).headers?.[headerName];
+
+			if (getResponseHeader(event, headerName) === routeHeader) {
+				removeResponseHeader(event, headerName);
+			}
+			continue;
+		}
+
+		const value =
+			key === 'contentSecurityPolicy'
+				? resolveCsp(
+						rawValue as Exclude<
+							SecurityHeaders['contentSecurityPolicy'],
+							false | undefined
+						>,
+						event.context.security?.nonce,
+					)
+				: rawValue;
+
+		setResponseHeader(event, headerName, stringifyHeader(key, value));
+	}
+});

package/app/server/middleware/url-helper.ts

@@ -0,0 +1,43 @@
+export default defineEventHandler((event) => {
+	if (event.method === 'OPTIONS') {
+		event.node.res.statusCode = 204;
+		return '';
+	}
+
+	const url = new URL(
+		event.node.req.url || '/',
+		`http://${event.node.req.headers.host}`,
+	);
+
+	const sanitize = (path: string) => {
+		let p = path
+			.replace(/[<>{}|\\^`]/g, '')
+			.replace(/\/+/g, '/')
+			.replace(/\.\.\//g, '')
+			.replace(/\.\./g, '');
+		if (p !== '/' && p.endsWith('/')) p = p.slice(0, -1);
+		return encodeURI(decodeURI(p)).toLowerCase();
+	};
+
+	const isLocalhost = (host: string) => {
+		return (
+			host.startsWith('localhost') ||
+			host.startsWith('127.') ||
+			host.startsWith('192.168.') ||
+			host.startsWith('::1') ||
+			/^[\d.]+$/.test(host)
+		);
+	};
+
+	const sanitizedPath = sanitize(url.pathname);
+	const isWww = url.hostname.startsWith('www.');
+	const finalHost = isWww ? url.hostname.replace(/^www\./, '') : url.hostname;
+	const needsHttps = !isLocalhost(finalHost) && url.protocol !== 'https:';
+	const port = url.port ? `:${url.port}` : '';
+
+	if (sanitizedPath !== url.pathname || isWww) {
+		const protocol = !needsHttps ? url.protocol : 'https:';
+		const newUrl = `${protocol}//${finalHost}${port}${sanitizedPath}${url.search}${url.hash}`;
+		return sendRedirect(event, newUrl, 301);
+	}
+});

package/app/server/plugins/clean-html-spaces.ts

@@ -0,0 +1,15 @@
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:response', (response) => {
+		if (
+			typeof response.body === 'string' &&
+			response.body.startsWith('<!DOCTYPE html>')
+		) {
+			response.body = response.body.replace(
+				/<html\b[^>]*>/i,
+				(htmlTag) => {
+					return htmlTag.replace(/\s{2,}/g, ' ');
+				},
+			);
+		}
+	});
+});

package/app/server/plugins/clean-styles.ts

@@ -0,0 +1,94 @@
+export default defineNitroPlugin((nitroApp) => {
+	const emptyStyleRegex = /<style\b[^>]*>\s*<\/style>/gi;
+	const deferredBody = new WeakMap<
+		object,
+		{ body: string[]; bodyAppend: string[] }
+	>();
+	const decoder = new TextDecoder();
+	const encoder = new TextEncoder();
+	const normalizeScriptNonces = (source: string) =>
+		source.replace(/<script\b[^>]*>/gi, (tag) => {
+			let hasNonce = false;
+			return tag.replace(/\snonce="[^"]*"/gi, (attribute) => {
+				if (hasNonce) {
+					return '';
+				}
+				hasNonce = true;
+				return attribute;
+			});
+		});
+
+	nitroApp.hooks.hook('render:html', (html) => {
+		html.head = html.head
+			.map((tag) => tag.replace(emptyStyleRegex, ''))
+			.filter(Boolean);
+	});
+
+	nitroApp.hooks.afterEach(({ name, args }) => {
+		if (name !== 'render:html') {
+			return;
+		}
+
+		const html = args[0] as {
+			head: string[];
+			bodyPrepend: string[];
+			body: string[];
+			bodyAppend: string[];
+		};
+		const context = args[1] as { event: object; streaming?: boolean };
+
+		for (const field of [
+			'head',
+			'bodyPrepend',
+			'body',
+			'bodyAppend',
+		] as const) {
+			html[field] = html[field].map(normalizeScriptNonces);
+		}
+
+		if (context.streaming && (html.body.length || html.bodyAppend.length)) {
+			deferredBody.set(context.event, {
+				body: [...html.body],
+				bodyAppend: [...html.bodyAppend],
+			});
+			html.body.length = 0;
+			html.bodyAppend.length = 0;
+		}
+	});
+
+	nitroApp.hooks.hook('render:html:close', (html, { event }) => {
+		const deferred = deferredBody.get(event);
+		html.bodyAppend = [
+			...(deferred?.body ?? []),
+			...(deferred?.bodyAppend ?? []),
+			...html.bodyAppend,
+		]
+			.map((tag) => tag.replace(emptyStyleRegex, ''))
+			.filter(Boolean);
+		deferredBody.delete(event);
+	});
+
+	nitroApp.hooks.hook('render:html:chunk', (chunk, { event }) => {
+		const source = decoder.decode(chunk.chunk);
+		let normalized = normalizeScriptNonces(source);
+
+		if (chunk.index === 0) {
+			const headEnd = normalized.indexOf('</head>');
+			if (headEnd !== -1) {
+				const head = normalized
+					.slice(0, headEnd + '</head>'.length)
+					.replace(/>\s+</g, '><');
+				normalized =
+					head + normalized.slice(headEnd + '</head>'.length);
+			}
+		}
+
+		if (normalized !== source) {
+			chunk.chunk = encoder.encode(normalized);
+		}
+
+		if (chunk.index === 0 && event.context.security?.rules?.hidePoweredBy) {
+			removeResponseHeader(event, 'x-powered-by');
+		}
+	});
+});

package/app/server/plugins/compression.ts

@@ -0,0 +1,122 @@
+import { brotliCompress, gzip } from 'node:zlib';
+import { promisify } from 'node:util';
+
+const compressBrotli = promisify(brotliCompress);
+const compressGzip = promisify(gzip);
+
+interface RequestLike {
+	headers?: Headers | Record<string, string | string[] | undefined>;
+}
+
+interface ResponseLike {
+	body?: unknown;
+	headers?: Headers | Record<string, string | number | undefined>;
+}
+
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:response', async (response, { event }) => {
+		if (import.meta.dev || event.req.method !== 'GET') {
+			return;
+		}
+
+		const target = response as ResponseLike;
+		const contentType = getResponseHeader(target, 'content-type');
+		const acceptedEncoding = getRequestHeader(
+			(event.node?.req || event.req) as RequestLike,
+			'accept-encoding',
+		);
+		const body = toBuffer(target.body);
+
+		if (
+			!body ||
+			!contentType?.includes('text/html') ||
+			getResponseHeader(target, 'content-encoding')
+		) {
+			return;
+		}
+
+		if (acceptedEncoding.includes('br')) {
+			target.body = await compressBrotli(body);
+			setResponseHeader(target, 'content-encoding', 'br');
+		} else if (acceptedEncoding.includes('gzip')) {
+			target.body = await compressGzip(body);
+			setResponseHeader(target, 'content-encoding', 'gzip');
+		} else {
+			return;
+		}
+
+		const vary = getResponseHeader(target, 'vary');
+		if (
+			!vary
+				.toLowerCase()
+				.split(/\s*,\s*/)
+				.includes('accept-encoding')
+		) {
+			setResponseHeader(
+				target,
+				'vary',
+				vary ? `${vary}, Accept-Encoding` : 'Accept-Encoding',
+			);
+		}
+		deleteResponseHeader(target, 'content-length');
+	});
+});
+
+function getRequestHeader(request: RequestLike, name: string): string {
+	if (request.headers instanceof Headers) {
+		return request.headers.get(name) || '';
+	}
+
+	const value = request.headers?.[name];
+	return Array.isArray(value) ? value.join(',') : value || '';
+}
+
+function getResponseHeader(response: ResponseLike, name: string): string {
+	if (response.headers instanceof Headers) {
+		return response.headers.get(name) || '';
+	}
+
+	const value = response.headers?.[name];
+	return value === undefined ? '' : String(value);
+}
+
+function setResponseHeader(
+	response: ResponseLike,
+	name: string,
+	value: string,
+) {
+	if (response.headers instanceof Headers) {
+		response.headers.set(name, value);
+		return;
+	}
+
+	response.headers ||= {};
+	response.headers[name] = value;
+}
+
+function deleteResponseHeader(response: ResponseLike, name: string) {
+	if (response.headers instanceof Headers) {
+		response.headers.delete(name);
+		return;
+	}
+
+	if (response.headers) {
+		delete response.headers[name];
+	}
+}
+
+function toBuffer(body: unknown): Buffer | null {
+	if (typeof body === 'string') {
+		return Buffer.from(body);
+	}
+
+	if (body instanceof Uint8Array) {
+		return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+	}
+
+	if (body instanceof ArrayBuffer) {
+		return Buffer.from(body);
+	}
+
+	return null;
+}

package/app/server/plugins/css-preload.ts

@@ -0,0 +1,26 @@
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:html', (html) => {
+		const head = html.head.join('');
+
+		const cssLinks =
+			head.match(/<link\b[^>]*rel=["']stylesheet["'][^>]*>/gi) ?? [];
+
+		const mainCssLink = cssLinks[0];
+
+		if (!mainCssLink) {
+			return;
+		}
+
+		const href = mainCssLink.match(
+			/\bhref=["']([^"']+\.css(?:\?[^"']*)?)["']/i,
+		)?.[1];
+
+		if (!href) {
+			return;
+		}
+
+		html.head.unshift(
+			`<link rel="preload" href="${href}" as="style" fetchPriority="high" crossorigin>`,
+		);
+	});
+});

package/app/server/plugins/early-hints.ts

@@ -0,0 +1,31 @@
+import { writeEarlyHints } from 'h3';
+
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:html', (htmlContext, { event }) => {
+		const links: string[] = [];
+
+		for (const tag of htmlContext.head) {
+			if (typeof tag !== 'string') continue;
+
+			if (tag.includes('rel="stylesheet"')) {
+				const match = tag.match(/href="([^"]+\.css[^"]*)"/);
+				if (match && match[1]) {
+					links.push(`<${match[1]}>; rel=preload; as=style`);
+				}
+			}
+
+			if (tag.includes('rel="modulepreload"')) {
+				const match = tag.match(/href="([^"]+\.js[^"]*)"/);
+				if (match && match[1]) {
+					links.push(
+						`<${match[1]}>; rel=modulepreload; as=script; crossorigin`,
+					);
+				}
+			}
+		}
+
+		if (links.length > 0) {
+			writeEarlyHints(event, links);
+		}
+	});
+});

package/app/server/plugins/force-noindex.ts

@@ -0,0 +1,43 @@
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:html', (html, { event }) => {
+		const config = useRuntimeConfig(event).myelophone;
+
+		if (!config.noindex) {
+			return;
+		}
+
+		const robotsMetaRegex = /<meta\b(?=[^>]*\bname=["']robots["'])[^>]*>/gi;
+
+		let robotsFound = false;
+
+		html.head = html.head.map((chunk) => {
+			if (!robotsMetaRegex.test(chunk)) {
+				robotsMetaRegex.lastIndex = 0;
+				return chunk;
+			}
+
+			robotsMetaRegex.lastIndex = 0;
+			robotsFound = true;
+
+			return chunk.replace(
+				robotsMetaRegex,
+				'<meta name="robots" content="noindex, nofollow">',
+			);
+		});
+
+		if (!robotsFound) {
+			html.head.push('<meta name="robots" content="noindex, nofollow">');
+		}
+	});
+
+	nitroApp.hooks.hook('render:response', (response, { event }) => {
+		const config = useRuntimeConfig(event).myelophone;
+
+		if (!config.noindex) {
+			return;
+		}
+
+		response.headers ??= {};
+		response.headers['X-Robots-Tag'] = 'noindex, nofollow';
+	});
+});

package/app/server/plugins/html-one-line.ts

@@ -0,0 +1,17 @@
+export default defineNitroPlugin((nitroApp) => {
+	nitroApp.hooks.hook('render:html', (html) => {
+		const compact = (fragment: string) => fragment.replace(/[\r\n]+/g, ' ');
+		const sections = [
+			html.head,
+			html.bodyPrepend,
+			html.body,
+			html.bodyAppend,
+		];
+
+		for (const section of sections) {
+			for (let index = 0; index < section.length; index++) {
+				section[index] = compact(section[index]!);
+			}
+		}
+	});
+});

package/app/server/plugins/inline-style.ts

@@ -0,0 +1,7 @@
+export default defineNitroPlugin((nitro) => {
+	nitro.hooks.hook('render:html', (html) => {
+		html.head.unshift(
+			'<style>body,img{overflow-x:hidden;max-width:100%}html,body,#__nuxt{margin:0;padding:0;width:100%;font-family:-apple-system,system-ui,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,"Helvetica Neue",Arial,sans-serif,color-emoji}body,#__nuxt{min-height:100dvh;}html{height:auto;font-size:15px;-webkit-text-size-adjust:100%;text-size-adjust:100%}body{min-height:100dvh;font-size:1rem;position:relative}@media screen and (min-width:768px){html{font-size:16px}}@media screen and (min-width:1500px){html{font-size:17px}}@media screen and (min-width:1920px){html{font-size:18px}}@media screen and (min-width:2560px){html{font-size:20px}}@media screen and (max-height:650px){html{font-size:15px}}@media screen and (max-height:480px){html{font-size:14px}}.nojs .page-fullscreen-preloader{display:none}</style>',
+		);
+	});
+});

package/app/server/routes/healthz.get.ts

@@ -0,0 +1 @@
+export default defineEventHandler(() => ({ status: 'ok' }));

package/app/server/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../.nuxt/tsconfig.server.json",
+}