@nosecone/sveltekit 1.0.0-alpha.30 → 1.0.0-alpha.32

package/index.d.ts

@@ -1,7 +1,76 @@
-import nosecone, { defaults } from "nosecone";
+import nosecone from "nosecone";
 import type { CspDirectives, NoseconeOptions } from "nosecone";
 import type { Handle, KitConfig } from "@sveltejs/kit";
-export { defaults };
+export declare const defaults: {
+    readonly directives: {
+        readonly scriptSrc: readonly ["'strict-dynamic'"];
+        readonly baseUri: readonly ["'none'"];
+        readonly childSrc: readonly ["'none'"];
+        readonly connectSrc: readonly ["'self'"];
+        readonly defaultSrc: readonly ["'self'"];
+        readonly fontSrc: readonly ["'self'"];
+        readonly formAction: readonly ["'self'"];
+        readonly frameAncestors: readonly ["'none'"];
+        readonly frameSrc: readonly ["'none'"];
+        readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+        readonly manifestSrc: readonly ["'self'"];
+        readonly mediaSrc: readonly ["'self'"];
+        readonly objectSrc: readonly ["'none'"];
+        readonly styleSrc: readonly ["'self'"];
+        readonly workerSrc: readonly ["'self'"];
+        readonly upgradeInsecureRequests: true;
+    };
+    readonly contentSecurityPolicy: {
+        readonly directives: {
+            readonly baseUri: readonly ["'none'"];
+            readonly childSrc: readonly ["'none'"];
+            readonly connectSrc: readonly ["'self'"];
+            readonly defaultSrc: readonly ["'self'"];
+            readonly fontSrc: readonly ["'self'"];
+            readonly formAction: readonly ["'self'"];
+            readonly frameAncestors: readonly ["'none'"];
+            readonly frameSrc: readonly ["'none'"];
+            readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+            readonly manifestSrc: readonly ["'self'"];
+            readonly mediaSrc: readonly ["'self'"];
+            readonly objectSrc: readonly ["'none'"];
+            readonly scriptSrc: readonly ["'self'"];
+            readonly styleSrc: readonly ["'self'"];
+            readonly workerSrc: readonly ["'self'"];
+            readonly upgradeInsecureRequests: true;
+        };
+    };
+    readonly crossOriginEmbedderPolicy: {
+        readonly policy: "require-corp";
+    };
+    readonly crossOriginOpenerPolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly crossOriginResourcePolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly originAgentCluster: true;
+    readonly referrerPolicy: {
+        readonly policy: readonly ["no-referrer"];
+    };
+    readonly strictTransportSecurity: {
+        readonly maxAge: number;
+        readonly includeSubDomains: true;
+        readonly preload: false;
+    };
+    readonly xContentTypeOptions: true;
+    readonly xDnsPrefetchControl: {
+        readonly allow: false;
+    };
+    readonly xDownloadOptions: true;
+    readonly xFrameOptions: {
+        readonly action: "sameorigin";
+    };
+    readonly xPermittedCrossDomainPolicies: {
+        readonly permittedPolicies: "none";
+    };
+    readonly xXssProtection: true;
+};
 export default nosecone;
 /**
  * Create a SvelteKit hook that sets secure headers on every request.

package/index.js

@@ -1,6 +1,13 @@
-import nosecone, { defaults, CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED } from 'nosecone';
-export { default, defaults } from 'nosecone';
+import nosecone, { defaults as defaults$1, CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED } from 'nosecone';
+export { default } from 'nosecone';
 
+const defaults = {
+    ...defaults$1,
+    directives: {
+        ...defaults$1.contentSecurityPolicy.directives,
+        scriptSrc: ["'strict-dynamic'"],
+    },
+};
 /**
  * Create a SvelteKit hook that sets secure headers on every request.
  *
@@ -21,10 +28,6 @@ function createHook(options = defaults) {
         return response;
     };
 }
-const directives = {
-    ...defaults.contentSecurityPolicy.directives,
-    scriptSrc: ["'strict-dynamic'"],
-};
 function unquote(value) {
     for (const [unquoted, quoted] of QUOTED) {
         if (value === quoted) {
@@ -70,11 +73,11 @@ function directivesToSvelteKitConfig(directives) {
     }
     return sveltekitDirectives;
 }
-function csp(options = { mode: "auto", directives }) {
+function csp(options = { mode: "auto" }) {
     return {
         mode: options.mode ? options.mode : "auto",
         directives: directivesToSvelteKitConfig(options.directives ?? defaults.contentSecurityPolicy.directives),
     };
 }
 
-export { createHook, csp };
+export { createHook, csp, defaults };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nosecone/sveltekit",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.32",
   "description": "Protect your SvelteKit application with secure headers",
   "license": "Apache-2.0",
   "homepage": "https://arcjet.com",
@@ -29,7 +29,6 @@
     "README.md",
     "*.js",
     "*.d.ts",
-    "*.ts",
     "!*.config.js"
   ],
   "scripts": {
@@ -40,19 +39,19 @@
     "test": "node --test"
   },
   "dependencies": {
-    "nosecone": "1.0.0-alpha.30"
+    "nosecone": "1.0.0-alpha.32"
   },
   "peerDependencies": {
     "@sveltejs/kit": ">=2"
   },
   "devDependencies": {
-    "@arcjet/eslint-config": "1.0.0-alpha.30",
-    "@arcjet/rollup-config": "1.0.0-alpha.30",
-    "@arcjet/tsconfig": "1.0.0-alpha.30",
-    "@rollup/wasm-node": "4.27.3",
-    "@sveltejs/kit": "^2.8.0",
+    "@arcjet/eslint-config": "1.0.0-alpha.32",
+    "@arcjet/rollup-config": "1.0.0-alpha.32",
+    "@arcjet/tsconfig": "1.0.0-alpha.32",
+    "@rollup/wasm-node": "4.27.4",
+    "@sveltejs/kit": "^2.8.4",
     "@types/node": "18.18.0",
-    "typescript": "5.6.3"
+    "typescript": "5.7.2"
   },
   "publishConfig": {
     "access": "public",

package/index.ts

@@ -1,119 +0,0 @@
-import nosecone, {
-  CONTENT_SECURITY_POLICY_DIRECTIVES,
-  QUOTED,
-  defaults,
-  NoseconeValidationError,
-} from "nosecone";
-import type { CspDirectives, NoseconeOptions } from "nosecone";
-import type { Handle, KitConfig } from "@sveltejs/kit";
-
-// Re-exports the defaults for easier overrides
-export { defaults };
-
-// We export `nosecone` as the default so it can be used with `new Response()`
-export default nosecone;
-
-/**
- * Create a SvelteKit hook that sets secure headers on every request.
- *
- * @param options: Configuration to provide to Nosecone
- * @returns A SvelteKit hook that sets secure headers
- */
-export function createHook(options: NoseconeOptions = defaults): Handle {
-  return async ({ event, resolve }) => {
-    const response = await resolve(event);
-
-    const headers = nosecone(options);
-    for (const [headerName, headerValue] of Object.entries(headers)) {
-      // Only add headers that aren't already set. For example, SvelteKit will
-      // likely have added `Content-Security-Policy` if configured with `csp`
-      if (!response.headers.has(headerName)) {
-        response.headers.set(headerName, headerValue);
-      }
-    }
-
-    return response;
-  };
-}
-
-type SvelteKitCsp = Exclude<KitConfig["csp"], undefined>;
-
-export type ContentSecurityPolicyConfig = {
-  mode?: SvelteKitCsp["mode"];
-  directives?: CspDirectives;
-  // TODO: Support `reportOnly`
-};
-
-const directives: CspDirectives = {
-  ...defaults.contentSecurityPolicy.directives,
-  scriptSrc: ["'strict-dynamic'"],
-};
-
-function unquote(value?: string) {
-  for (const [unquoted, quoted] of QUOTED) {
-    if (value === quoted) {
-      return unquoted;
-    }
-  }
-
-  return value;
-}
-
-function resolveValue(v: (() => string) | string) {
-  if (typeof v === "function") {
-    return v();
-  } else {
-    return v;
-  }
-}
-
-function directivesToSvelteKitConfig(
-  directives: Readonly<CspDirectives>,
-): SvelteKitCsp["directives"] {
-  const sveltekitDirectives: SvelteKitCsp["directives"] = {};
-  for (const [optionKey, optionValues] of Object.entries(directives)) {
-    const key = CONTENT_SECURITY_POLICY_DIRECTIVES.get(
-      // @ts-expect-error because we're validating this option key
-      optionKey,
-    );
-    if (!key) {
-      throw new NoseconeValidationError(
-        `${optionKey} is not a Content-Security-Policy directive`,
-      );
-    }
-
-    // Skip anything falsey
-    if (!optionValues) {
-      continue;
-    }
-
-    // TODO: What do we want to do if array is empty? I think they work differently for some directives
-    const resolvedValues = Array.isArray(optionValues)
-      ? new Set(optionValues.map(resolveValue))
-      : new Set<string>();
-
-    // TODO: Add validations for SvelteKit CSP directives
-
-    const values = Array.from(resolvedValues);
-
-    if (key === "upgrade-insecure-requests") {
-      sveltekitDirectives[key] = true;
-    } else {
-      // @ts-ignore because we're mapping to SvelteKit options
-      sveltekitDirectives[key] = values.map(unquote);
-    }
-  }
-
-  return sveltekitDirectives;
-}
-
-export function csp(
-  options: ContentSecurityPolicyConfig = { mode: "auto", directives },
-): SvelteKitCsp {
-  return {
-    mode: options.mode ? options.mode : "auto",
-    directives: directivesToSvelteKitConfig(
-      options.directives ?? defaults.contentSecurityPolicy.directives,
-    ),
-  };
-}