@newrelic/browser-agent 1.321.0-rc.10 → 1.321.0-rc.12

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.321.0-rc.10";
+const VERSION = exports.VERSION = "1.321.0-rc.12";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.321.0-rc.10";
+const VERSION = exports.VERSION = "1.321.0-rc.12";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/features/generic_events/aggregate/index.js

@@ -307,21 +307,11 @@ class Aggregate extends _aggregateBase.AggregateBase {
         }, this.featureName, this.ee);
       }
       if (!agentRef.init.feature_flags.includes('no_spv')) {
-        (0, _registerHandler.registerHandler)('spv', evt => {
+        (0, _registerHandler.registerHandler)('spv', (violation, timestamp) => {
           this.addEvent({
             eventType: _events.EVENT_TYPES.SPV,
-            timestamp: this.#toEpoch(evt.timeStamp),
-            blockedUri: evt.blockedURI,
-            documentUri: evt.documentURI,
-            effectiveDirective: evt.effectiveDirective,
-            originalPolicy: evt.originalPolicy,
-            sourceFile: evt.sourceFile,
-            statusCode: evt.statusCode,
-            lineNumber: evt.lineNumber,
-            columnNumber: evt.columnNumber,
-            disposition: evt.disposition,
-            sample: evt.sample,
-            referrer: evt.referrer
+            timestamp: this.#toEpoch(timestamp),
+            ...violation
           });
         }, this.featureName, this.ee);
       }

package/dist/cjs/features/generic_events/instrument/index.js

@@ -7,6 +7,7 @@ exports.Instrument = exports.GenericEvents = void 0;
 var _runtime = require("../../../common/constants/runtime");
 var _handle = require("../../../common/event-emitter/handle");
 var _eventListenerOpts = require("../../../common/event-listener/event-listener-opts");
+var _now = require("../../../common/timing/now");
 var _invoke = require("../../../common/util/invoke");
 var _addPageAction = require("../../../loaders/api/addPageAction");
 var _finished = require("../../../loaders/api/finished");
@@ -56,8 +57,26 @@ class Instrument extends _instrumentBase.InstrumentBase {
       });
     }
     if (securityPolicyViolationEnabled) {
+      /** ReportingObserver's `csp-violation` type isn't reliably enabled everywhere out of the box:
+       *  - Safari only delivers it when the page sets a report-to CSP directive -- https://bugs.webkit.org/show_bug.cgi?id=320750;
+       *  - Firefox ships it behind the `dom.reporting.enabled` pref, which defaults to false;
+       * So it's only used for violations that occur before the agent loaded, targeting Chromium browsers. `buffered: true` replays
+       * that backlog in the observer's first callback invocation, after which it's disconnected and all future violations are
+       * covered by securitypolicyviolation, which is reliable across all browsers. */
+      if (typeof _runtime.globalScope.ReportingObserver === 'function') {
+        const cspObserver = new _runtime.globalScope.ReportingObserver(reports => {
+          reports.forEach(report => {
+            (0, _handle.handle)('spv', [normalizeCspViolation(report), (0, _now.now)()], undefined, _features.FEATURE_NAMES.genericEvents, this.ee);
+          });
+          cspObserver.disconnect();
+        }, {
+          types: ['csp-violation'],
+          buffered: true
+        });
+        cspObserver.observe();
+      }
       _runtime.globalScope.addEventListener('securitypolicyviolation', evt => {
-        (0, _handle.handle)('spv', [evt], undefined, _features.FEATURE_NAMES.genericEvents, this.ee);
+        (0, _handle.handle)('spv', [normalizeCspViolation(evt), evt.timeStamp], undefined, _features.FEATURE_NAMES.genericEvents, this.ee);
       }, (0, _eventListenerOpts.eventListenerOpts)(false, this.removeOnAbort.signal));
     }
     if (_runtime.isBrowserScope) {
@@ -122,5 +141,26 @@ class Instrument extends _instrumentBase.InstrumentBase {
     if (genericEventSourceConfigs.some(x => x)) this.importAggregator(agentRef, () => Promise.resolve().then(() => _interopRequireWildcard(require(/* webpackChunkName: "generic_events-aggregate" */'../aggregate'))));else this.deregisterDrain();
   }
 }
+/** `Report.body` (ReportingObserver) and `SecurityPolicyViolationEvent` (securitypolicyviolation) describe the same
+ * violation with differently-named/shaped fields -- collapse both into one shape so downstream code doesn't care
+ * which mechanism produced it. `source` is either of those: a Report (fields under `.body`, URLs as blockedURL/
+ * documentURL) or the event (fields at the top level, URLs as blockedURI/documentURI). Also normalizes disposition's
+ * "reporting" (Report body) to "report" (event) so the value is consistent regardless of source. */
 exports.Instrument = Instrument;
+function normalizeCspViolation(source) {
+  const body = source.body ?? source;
+  return {
+    blockedUrl: body.blockedURL ?? source.blockedURI,
+    documentUrl: body.documentURL ?? source.documentURI,
+    effectiveDirective: body.effectiveDirective,
+    originalPolicy: body.originalPolicy,
+    sourceFile: body.sourceFile,
+    statusCode: body.statusCode,
+    lineNumber: body.lineNumber,
+    columnNumber: body.columnNumber,
+    disposition: body.disposition === 'reporting' ? 'report' : body.disposition,
+    sample: body.sample,
+    referrer: body.referrer
+  };
+}
 const GenericEvents = exports.GenericEvents = Instrument;

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.321.0-rc.10";
+export const VERSION = "1.321.0-rc.12";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.321.0-rc.10";
+export const VERSION = "1.321.0-rc.12";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/features/generic_events/aggregate/index.js

@@ -300,21 +300,11 @@ export class Aggregate extends AggregateBase {
         }, this.featureName, this.ee);
       }
       if (!agentRef.init.feature_flags.includes('no_spv')) {
-        registerHandler('spv', evt => {
+        registerHandler('spv', (violation, timestamp) => {
           this.addEvent({
             eventType: EVENT_TYPES.SPV,
-            timestamp: this.#toEpoch(evt.timeStamp),
-            blockedUri: evt.blockedURI,
-            documentUri: evt.documentURI,
-            effectiveDirective: evt.effectiveDirective,
-            originalPolicy: evt.originalPolicy,
-            sourceFile: evt.sourceFile,
-            statusCode: evt.statusCode,
-            lineNumber: evt.lineNumber,
-            columnNumber: evt.columnNumber,
-            disposition: evt.disposition,
-            sample: evt.sample,
-            referrer: evt.referrer
+            timestamp: this.#toEpoch(timestamp),
+            ...violation
           });
         }, this.featureName, this.ee);
       }

package/dist/esm/features/generic_events/instrument/index.js

@@ -6,6 +6,7 @@
 import { globalScope, isBrowserScope } from '../../../common/constants/runtime';
 import { handle } from '../../../common/event-emitter/handle';
 import { eventListenerOpts, windowAddEventListener } from '../../../common/event-listener/event-listener-opts';
+import { now } from '../../../common/timing/now';
 import { debounce } from '../../../common/util/invoke';
 import { setupAddPageActionAPI } from '../../../loaders/api/addPageAction';
 import { setupFinishedAPI } from '../../../loaders/api/finished';
@@ -51,8 +52,26 @@ export class Instrument extends InstrumentBase {
       });
     }
     if (securityPolicyViolationEnabled) {
+      /** ReportingObserver's `csp-violation` type isn't reliably enabled everywhere out of the box:
+       *  - Safari only delivers it when the page sets a report-to CSP directive -- https://bugs.webkit.org/show_bug.cgi?id=320750;
+       *  - Firefox ships it behind the `dom.reporting.enabled` pref, which defaults to false;
+       * So it's only used for violations that occur before the agent loaded, targeting Chromium browsers. `buffered: true` replays
+       * that backlog in the observer's first callback invocation, after which it's disconnected and all future violations are
+       * covered by securitypolicyviolation, which is reliable across all browsers. */
+      if (typeof globalScope.ReportingObserver === 'function') {
+        const cspObserver = new globalScope.ReportingObserver(reports => {
+          reports.forEach(report => {
+            handle('spv', [normalizeCspViolation(report), now()], undefined, FEATURE_NAMES.genericEvents, this.ee);
+          });
+          cspObserver.disconnect();
+        }, {
+          types: ['csp-violation'],
+          buffered: true
+        });
+        cspObserver.observe();
+      }
       globalScope.addEventListener('securitypolicyviolation', evt => {
-        handle('spv', [evt], undefined, FEATURE_NAMES.genericEvents, this.ee);
+        handle('spv', [normalizeCspViolation(evt), evt.timeStamp], undefined, FEATURE_NAMES.genericEvents, this.ee);
       }, eventListenerOpts(false, this.removeOnAbort.signal));
     }
     if (isBrowserScope) {
@@ -117,4 +136,25 @@ export class Instrument extends InstrumentBase {
     if (genericEventSourceConfigs.some(x => x)) this.importAggregator(agentRef, () => import(/* webpackChunkName: "generic_events-aggregate" */'../aggregate'));else this.deregisterDrain();
   }
 }
+/** `Report.body` (ReportingObserver) and `SecurityPolicyViolationEvent` (securitypolicyviolation) describe the same
+ * violation with differently-named/shaped fields -- collapse both into one shape so downstream code doesn't care
+ * which mechanism produced it. `source` is either of those: a Report (fields under `.body`, URLs as blockedURL/
+ * documentURL) or the event (fields at the top level, URLs as blockedURI/documentURI). Also normalizes disposition's
+ * "reporting" (Report body) to "report" (event) so the value is consistent regardless of source. */
+function normalizeCspViolation(source) {
+  const body = source.body ?? source;
+  return {
+    blockedUrl: body.blockedURL ?? source.blockedURI,
+    documentUrl: body.documentURL ?? source.documentURI,
+    effectiveDirective: body.effectiveDirective,
+    originalPolicy: body.originalPolicy,
+    sourceFile: body.sourceFile,
+    statusCode: body.statusCode,
+    lineNumber: body.lineNumber,
+    columnNumber: body.columnNumber,
+    disposition: body.disposition === 'reporting' ? 'report' : body.disposition,
+    sample: body.sample,
+    referrer: body.referrer
+  };
+}
 export const GenericEvents = Instrument;

package/dist/types/features/generic_events/aggregate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/generic_events/aggregate/index.js"],"names":[],"mappings":"AAoBA;IACE,2BAAiC;IAGjC,2BAkSC;IAhSC,gCAAkG;IAIlG,uBAA0C;IA+R5C;;;;;;;;;;;;OAYG;IACH,eAJW,MAAM,YAAC,WACP,MAAM,YAAC,QAkCjB;IAED,6CAEC;IAED;;;MAEC;;CAsBF;8BA/X6B,4BAA4B;2BAI/B,gCAAgC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/generic_events/aggregate/index.js"],"names":[],"mappings":"AAoBA;IACE,2BAAiC;IAGjC,2BAwRC;IAtRC,gCAAkG;IAIlG,uBAA0C;IAqR5C;;;;;;;;;;;;OAYG;IACH,eAJW,MAAM,YAAC,WACP,MAAM,YAAC,QAkCjB;IAED,6CAEC;IAED;;;MAEC;;CAsBF;8BArX6B,4BAA4B;2BAI/B,gCAAgC"}

package/dist/types/features/generic_events/instrument/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/generic_events/instrument/index.js"],"names":[],"mappings":"AAwBA;IACE,2BAAiC;IACjC,2BA0GC;IAnFC,+BAA0C;IAC1C,yBAGC;CAgFJ;AAED,8CAAuC;+BAzHR,6BAA6B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/generic_events/instrument/index.js"],"names":[],"mappings":"AAyBA;IACE,2BAAiC;IACjC,2BA0HC;IAnGC,+BAA0C;IAC1C,yBAGC;CAgGJ;AAuBD,8CAAuC;+BA9JR,6BAA6B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/browser-agent",
-  "version": "1.321.0-rc.10",
+  "version": "1.321.0-rc.12",
   "private": false,
   "author": "New Relic Browser Agent Team <browser-agent@newrelic.com>",
   "description": "New Relic Browser Agent",

package/src/features/generic_events/aggregate/index.js

@@ -291,21 +291,11 @@ export class Aggregate extends AggregateBase {
         }, this.featureName, this.ee)
       }
       if (!agentRef.init.feature_flags.includes('no_spv')) {
-        registerHandler('spv', (evt) => {
+        registerHandler('spv', (violation, timestamp) => {
           this.addEvent({
             eventType: EVENT_TYPES.SPV,
-            timestamp: this.#toEpoch(evt.timeStamp),
-            blockedUri: evt.blockedURI,
-            documentUri: evt.documentURI,
-            effectiveDirective: evt.effectiveDirective,
-            originalPolicy: evt.originalPolicy,
-            sourceFile: evt.sourceFile,
-            statusCode: evt.statusCode,
-            lineNumber: evt.lineNumber,
-            columnNumber: evt.columnNumber,
-            disposition: evt.disposition,
-            sample: evt.sample,
-            referrer: evt.referrer
+            timestamp: this.#toEpoch(timestamp),
+            ...violation
           })
         }, this.featureName, this.ee)
       }

package/src/features/generic_events/instrument/index.js

@@ -6,6 +6,7 @@
 import { globalScope, isBrowserScope } from '../../../common/constants/runtime'
 import { handle } from '../../../common/event-emitter/handle'
 import { eventListenerOpts, windowAddEventListener } from '../../../common/event-listener/event-listener-opts'
+import { now } from '../../../common/timing/now'
 import { debounce } from '../../../common/util/invoke'
 import { setupAddPageActionAPI } from '../../../loaders/api/addPageAction'
 import { setupFinishedAPI } from '../../../loaders/api/finished'
@@ -61,8 +62,24 @@ export class Instrument extends InstrumentBase {
       })
     }
     if (securityPolicyViolationEnabled) {
+      /** ReportingObserver's `csp-violation` type isn't reliably enabled everywhere out of the box:
+       *  - Safari only delivers it when the page sets a report-to CSP directive -- https://bugs.webkit.org/show_bug.cgi?id=320750;
+       *  - Firefox ships it behind the `dom.reporting.enabled` pref, which defaults to false;
+       * So it's only used for violations that occur before the agent loaded, targeting Chromium browsers. `buffered: true` replays
+       * that backlog in the observer's first callback invocation, after which it's disconnected and all future violations are
+       * covered by securitypolicyviolation, which is reliable across all browsers. */
+      if (typeof globalScope.ReportingObserver === 'function') {
+        const cspObserver = new globalScope.ReportingObserver((reports) => {
+          reports.forEach(report => {
+            handle('spv', [normalizeCspViolation(report), now()], undefined, FEATURE_NAMES.genericEvents, this.ee)
+          })
+          cspObserver.disconnect()
+        }, { types: ['csp-violation'], buffered: true })
+        cspObserver.observe()
+      }
+
       globalScope.addEventListener('securitypolicyviolation', (evt) => {
-        handle('spv', [evt], undefined, FEATURE_NAMES.genericEvents, this.ee)
+        handle('spv', [normalizeCspViolation(evt), evt.timeStamp], undefined, FEATURE_NAMES.genericEvents, this.ee)
       }, eventListenerOpts(false, this.removeOnAbort.signal))
     }
     if (isBrowserScope) {
@@ -132,5 +149,26 @@ export class Instrument extends InstrumentBase {
     else this.deregisterDrain()
   }
 }
+/** `Report.body` (ReportingObserver) and `SecurityPolicyViolationEvent` (securitypolicyviolation) describe the same
+ * violation with differently-named/shaped fields -- collapse both into one shape so downstream code doesn't care
+ * which mechanism produced it. `source` is either of those: a Report (fields under `.body`, URLs as blockedURL/
+ * documentURL) or the event (fields at the top level, URLs as blockedURI/documentURI). Also normalizes disposition's
+ * "reporting" (Report body) to "report" (event) so the value is consistent regardless of source. */
+function normalizeCspViolation (source) {
+  const body = source.body ?? source
+  return {
+    blockedUrl: body.blockedURL ?? source.blockedURI,
+    documentUrl: body.documentURL ?? source.documentURI,
+    effectiveDirective: body.effectiveDirective,
+    originalPolicy: body.originalPolicy,
+    sourceFile: body.sourceFile,
+    statusCode: body.statusCode,
+    lineNumber: body.lineNumber,
+    columnNumber: body.columnNumber,
+    disposition: body.disposition === 'reporting' ? 'report' : body.disposition,
+    sample: body.sample,
+    referrer: body.referrer
+  }
+}
 
 export const GenericEvents = Instrument