@preventive/triage 1.0.0-alpha.6 → 1.0.0-alpha.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/api/reap.ts +79 -0
- package/out/client-sync.js +10 -10
- package/out/graph.js +3 -3
- package/out/view.css +1 -1
- package/out/view.js +55 -52
- package/package.json +4 -2
- package/server/static.ts +14 -5
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@preventive/triage",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.8",
|
|
4
4
|
"description": "Client & relay server for triaging of automated reports",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": {
|
|
@@ -29,6 +29,7 @@
|
|
|
29
29
|
"#client/sync-host.js": "./client/sync-host.js"
|
|
30
30
|
},
|
|
31
31
|
"exports": {
|
|
32
|
+
"./reap": "./api/reap.ts",
|
|
32
33
|
"./server": "./server/index.ts",
|
|
33
34
|
"./strip-types-loader": "./strip-types-loader.js",
|
|
34
35
|
"./package.json": "./package.json"
|
|
@@ -37,6 +38,7 @@
|
|
|
37
38
|
"triage-server": "server/cli.js"
|
|
38
39
|
},
|
|
39
40
|
"files": [
|
|
41
|
+
"api/reap.ts",
|
|
40
42
|
"server/auth.ts",
|
|
41
43
|
"server/bus-receiver.ts",
|
|
42
44
|
"server/cli.js",
|
|
@@ -97,7 +99,7 @@
|
|
|
97
99
|
],
|
|
98
100
|
"scripts": {
|
|
99
101
|
"lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
|
|
100
|
-
"lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./tests/ ./common/ ./server/ ./client/ ./ui/",
|
|
102
|
+
"lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./tests/ ./common/ ./server/ ./client/ ./ui/ ./api/",
|
|
101
103
|
"lint:css": "stylelint 'ui/**/*.css'",
|
|
102
104
|
"lint:ts": "tsc --noEmit",
|
|
103
105
|
"prepack": "node --run build",
|
package/server/static.ts
CHANGED
|
@@ -64,15 +64,24 @@ const COMPRESSIBLE = new Set(['.html', '.css', '.js', '.svg', '.webmanifest'])
|
|
|
64
64
|
// navigated `image/svg+xml` icon into something script-executable.
|
|
65
65
|
// `no-referrer` keeps URLs of this (potentially sensitive) viewer out
|
|
66
66
|
// of outbound Referer headers, and `same-origin` CORP stops other
|
|
67
|
-
// origins embedding these bytes.
|
|
68
|
-
//
|
|
69
|
-
//
|
|
70
|
-
//
|
|
71
|
-
//
|
|
67
|
+
// origins embedding these bytes. COOP `same-origin` severs the
|
|
68
|
+
// window.opener link to any cross-origin opener/popup (so an external
|
|
69
|
+
// `target=_blank` GitHub/Claude link can't reach back into this context),
|
|
70
|
+
// and COEP `require-corp` bars the document from loading any cross-origin
|
|
71
|
+
// subresource that doesn't opt in via CORP/CORS. Together they also make
|
|
72
|
+
// the page cross-origin-isolated. Safe here because the bundle is fully
|
|
73
|
+
// same-origin (no external scripts/images/fonts/iframes) — switch COEP to
|
|
74
|
+
// `credentialless` if a cross-origin resource is ever added. CSP is
|
|
75
|
+
// deliberately NOT here: the HTML documents carry their own per-page
|
|
76
|
+
// `<meta http-equiv>` policy (and the three pages differ), so a blanket
|
|
77
|
+
// header CSP would just AND against the meta one and risk breaking a page
|
|
78
|
+
// — non-document assets get their own flat CSP via `StaticEntry.csp`.
|
|
72
79
|
const SECURITY_HEADERS = {
|
|
73
80
|
'x-content-type-options': 'nosniff',
|
|
74
81
|
'referrer-policy': 'no-referrer',
|
|
75
82
|
'cross-origin-resource-policy': 'same-origin',
|
|
83
|
+
'cross-origin-opener-policy': 'same-origin',
|
|
84
|
+
'cross-origin-embedder-policy': 'require-corp',
|
|
76
85
|
} as const
|
|
77
86
|
|
|
78
87
|
type StaticEntry = {
|