@nutin/cli 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## V1.2.2
+
+- Fixed Nginx security headers in child location blocks.
+
+- Fixed package manager variable in `dev-serve.js.hbs` runCommand
+
+- Removed ghost files
+
 ## V1.2.1
 
 - Builder
@@ -24,8 +32,6 @@
     - Moved Dockerfile and deployment config files (`nginx.conf`, `gzip.conf`) into their own folder `tools/deployment`.
     - Added `docker:build` and `docker:run` scripts in package.json.
 
-  See [DEPLOYMENT.md file](../../docs/DEPLOYMENT_HELPERS.md) for details.
-
 - Moved dev tools (`serve.js`, `dev-serve.js`, `watcher.js`) into their own `tools/dev` folder.
 
 - Added explicit chokidar devDependency (sass & live-server transitive).
@@ -58,8 +64,6 @@
 
 - Improved deployment tools Dockerfile (nginx conf + gzip)
 
-  See [DEPLOYMENT.md file](../../docs/DEPLOYMENT_HELPERS.md) for details.
-
 - stylin-nutin (generator)
     - When generating a component, prompts (boolean) to generate a `_component-name.scss` file in `styles/components` (forwarded by `stymes/components/_index.scss`).
 

package/README.md

@@ -48,5 +48,7 @@ nutin-new
 
 ## [First app tutorial](https://www.nutin.org/tutorial)
 
-- Visit the [website](https://www.nutin.org)
-- [Project repository](https://github.com/LoisKOUNINEF/nutin)
+## 📄 Docs
+
+- Docs on [website](https://www.nutin.org).
+- Docs on [Project repository](https://github.com/LoisKOUNINEF/nutin/tree/main/docs).

package/lib/src/file-generator.mjs

@@ -55,7 +55,7 @@ export class ProjectGenerator {
     await this.processFeatureTemplates(projectPath, context);
   }
 
-  buildContext(answers) {  
+  buildContext(answers) { 
     const version = packageVersion;
     const ciCommand = getCiCommand(answers.packageManager);
 

package/lib/src/package-manager.mjs

@@ -42,9 +42,6 @@ function getScripts(answers) {
   const { testinNutin, packageManager, projectName } = answers;
 
   const baseScripts = {
-    "patch": `${packageManager} version patch -m 'CI/CD: Bump version to %s'`,
-    "minor": `${packageManager} version minor -m 'CI/CD: Bump version to %s'`,
-    "major": `${packageManager} version major -m 'CI/CD: Bump version to %s'`,
     "build": "node tools/builder/builder.js",
     "build:prod": "NODE_ENV=production node tools/builder/builder.js",
     "serve:only": "node tools/dev/serve.js",
@@ -52,7 +49,10 @@ function getScripts(answers) {
     "dev": "node tools/dev/dev-serve.js",
     "generate": "node tools/generator/generator.js",
     "docker:build": `docker build -t ${projectName} -f tools/deployment/Dockerfile .`,
-    "docker:run": `docker run -p 9090:9090 ${projectName}:latest`
+    "docker:run": `docker run -p 9090:9090 --name ${projectName}-container ${projectName}:latest`,
+    "patch": `${packageManager} version patch -m 'CI/CD: Bump version to %s'`,
+    "minor": `${packageManager} version minor -m 'CI/CD: Bump version to %s'`,
+    "major": `${packageManager} version major -m 'CI/CD: Bump version to %s'`
   };
 
   const testinNutinScripts = {

package/lib/src/prompts.mjs

@@ -84,7 +84,7 @@ export async function promptUser(initialName, cliOptions = {}) {
       type: 'confirm',
       name: 'testinNutin',
       message: 'Use testin-nutin toolkit?',
-      default: false
+      default: true
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nutin/cli",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Build SPAs by understanding SPAs. A minimal frontend toolkit crafted for learning and lean applications.",
   "preferGlobal": true,
   "main": "lib/index.mjs",

package/templates/base/tools/builder/builder.js.hbs

@@ -28,3 +28,5 @@ if (isProd) runScript(path.join(scriptsDir, 'esbuild.js'), 'Running esbuild...')
 runScript(path.join(scriptsDir, 'finalize-build.js'), 'Finalizing build...')
 
 print.boldSuccess(`\nBuild successful!\n`);
+
+if (!isProd) print.boldInfo('For production, use build:prod.');

package/templates/base/tools/builder/core/esbuild.js.hbs

@@ -19,7 +19,6 @@ async function build() {
   if (isVerbose) print.boldInfo(`ESBuild complete.\n`);
 }
 
-
 build().catch((err) => {
   print.boldError(`ESBuild failed: ${err.message}`);
   exit(1);

package/templates/base/tools/deployment/nginx.conf.hbs

@@ -1,8 +1,45 @@
+# ---------------------------
+# HEADER VARIABLES (define outside server block)
+# ---------------------------
+map $uri $frame_options {
+    default "SAMEORIGIN";
+}
+
+map $uri $content_type_options {
+    default "nosniff";
+}
+
+map $uri $xss_protection {
+    default "1; mode=block";
+}
+
+map $uri $referrer_policy {
+    default "strict-origin-when-cross-origin";
+}
+
+map $uri $permissions_policy {
+    default "geolocation=(), microphone=(), camera=()";
+}
+
+map $uri $csp_policy {
+    default "default-src 'self'; \
+        script-src 'self'; \
+        style-src 'self' 'unsafe-inline'; \
+        img-src 'self' data: https:; \
+        font-src 'self'; \
+        connect-src 'self'; \
+        object-src 'none'; \
+        base-uri 'self'; \
+        form-action 'self'; \
+        frame-ancestors 'none';";
+}
+
 server {
     # ---------------------------
     # LISTEN PORTS
     # ---------------------------
     listen 9090;
+    listen 9091;
     server_name _;
 
     # ---------------------------
@@ -11,45 +48,22 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Hide nginx version
+    server_tokens off;
+
     # SPA routing: serve index.html for unknown paths
     location / {
         try_files $uri $uri/ /index.html;
+        
+        # Security headers
+        add_header X-Frame-Options $frame_options always;
+        add_header X-Content-Type-Options $content_type_options always;
+        add_header X-XSS-Protection $xss_protection always;
+        add_header Referrer-Policy $referrer_policy always;
+        add_header Permissions-Policy $permissions_policy always;
+        add_header Content-Security-Policy $csp_policy always;
     }
 
-    # ---------------------------
-    # SECURITY HEADERS
-    # ---------------------------
-
-    # Prevent clickjacking
-    add_header X-Frame-Options "SAMEORIGIN" always;
-
-    # Block MIME type sniffing
-    add_header X-Content-Type-Options "nosniff" always;
-
-    # Legacy XSS filter
-    add_header X-XSS-Protection "1; mode=block" always;
-
-    # Limit referrer leakage
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
-    # Restrict powerful browser APIs
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-
-    # Content Security Policy
-    add_header Content-Security-Policy "default-src 'self'; \
-        script-src 'self'; \
-        style-src 'self' 'unsafe-inline'; \
-        img-src 'self' data: https:; \
-        font-src 'self'; \
-        connect-src 'self'; \
-        object-src 'none'; \
-        base-uri 'self'; \
-        form-action 'self'; \
-        frame-ancestors 'none';" always;
-
-    # Hide nginx version
-    server_tokens off;
-
     # ---------------------------
     # STATIC ASSETS CACHING
     # ---------------------------
@@ -57,14 +71,30 @@ server {
     # Immutable cache for static assets
     location ~* \.(js|css|png|jpg|jpeg|gif|avif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;
-        add_header Cache-Control "public, immutable";
+        add_header Cache-Control "public, immutable" always;
+        
+        # Security headers
+        add_header X-Frame-Options $frame_options always;
+        add_header X-Content-Type-Options $content_type_options always;
+        add_header X-XSS-Protection $xss_protection always;
+        add_header Referrer-Policy $referrer_policy always;
+        add_header Permissions-Policy $permissions_policy always;
+        add_header Content-Security-Policy $csp_policy always;
     }
 
     # No caching for HTML files (SPA shell)
     location ~* \.html$ {
         expires -1;
-        add_header Cache-Control "no-cache, no-store, must-revalidate";
-        add_header Pragma "no-cache";
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+        add_header Pragma "no-cache" always;
+        
+        # Security headers
+        add_header X-Frame-Options $frame_options always;
+        add_header X-Content-Type-Options $content_type_options always;
+        add_header X-XSS-Protection $xss_protection always;
+        add_header Referrer-Policy $referrer_policy always;
+        add_header Permissions-Policy $permissions_policy always;
+        add_header Content-Security-Policy $csp_policy always;
     }
 
     # ---------------------------
@@ -72,7 +102,7 @@ server {
     # ---------------------------
     location /health {
         access_log off;
-        add_header Content-Type text/plain;
+        add_header Content-Type text/plain always;
         return 200 "healthy\n";
     }
 }

package/templates/base/tools/dev/dev-serve.js.hbs

@@ -10,7 +10,7 @@ async function startDev() {
     await runCommand('{{packageManager}}', ['run', 'build']);
 
     const { serve, watcher } = await Promise.all([
-      runCommand('npm', ['run', 'serve:only']),
+      runCommand('{{packageManager}}', ['run', 'serve:only']),
       runCommand('node', ['tools/dev/watcher.js'])
     ]);
 

package/templates/base/tools/utils/index.js.hbs

@@ -7,4 +7,4 @@ export * from './export-flags.js';
 export * from './prompt-boolean.js';
 {{#if i18n}}
 export * from './languages.js';
-{{/if}}
+{{/if}}

package/templates/features/stylinNutin/src/styles/components/_index.scss.hbs

@@ -0,0 +1,3 @@
+// global components style export
+
+// @forward "my-component";

package/templates/features/i18n/src/app/languages.js.hbs

@@ -1,10 +0,0 @@
-// used in tools/generators to generate views/components JSON files
-
-/**
- * @typedef {'en' | 'fr'} Language
- */
-/** @type {readonly Language[]} */
-export const LANGUAGES = /** @type {const} */ (['en', 'fr']);
-
-/** @type {Language} */
-export const DEFAULT_LANGUAGE = /** @type {const} */ ('en');

package/templates/features/i18n/src/app/languages.ts.hbs

@@ -1,7 +0,0 @@
-// Used in src/core/services/i18n.ts
-
-export const LANGUAGES = ['en', 'fr'] as const;
-export const DEFAULT_LANGUAGE: Language = 'en' as const;
-
-export type Language = typeof LANGUAGES[number];
-export type Translations = Record<string, any>;