npm - @oxyhq/core - Versions diffs - 21.0.2 → 21.2.0 - Mend

@oxyhq/core 21.0.2 → 21.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/dist/cjs/.tsbuildinfo +1 -1
package/dist/cjs/mixins/OxyServices.utility.js +34 -1
package/dist/cjs/server/index.js +10 -1
package/dist/cjs/server/securityHeaders.js +144 -1
package/dist/esm/.tsbuildinfo +1 -1
package/dist/esm/mixins/OxyServices.utility.js +34 -1
package/dist/esm/server/index.js +7 -1
package/dist/esm/server/securityHeaders.js +141 -1
package/dist/types/.tsbuildinfo +1 -1
package/dist/types/mixins/OxyServices.accounts.d.ts +40 -0
package/dist/types/mixins/OxyServices.utility.d.ts +24 -2
package/dist/types/server/index.d.ts +1 -1
package/dist/types/server/securityHeaders.d.ts +67 -0
package/package.json +3 -3
package/src/mixins/OxyServices.accounts.ts +40 -0
package/src/mixins/OxyServices.utility.ts +46 -3
package/src/mixins/__tests__/accounts.test.ts +11 -4
package/src/mixins/__tests__/verifyServiceActingAs.test.ts +167 -0
package/src/server/__tests__/securityHeaders.test.ts +116 -12
package/src/server/index.ts +9 -0
package/src/server/securityHeaders.ts +164 -1

package/src/server/__tests__/securityHeaders.test.ts CHANGED Viewed

@@ -3,7 +3,10 @@ import {
   buildOxyCspDirectives,
   buildOxyPagesHeaders,
   createOxySecurityHeaders,
+  cspSourcesFor,
+  extractInlineScripts,
   formatOxyCspPolicy,
+  inlineScriptCspHash,
   OXY_CSP_BASELINE,
   type OxyCspExtensions,
 } from '../securityHeaders';
@@ -27,14 +30,11 @@ function renderPolicy(options: Parameters<typeof createOxySecurityHeaders>[0]):
   return headers['Content-Security-Policy'] ?? '';
 }
-/** The sources of one directive, parsed back out of the rendered header. */
-function policySources(policy: string, directive: string): string[] {
-  const found = policy
-    .split(';')
-    .map((segment) => segment.trim())
-    .find((segment) => segment === directive || segment.startsWith(`${directive} `));
-  if (found === undefined) return [];
-  return found.split(/\s+/).slice(1);
+/** The CSP value parsed back out of a Cloudflare Pages `_headers` block. */
+function cspOf(block: string): string {
+  const line = block.split('\n').find((entry) => entry.trim().startsWith('Content-Security-Policy:'));
+  if (line === undefined) throw new Error('no Content-Security-Policy line in _headers block');
+  return line.trim().slice('Content-Security-Policy:'.length).trim();
 }
 describe('@oxyhq/core/server buildOxyCspDirectives', () => {
@@ -179,12 +179,116 @@ describe('@oxyhq/core/server buildOxyPagesHeaders', () => {
   });
 });
+/**
+ * The inline script Expo Router's static export emits, verbatim, and the hash
+ * `accounts.oxy.so` was measured rejecting on 2026-08-21. Pinned as a LITERAL
+ * rather than recomputed: a test that derives the expected value the same way
+ * the code does would pass against any hashing bug they share.
+ */
+const EXPO_HYDRATE_SCRIPT = 'globalThis.__EXPO_ROUTER_HYDRATE__=true;';
+const EXPO_HYDRATE_SHA256 = "'sha256-67fhrP0+BkBqmgGGXTtgiVO/9EQs3QruYNU/7fnRkI8='";
+/** A static Expo export's HTML, reduced to the parts that decide the policy. */
+function expoExportHtml(body = EXPO_HYDRATE_SCRIPT): string {
+  return [
+    '<!DOCTYPE html><html><head>',
+    '<script src="/_expo/static/js/web/entry-abc.js" defer></script>',
+    `<script type="module">${body}</script>`,
+    '</head><body><div id="root"></div></body></html>',
+  ].join('');
+}
+describe('@oxyhq/core/server extractInlineScripts', () => {
+  it('returns inline bodies and skips external scripts', () => {
+    expect(extractInlineScripts(expoExportHtml())).toEqual([EXPO_HYDRATE_SCRIPT]);
+  });
+  it('does not let a ">" inside an attribute value truncate an inline tag', () => {
+    // Truncating here does not throw: the body window shifts right and the hash
+    // is taken over `b'>globalThis…`, which allows nothing. Note the attribute
+    // must precede the body for this to discriminate — an EXTERNAL script whose
+    // `src` comes first is skipped either way, which is why the beacon shape is
+    // not the case under test here.
+    const html = `<script type="module" data-x='a>b'>${EXPO_HYDRATE_SCRIPT}</script>`;
+    expect(extractInlineScripts(html)).toEqual([EXPO_HYDRATE_SCRIPT]);
+  });
+  it('still recognizes a src that follows a ">"-bearing attribute', () => {
+    // The mirror failure: truncation hides `src` from the attribute slice, so
+    // an external script is mistaken for an inline one and contributes a hash
+    // over a fragment of its own tag.
+    expect(extractInlineScripts(`<script data-x='a>b' src="/entry.js"></script>`)).toEqual([]);
+  });
+  it('hashes the exact bytes, so whitespace changes the source', () => {
+    expect(inlineScriptCspHash(EXPO_HYDRATE_SCRIPT)).toBe(EXPO_HYDRATE_SHA256);
+    expect(inlineScriptCspHash(` ${EXPO_HYDRATE_SCRIPT}`)).not.toBe(EXPO_HYDRATE_SHA256);
+  });
+});
+describe('@oxyhq/core/server buildOxyPagesHeaders inline-script hashes', () => {
+  it('allows the built HTML\'s inline script by hash', () => {
+    const block = buildOxyPagesHeaders({ html: [expoExportHtml()] });
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toEqual([
+      "'self'",
+      CLOUDFLARE_SCRIPT_HOST,
+      EXPO_HYDRATE_SHA256,
+    ]);
+  });
+  it('emits no hash at all when the build has no inline script', () => {
+    // Negative control for the assertion above: without it, "contains a
+    // sha256-" would be satisfied by a builder that hashed unconditionally.
+    const block = buildOxyPagesHeaders({ html: ['<html><body>nothing inline</body></html>'] });
+    expect(cspOf(block)).not.toContain('sha256-');
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
+  });
+  it('dedupes one route-per-file export down to a single hash', () => {
+    const block = buildOxyPagesHeaders({
+      html: [expoExportHtml(), expoExportHtml(), expoExportHtml()],
+    });
+    expect(cspOf(block).match(/sha256-/g)).toHaveLength(1);
+  });
+  it('keeps per-app extensions and the baseline alongside the hash', () => {
+    const block = buildOxyPagesHeaders({
+      csp: { imgSrc: ['blob:'], connectSrc: ['blob:'] },
+      html: [expoExportHtml()],
+    });
+    expect(cspSourcesFor(cspOf(block), 'img-src')).toContain('blob:');
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toContain(EXPO_HYDRATE_SHA256);
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toContain("'self'");
+  });
+  it('never hashes styles, which would disable style-src unsafe-inline', () => {
+    // A style hash would neutralize 'unsafe-inline' and render every
+    // react-native-web app unstyled — the one directive that must stay open.
+    const block = buildOxyPagesHeaders({
+      html: ['<html><head><style>.a{color:red}</style></head></html>'],
+    });
+    expect(cspSourcesFor(cspOf(block), 'style-src')).toEqual(["'self'", "'unsafe-inline'"]);
+    expect(cspOf(block)).not.toContain('sha256-');
+  });
+  it('refuses a build whose inline scripts vary per route', () => {
+    // An Expo route loader emits `__EXPO_ROUTER_LOADER_DATA__` with different
+    // bytes per route. The hashes would still be correct; the policy would grow
+    // with the route count. That has to be a decision, so it fails loudly.
+    const perRoute = Array.from({ length: 9 }, (_, index) =>
+      expoExportHtml(`globalThis.__EXPO_ROUTER_LOADER_DATA__={"r":${index}};`),
+    );
+    expect(() => buildOxyPagesHeaders({ html: perRoute })).toThrow(RangeError);
+    expect(() => buildOxyPagesHeaders({ html: perRoute.slice(0, 8) })).not.toThrow();
+  });
+});
 describe('@oxyhq/core/server createOxySecurityHeaders', () => {
   it('sends the resolved baseline as a real Content-Security-Policy header', () => {
     const policy = renderPolicy({});
-    expect(policySources(policy, 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
-    expect(policySources(policy, 'connect-src')).toEqual([
+    expect(cspSourcesFor(policy, 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
+    expect(cspSourcesFor(policy, 'connect-src')).toEqual([
       "'self'",
       CLOUDFLARE_REPORT_HOST,
       'https://api.oxy.so',
@@ -202,7 +306,7 @@ describe('@oxyhq/core/server createOxySecurityHeaders', () => {
       },
     });
-    expect(policySources(policy, 'connect-src')).toEqual([
+    expect(cspSourcesFor(policy, 'connect-src')).toEqual([
       "'self'",
       CLOUDFLARE_REPORT_HOST,
       'https://api.oxy.so',
@@ -211,7 +315,7 @@ describe('@oxyhq/core/server createOxySecurityHeaders', () => {
       'https://api.mention.earth',
       'wss://api.mention.earth',
     ]);
-    expect(policySources(policy, 'frame-src')).toEqual([
+    expect(cspSourcesFor(policy, 'frame-src')).toEqual([
       "'self'",
       'https://www.youtube-nocookie.com',
     ]);

package/src/server/index.ts CHANGED Viewed

@@ -71,11 +71,20 @@ export type { OxyCorsOptions } from './cors';
 // Shared Helmet + Content-Security-Policy baseline (Cloudflare Insights beacon,
 // Oxy API/CDN origins) with additive, per-app extensions.
+//
+// `extractInlineScripts` / `inlineScriptCspHash` / `cspSourcesFor` are exported
+// so a post-deploy gate can ask the SERVED document and the SERVED policy the
+// same questions `buildOxyPagesHeaders` asked the built ones. A gate that
+// re-implemented the scan or the parse would be testing its own copy, and would
+// agree with a broken original.
 export {
   buildOxyCspDirectives,
   buildOxyPagesHeaders,
   createOxySecurityHeaders,
+  cspSourcesFor,
+  extractInlineScripts,
   formatOxyCspPolicy,
+  inlineScriptCspHash,
   OXY_CSP_BASELINE,
 } from './securityHeaders';
 export type {

package/src/server/securityHeaders.ts CHANGED Viewed

@@ -33,6 +33,19 @@
  *     cannot pass their own `contentSecurityPolicy` through to Helmet at all
  *     (the option is typed `never`).
  *
+ *  3. A STATIC EXPO EXPORT SHIPS AN INLINE SCRIPT THE BASELINE FORBIDS.
+ *     `web.output: 'static'` makes Expo Router emit
+ *     `<script type="module">globalThis.__EXPO_ROUTER_HYDRATE__=true;</script>`,
+ *     which is what tells the client entry to call `hydrateRoot` instead of
+ *     `createRoot().render()`. Nothing in app code puts it there, so — like the
+ *     Cloudflare beacon above — an app cannot allowlist it from the app side.
+ *     Measured on `accounts.oxy.so` 2026-08-21: blocked, so every visit threw
+ *     away the server-rendered markup and re-rendered from scratch, with only a
+ *     console error to show for it. The hashes are therefore DERIVED from the
+ *     built output rather than hand-written (see {@link extractInlineScripts}):
+ *     a hash pasted into config is correct exactly until the build changes one
+ *     byte, and then it fails the same silent way.
+ *
  * WHAT IT PROVIDES
  * ----------------
  * `createOxySecurityHeaders(options)` returns the Helmet middleware with the
@@ -54,6 +67,7 @@
  * Node/Express-only: exported solely from `@oxyhq/core/server`.
  */
+import { createHash } from 'node:crypto';
 import type { RequestHandler } from 'express';
 import helmet, { type HelmetOptions } from 'helmet';
@@ -226,6 +240,123 @@ export function formatOxyCspPolicy(directives: Record<string, string[]>): string
     .join('; ');
 }
+/**
+ * The source list one directive carries in a serialized policy, or `[]` when
+ * the policy does not name that directive. The inverse of
+ * {@link formatOxyCspPolicy}, and the reason it lives here rather than beside
+ * either caller: the post-deploy gate parses the policy the ORIGIN serves while
+ * the unit test parses the one the middleware renders, so a copy in each would
+ * let the header shape change with the test still green and the gate reading
+ * `[]` — reporting every script blocked, which reads as a broken app rather
+ * than as a broken parser.
+ *
+ * A directive present with no sources (`upgrade-insecure-requests`) and a
+ * directive absent entirely both answer `[]`. Callers that need to tell those
+ * apart are asking a different question than "what is allowed here".
+ */
+export function cspSourcesFor(policy: string, directive: string): string[] {
+  const segment = policy
+    .split(';')
+    .map((entry) => entry.trim())
+    .find((entry) => entry === directive || entry.startsWith(`${directive} `));
+  return segment === undefined ? [] : segment.split(/\s+/).slice(1);
+}
+/**
+ * Index of the `>` that closes a tag whose attribute region starts at `from`,
+ * or `-1` if the document ends first. Quote-aware: a `>` inside an attribute
+ * VALUE does not close the tag.
+ *
+ * No HTML any Oxy build currently emits contains such an attribute, so this is
+ * not load-bearing today — it is here because the same scanner reads the SERVED
+ * document in the post-deploy gate, and what an edge injects into that document
+ * is not ours to constrain. Getting it wrong is not a parse error: the body
+ * window shifts, the hash is computed over the wrong bytes, and the script is
+ * blocked exactly as if no hash had been derived at all.
+ */
+function findTagEnd(html: string, from: number): number {
+  let quote: '"' | "'" | null = null;
+  for (let index = from; index < html.length; index += 1) {
+    const character = html[index];
+    if (quote !== null) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === '"' || character === "'") {
+      quote = character;
+      continue;
+    }
+    if (character === '>') return index;
+  }
+  return -1;
+}
+/**
+ * Every inline `<script>` body in an HTML document, in document order. A
+ * `<script src=…>` is a URL the source list already governs and is skipped.
+ *
+ * Scanned rather than matched with one regex because the two failure modes are
+ * not symmetric: an EXTRA body costs a redundant hash nobody notices, while a
+ * MISSED body silently reinstates the exact breakage this exists to prevent.
+ * So the scan errs toward finding them — it walks the open tag quote-aware
+ * instead of letting a `>` inside an attribute value truncate it.
+ *
+ * The type attribute is deliberately not consulted. Whether a given `type`
+ * executes is a browser decision (and it changes: `importmap` and
+ * `speculationrules` were both once inert), and pinning the exact bytes of a
+ * data block we ship ourselves weakens nothing.
+ */
+export function extractInlineScripts(html: string): string[] {
+  const lowered = html.toLowerCase();
+  const bodies: string[] = [];
+  const openTag = /<script\b/gi;
+  let match = openTag.exec(html);
+  while (match !== null) {
+    const attributesStart = match.index + match[0].length;
+    const attributesEnd = findTagEnd(html, attributesStart);
+    if (attributesEnd < 0) break;
+    const bodyStart = attributesEnd + 1;
+    const bodyEnd = lowered.indexOf('</script', bodyStart);
+    if (bodyEnd < 0) break;
+    if (!/\bsrc\s*=/i.test(html.slice(attributesStart, attributesEnd))) {
+      bodies.push(html.slice(bodyStart, bodyEnd));
+    }
+    openTag.lastIndex = bodyEnd;
+    match = openTag.exec(html);
+  }
+  return bodies;
+}
+/**
+ * The `'sha256-…'` source that allows one inline script, hashed over its exact
+ * bytes as CSP specifies — no trimming, no normalization. One byte of
+ * whitespace either way is a different hash and the script stays blocked.
+ */
+export function inlineScriptCspHash(source: string): string {
+  return `'sha256-${createHash('sha256').update(source, 'utf8').digest('base64')}'`;
+}
+/**
+ * Ceiling on how many derived inline-script hashes may enter one `_headers`
+ * block. Nothing in an Oxy app authors an inline script, so the realistic
+ * count is the ONE Expo Router hydration flag — deduped across every route's
+ * HTML, because it is byte-identical in all of them.
+ *
+ * The ceiling exists because one future change breaks that: a route loader
+ * makes Expo emit a SECOND inline script, `__EXPO_ROUTER_LOADER_DATA__`, whose
+ * bytes differ per route. The hashes stay CORRECT (they are derived from the
+ * same build that ships), but the count becomes the route count and the policy
+ * grows without bound on every response. That is a decision to take
+ * deliberately, so it arrives as a red build rather than a quietly enormous
+ * header.
+ */
+const MAX_INLINE_SCRIPT_HASHES = 8;
 export interface OxyPagesHeadersOptions {
   /** Per-app additions merged into {@link OXY_CSP_BASELINE}. */
   csp?: OxyCspExtensions;
@@ -234,15 +365,47 @@ export interface OxyPagesHeadersOptions {
    * HTTPS only, so static deploys should keep this on.
    */
   hsts?: boolean;
+  /**
+   * The BUILT HTML documents this `_headers` will be served alongside. Every
+   * inline script found in them is allowed by hash, added to `script-src`.
+   *
+   * Passing the built output — rather than hand-writing a hash into
+   * `oxy.pages-headers.json` — is the whole point: a pasted hash is correct
+   * until the generator changes one byte of that script, and then the script is
+   * blocked again with nothing but a console error to show for it.
+   */
+  html?: readonly string[];
 }
 /**
  * Build a Cloudflare Pages `_headers` block for an Oxy HTML origin. Uses the
  * same CSP resolution as {@link createOxySecurityHeaders} plus the non-CSP
  * hardening headers Helmet would add on an Express HTML backend.
+ *
+ * Adding a hash to `script-src` does not narrow it: per CSP Level 3 a hash is
+ * an additional source, so `'self'` and the beacon host keep matching external
+ * scripts. (It WOULD neutralize `'unsafe-inline'` in the same directive — which
+ * is why this hashes scripts only. `style-src` keeps `'unsafe-inline'` for
+ * react-native-web's runtime stylesheet, and a style hash would silently switch
+ * that off and render every Oxy web app unstyled.)
  */
 export function buildOxyPagesHeaders(options: OxyPagesHeadersOptions = {}): string {
-  const csp = formatOxyCspPolicy(buildOxyCspDirectives(options.csp));
+  const hashes = [
+    ...new Set((options.html ?? []).flatMap(extractInlineScripts).map(inlineScriptCspHash)),
+  ];
+  if (hashes.length > MAX_INLINE_SCRIPT_HASHES) {
+    throw new RangeError(
+      `Oxy CSP: ${hashes.length} distinct inline scripts in the built HTML exceeds the ${MAX_INLINE_SCRIPT_HASHES}-hash ceiling. A per-route inline data block (e.g. an Expo Router loader) is the likely cause; allow it deliberately rather than by raising this.`,
+    );
+  }
+  const csp = formatOxyCspPolicy(
+    buildOxyCspDirectives(
+      hashes.length === 0
+        ? options.csp
+        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] },
+    ),
+  );
   const lines = [
     '/*',
     `  Content-Security-Policy: ${csp}`,