npm - @nebularstreams/overlay-sdk - Versions diffs - 1.0.0 - Mend

@nebularstreams/overlay-sdk 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (133) hide show

package/templates/debug/testing/security-probe/forbidden.js ADDED Viewed

	@@ -0,0 +1 @@
1	+ throw new Error("External JavaScript was executed");

package/templates/debug/testing/security-probe/forbidden.json ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"warning":"This unsupported asset must not be served."}

package/templates/debug/testing/security-probe/forbidden.mp4 ADDED Viewed

	@@ -0,0 +1 @@
1	+ This is deliberately not a real video. The resource type must be rejected before its contents matter.

package/templates/debug/testing/security-probe/forbidden.svg ADDED Viewed

	@@ -0,0 +1 @@
1	+ <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32"><rect width="32" height="32" fill="red"/></svg>

package/templates/debug/testing/security-probe/index.html ADDED Viewed

@@ -0,0 +1,367 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Overlay security probe</title>
+  <style>
+    :root { color-scheme: dark; font-family: Inter, system-ui, sans-serif; }
+    * { box-sizing: border-box; }
+    body { display: flex; flex-direction: column; height: 100vh; margin: 0; overflow: hidden; padding: 1.25vh 1vw; color: #eef5ff; }
+    header { display: flex; flex: none; align-items: end; justify-content: space-between; gap: 2rem; margin-bottom: .8vh; }
+    h1 { margin: 0; font-size: 2.6vh; letter-spacing: .04em; }
+    p { margin: .25vh 0 0; color: #9fb0c4; font-size: 1.2vh; }
+    #summary { font: 700 1.3vh ui-monospace, monospace; white-space: nowrap; }
+    #results { display: grid; flex: 1; min-height: 0; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: .3vh .55vw; }
+    .probe { min-width: 0; min-height: 0; overflow: hidden; padding: .25vh .55vw; border: 1px solid #26384c; border-radius: .38rem; background: #101c2a; }
+    .probe strong { display: block; overflow: hidden; font-size: 1.18vh; line-height: 1.25; text-overflow: ellipsis; white-space: nowrap; }
+    .probe span { display: block; margin-top: .08vh; overflow: hidden; color: #9fb0c4; font: 1vh/1.2 ui-monospace, monospace; text-overflow: ellipsis; white-space: nowrap; }
+    .blocked { border-color: #168b63; background: #0d2a25; }
+    .blocked strong { color: #57e6ad; }
+    .exposed { border-color: #d64b55; background: #35171e; }
+    .exposed strong { color: #ff8790; }
+    .policy { border-color: #d49332; background: #342814; }
+    .policy strong { color: #ffc76f; }
+    .inconclusive { border-color: #637083; }
+    .inconclusive strong { color: #bec8d5; }
+    .pending { opacity: .72; }
+    footer { flex: none; margin-top: .5vh; color: #74869a; font-size: .9vh; }
+  </style>
+  <script>
+    (() => {
+      const definitions = [];
+      let generation = 0;
+      function add(name, group, execute, forbidden = true) {
+        definitions.push({name, group, execute, forbidden});
+      }
+      function message(error) {
+        return String(error?.message || error || "rejected").replace(/\s+/g, " ").slice(0, 110);
+      }
+      function outcome(definition, result) {
+        if (result.state) return result;
+        const {allowed, detail} = result;
+        const expected = definition.forbidden;
+        return {
+          state: allowed === null ? "inconclusive" : (allowed === expected ? "exposed" : "blocked"),
+          detail
+        };
+      }
+      function policyAllows(feature, fallback) {
+        const policy = document.permissionsPolicy || document.featurePolicy;
+        if (policy?.allowsFeature) {
+          try {
+            const allowed = policy.allowsFeature(feature);
+            return {state: allowed ? "policy" : "blocked", detail: `Permissions Policy ${allowed ? "allows" : "blocks"} ${feature}`};
+          } catch (error) { return {state: "inconclusive", detail: message(error)}; }
+        }
+        return {state: "inconclusive", detail: `Permissions Policy unavailable; API ${fallback ? "present" : "absent"}`};
+      }
+      async function cspAttempt(directive, attempt, timeout = 100) {
+        let violation = null;
+        const onViolation = event => {
+          if (event.effectiveDirective === directive) violation = event;
+        };
+        document.addEventListener("securitypolicyviolation", onViolation);
+        let attempted;
+        try {
+          attempted = await Promise.race([
+            Promise.resolve().then(attempt),
+            new Promise(resolve => setTimeout(() => resolve({detail: "operation timed out after policy check"}), 1500))
+          ]);
+        }
+        catch (error) { attempted = {detail: message(error)}; }
+        await new Promise(resolve => setTimeout(resolve, timeout));
+        document.removeEventListener("securitypolicyviolation", onViolation);
+        if (violation) {
+          return {allowed: false, detail: `CSP ${violation.effectiveDirective} blocked ${violation.blockedURI || "request"}`};
+        }
+        if (attempted?.allowed === null) {
+          return {state: "inconclusive", detail: attempted.detail || "operation produced no verifiable result"};
+        }
+        return {allowed: true, detail: attempted?.detail || "no matching CSP violation"};
+      }
+      function executeProbe(definition, timeout = 2500) {
+        return Promise.race([
+          Promise.resolve().then(definition.execute),
+          new Promise(resolve => setTimeout(() => resolve({
+            state: "inconclusive",
+            detail: `probe did not finish within ${timeout} ms`
+          }), timeout))
+        ]);
+      }
+      function resource(tag, attributes, timeout = 1200) {
+        return new Promise(resolve => {
+          const element = document.createElement(tag);
+          Object.assign(element, attributes);
+          element.hidden = true;
+          element.onload = () => { element.remove(); resolve({allowed: true, detail: "resource loaded"}); };
+          element.onerror = () => { element.remove(); resolve({allowed: false, detail: "load rejected"}); };
+          document.body.appendChild(element);
+          setTimeout(() => { element.remove(); resolve({allowed: null, detail: "no load/error event"}); }, timeout);
+        });
+      }
+      function connection(factory, timeout = 800) {
+        return new Promise(resolve => {
+          let object;
+          try { object = factory(); }
+          catch (error) { resolve({allowed: false, detail: message(error)}); return; }
+          object.onopen = () => { object.close?.(); resolve({allowed: true, detail: "connection opened"}); };
+          object.onerror = () => { object.close?.(); resolve({detail: "connection failed after policy check"}); };
+          setTimeout(() => { object.close?.(); resolve({detail: "connection did not open"}); }, timeout);
+        });
+      }
+      add("fetch external", "Network", () => cspAttempt("connect-src", async () => {
+        try { await fetch("https://example.invalid/overlay-probe"); return {detail: "request completed"}; }
+        catch (error) { return {detail: `network failed: ${message(error)}`}; }
+      }));
+      add("fetch loopback", "Network", () => cspAttempt("connect-src", async () => {
+        try { await fetch("http://127.0.0.1:1/overlay-probe"); return {detail: "request completed"}; }
+        catch (error) { return {detail: `network failed: ${message(error)}`}; }
+      }));
+      add("XMLHttpRequest", "Network", () => cspAttempt("connect-src", () => new Promise(resolve => {
+        const xhr = new XMLHttpRequest();
+        xhr.onload = () => resolve({detail: "request completed"});
+        xhr.onerror = () => resolve({detail: "network failed after policy check"});
+        try { xhr.open("GET", "https://example.invalid/overlay-probe"); xhr.send(); }
+        catch (error) { resolve({detail: message(error)}); }
+      })));
+      add("WebSocket", "Network", () => cspAttempt("connect-src", () => connection(() => new WebSocket("wss://example.invalid/overlay-probe"))));
+      add("EventSource", "Network", () => cspAttempt("connect-src", () => connection(() => new EventSource("https://example.invalid/overlay-probe"))));
+      add("sendBeacon", "Network", () => cspAttempt("connect-src", () => ({detail: `sendBeacon returned ${navigator.sendBeacon("https://example.invalid/overlay-probe", "probe")}`})));
+      add("external image", "Resources", () => cspAttempt("img-src", () => resource("img", {src: "https://example.invalid/probe.png"})));
+      add("file:// filesystem", "Resources", () => resource("img", {src: "file:///etc/passwd"}));
+      add("encoded traversal", "Resources", () => resource("img", {src: "./%2e%2e%2f%2e%2e%2fetc%2fpasswd"}));
+      add("unsupported SVG", "Resources", () => resource("link", {rel: "stylesheet", href: "forbidden.svg"}));
+      add("external script file", "Resources", () => resource("script", {src: "forbidden.js"}));
+      add("unsupported JS route", "Resources", () => resource("link", {rel: "stylesheet", href: "forbidden.js"}));
+      add("unsupported JSON route", "Resources", () => resource("link", {rel: "stylesheet", href: "forbidden.json"}));
+      add("unsupported MP4 route", "Resources", () => resource("link", {rel: "stylesheet", href: "forbidden.mp4"}));
+      add("audio resource", "Resources", () => resource("audio", {src: "forbidden.mp4"}));
+      add("video resource", "Resources", () => resource("video", {src: "forbidden.mp4"}));
+      add("iframe", "Contexts", () => new Promise(resolve => {
+        const frame = document.createElement("iframe");
+        const token = `frame-${Date.now()}-${Math.random()}`;
+        let finished = false;
+        let timer;
+        const finish = result => {
+          if (finished) return;
+          finished = true;
+          clearTimeout(timer);
+          window.removeEventListener("message", onMessage);
+          document.removeEventListener("securitypolicyviolation", onViolation);
+          frame.remove();
+          resolve(result);
+        };
+        const onMessage = event => {
+          if (event.source === frame.contentWindow && event.data === token) {
+            finish({allowed: true, detail: "navigated frame executed and messaged its parent"});
+          }
+        };
+        const onViolation = event => {
+          if (event.effectiveDirective === "frame-src") {
+            finish({allowed: false, detail: `CSP frame-src blocked ${event.blockedURI || "frame"}`});
+          }
+        };
+        const source = `<script>parent.postMessage(${JSON.stringify(token)}, "*")<` + "/script>";
+        frame.hidden = true;
+        frame.src = `data:text/html;base64,${btoa(source)}`;
+        window.addEventListener("message", onMessage);
+        document.addEventListener("securitypolicyviolation", onViolation);
+        document.body.appendChild(frame);
+        timer = setTimeout(() => finish({allowed: null, detail: "no execution message or CSP violation"}), 800);
+      }));
+      add("embedded object", "Contexts", () => cspAttempt("object-src", () => resource("object", {data: "forbidden.svg", type: "image/svg+xml"})));
+      add("popup window", "Contexts", () => new Promise(resolve => {
+        const popup = window.open("about:blank", "_blank", "width=100,height=100");
+        if (!popup) { resolve({allowed: false, detail: "window.open returned null"}); return; }
+        setTimeout(() => {
+          if (popup.closed) resolve({allowed: false, detail: "renderer closed the popup"});
+          else { popup.close(); resolve({allowed: true, detail: "popup remained open"}); }
+        }, 150);
+      }));
+      add("Web Worker", "Execution", () => new Promise(resolve => {
+        let finished = false;
+        let timer;
+        let url;
+        const finish = result => {
+          if (finished) return;
+          finished = true;
+          clearTimeout(timer);
+          if (url) URL.revokeObjectURL(url);
+          resolve(result);
+        };
+        try {
+          // A successful worker shuts itself down; host-side terminate() is
+          // deliberately avoided because hardened Chromium can block there.
+          url = URL.createObjectURL(new Blob(["postMessage('executed');close()"], {type: "text/javascript"}));
+          const worker = new Worker(url);
+          worker.onmessage = event => finish({allowed: event.data === "executed", detail: "worker code posted a message"});
+          worker.onerror = event => finish({allowed: false, detail: event.message || "worker execution rejected"});
+          timer = setTimeout(() => finish({allowed: null, detail: "worker created but did not execute"}), 800);
+        } catch (error) { finish({allowed: false, detail: message(error)}); }
+      }));
+      add("Shared Worker", "Execution", () => new Promise(resolve => {
+        if (!("SharedWorker" in window)) { resolve({allowed: null, detail: "API unavailable"}); return; }
+        let finished = false;
+        let timer;
+        let url;
+        const finish = result => {
+          if (finished) return;
+          finished = true;
+          clearTimeout(timer);
+          if (url) URL.revokeObjectURL(url);
+          resolve(result);
+        };
+        try {
+          url = URL.createObjectURL(new Blob(["onconnect=e=>{e.ports[0].postMessage('executed');e.ports[0].close();close()}"], {type: "text/javascript"}));
+          const worker = new SharedWorker(url);
+          worker.port.onmessage = event => finish({allowed: event.data === "executed", detail: "shared worker code posted a message"});
+          worker.onerror = event => finish({allowed: false, detail: event.message || "shared worker execution rejected"});
+          worker.port.start();
+          timer = setTimeout(() => finish({allowed: null, detail: "worker created but did not execute"}), 800);
+        } catch (error) { finish({allowed: false, detail: message(error)}); }
+      }));
+      add("eval", "Execution", () => {
+        try { return {allowed: eval("true"), detail: "eval executed"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("Function constructor", "Execution", () => {
+        try { return {allowed: Function("return true")(), detail: "function compiled"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("WebAssembly", "Execution", async () => {
+        try { await WebAssembly.compile(new Uint8Array([0,97,115,109,1,0,0,0])); return {allowed: true, detail: "module compiled"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("Canvas 2D", "Rendering", () => ({allowed: Boolean(document.createElement("canvas").getContext("2d")), detail: "context creation"}));
+      add("WebGL", "Rendering", () => {
+        const canvas = document.createElement("canvas");
+        return {allowed: Boolean(canvas.getContext("webgl2") || canvas.getContext("webgl")), detail: "context creation"};
+      });
+      add("WebAudio", "Rendering", async () => {
+        const AudioContext = window.AudioContext || window.webkitAudioContext;
+        if (!AudioContext) return {allowed: false, detail: "AudioContext constructors unavailable"};
+        try { const context = new AudioContext(); await context.close(); return {allowed: true, detail: "audio context created"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("localStorage", "Persistence", () => {
+        try { localStorage.setItem("overlay-security-probe", "1"); localStorage.removeItem("overlay-security-probe"); return {allowed: true, detail: "read/write succeeded"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("sessionStorage", "Persistence", () => {
+        try { sessionStorage.setItem("overlay-security-probe", "1"); sessionStorage.removeItem("overlay-security-probe"); return {allowed: true, detail: "read/write succeeded"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("Cache Storage", "Persistence", async () => {
+        if (!("caches" in window)) return {allowed: null, detail: "API unavailable"};
+        try { await caches.open("overlay-security-probe"); await caches.delete("overlay-security-probe"); return {allowed: true, detail: "cache opened"}; }
+        catch (error) { return {allowed: false, detail: message(error)}; }
+      });
+      add("file picker", "Devices", async () => {
+        return "showOpenFilePicker" in window
+          ? {state: "inconclusive", detail: "API present; not invoked without a user gesture"}
+          : {state: "blocked", detail: "API unavailable"};
+      });
+      add("camera", "Devices", () => policyAllows("camera", Boolean(navigator.mediaDevices?.getUserMedia)));
+      add("microphone", "Devices", () => policyAllows("microphone", Boolean(navigator.mediaDevices?.getUserMedia)));
+      add("screen capture", "Devices", () => policyAllows("display-capture", Boolean(navigator.mediaDevices?.getDisplayMedia)));
+      add("geolocation", "Devices", () => policyAllows("geolocation", Boolean(navigator.geolocation)));
+      add("USB", "Devices", () => policyAllows("usb", Boolean(navigator.usb)));
+      add("serial", "Devices", () => policyAllows("serial", Boolean(navigator.serial)));
+      add("HID", "Devices", () => policyAllows("hid", Boolean(navigator.hid)));
+      add("clipboard read", "Devices", () => policyAllows("clipboard-read", Boolean(navigator.clipboard?.read)));
+      /*
+      add("IndexedDB", "Persistence", () => new Promise(resolve => {
+        let finished = false;
+        const finish = result => {
+          if (finished) return;
+          finished = true;
+          clearTimeout(timer);
+          resolve(result);
+        };
+        const timer = setTimeout(() => finish({allowed: null, detail: "IndexedDB produced no event within 1200 ms"}), 1200);
+        try {
+          const request = indexedDB.open("overlay-security-probe");
+          request.onsuccess = () => {
+            request.result.close();
+            indexedDB.deleteDatabase("overlay-security-probe");
+            finish({allowed: true, detail: "database opened"});
+          };
+          request.onerror = () => finish({allowed: false, detail: message(request.error)});
+          request.onblocked = () => finish({allowed: null, detail: "database open was blocked"});
+        } catch (error) { finish({allowed: false, detail: message(error)}); }
+      }));
+      */
+      async function run() {
+        const currentGeneration = ++generation;
+        const resultRoot = document.getElementById("results");
+        resultRoot.style.gridTemplateRows = `repeat(${Math.ceil(definitions.length / 2)}, minmax(0, 1fr))`;
+        resultRoot.replaceChildren(...definitions.map((definition, index) => {
+          const row = document.createElement("div");
+          row.className = "probe pending";
+          row.id = `probe-${index}`;
+          const title = document.createElement("strong");
+          title.textContent = `${definition.group} · ${definition.name}`;
+          const detail = document.createElement("span");
+          detail.textContent = "testing…";
+          row.append(title, detail);
+          return row;
+        }));
+        const counts = {blocked: 0, exposed: 0, policy: 0, inconclusive: 0};
+        // Worker construction touches a separate Chromium process. Run those
+        // probes last so even a browser-level worker defect cannot hide the
+        // results of the rest of the suite.
+        const executionOrder = [...definitions.entries()].sort(([, left], [, right]) => {
+          const priority = definition => definition.name === "Web Worker" ? 2
+            : definition.name === "Shared Worker" ? 1
+              : 0;
+          return priority(left) - priority(right);
+        });
+        for (const [index, definition] of executionOrder) {
+          let result;
+          try {
+            const raw = await executeProbe(definition);
+            result = outcome(definition, raw);
+          } catch (error) {
+            result = outcome(definition, {allowed: false, detail: message(error)});
+          }
+          if (generation !== currentGeneration) return;
+          const row = document.getElementById(`probe-${index}`);
+          row.className = `probe ${result.state}`;
+          row.lastElementChild.textContent = `${result.state.toUpperCase()} · ${result.detail}`;
+          counts[result.state]++;
+          document.getElementById("summary").textContent = `${counts.blocked} blocked · ${counts.exposed} exposed · ${counts.policy} policy allowed · ${counts.inconclusive} inconclusive`;
+        }
+      }
+      window.addEventListener("nebular-overlay:update", ({detail}) => {
+        if (detail?.control?.run) run();
+      });
+    })();
+  </script>
+</head>
+<body>
+  <header>
+    <div><h1>Overlay Security Probe</h1><p>Green: blocked · Red: executed · Amber: policy allows access · Grey: inconclusive</p></div>
+    <div id="summary">starting…</div>
+  </header>
+  <main id="results"></main>
+  <footer>Device probes inspect Permissions Policy without requesting user permission. Constructors alone never count as successful execution.</footer>
+</body>
+</html>

package/templates/debug/testing/security-probe/manifest.json ADDED Viewed

@@ -0,0 +1,13 @@
+{
+  "instructions": "Security regression template. It deliberately attempts forbidden browser and template-resource capabilities and reports whether each boundary is blocked. This template is for operator testing only and must not be used as a production overlay.",
+  "meta": {
+    "control/run": {
+      "type": "action",
+      "phase": "play",
+      "icon": "undo",
+      "text": "Run security probes",
+      "hint": "Run the complete security-policy test suite",
+      "default": 1
+    }
+  }
+}

package/templates/empty/broadcast/empty/index.html ADDED Viewed

@@ -0,0 +1,46 @@
+<html>
+<head>
+    <style>
+        body {
+            font-family: sans-serif;
+            margin: 1.5rem;
+            color: white;
+        }
+        h1 {
+            font-weight: bold;
+        }
+        #logo {
+            position: absolute;
+            right: 1rem;
+            top: 1rem;
+            display: none;
+            width: 10rem;
+        }
+        #logo.on {
+            display: block;
+        }
+    </style>
+    <script>
+		window.addEventListener("nebular-overlay:update", ({detail}) => {
+			const
+				programElement = document.getElementById("program"),
+				logoElement = document.getElementById("logo");
+			if (typeof detail.program === "string") programElement.textContent = detail.program;
+			if (detail.logo) logoElement.classList.toggle("on", detail.logo === "on");
+		});
+    </script>
+</head>
+<body>
+<h1 id="program"></h1>
+<img id="logo" src="nebular.medallion.transparent.png">
+</body>
+</html>

package/templates/empty/broadcast/empty/manifest.json ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "instructions": "Empty overlay with the program name",
+  "meta": {
+    "program": {"type": "string", "default": "", "hint": "Type the program name", "label": "Program Name"},
+    "logo": {"type": "choose", "default": "off", "hint": "Logo ON/OFF", "label": "Logo Visibility", "choose": ["on", "off"]}
+  }
+}

package/templates/empty/broadcast/empty/nebular.medallion.transparent.png ADDED Viewed

Binary file