@rimelight/security 0.0.18 → 0.0.20

package/dist/index.d.mts

@@ -2,4 +2,5 @@ import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t
 import { buildCspHeader } from "./csp.mjs";
 import { RimelightSecurityPlugin, SecurityPluginOptions, security } from "./vite.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RateLimitOptions, RateLimiterBinding, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };
+import rimelightSecurity, { RimelightSecurityOptions } from "./integration.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RateLimitOptions, RateLimiterBinding, RimelightSecurityOptions, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, rimelightSecurity, security, security as sri, signInConstructionGuest };

package/dist/index.mjs

@@ -2,4 +2,5 @@ import "./types.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { security } from "./vite.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };
+import rimelightSecurity from "./integration.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, buildCspHeader, construction, isConstructionGuest, rimelightSecurity, security, security as sri, signInConstructionGuest };

package/dist/integration.d.mts

@@ -0,0 +1,26 @@
+import { i as SecurityOptions, t as ConstructionOptions } from "./types-Dcvwj-af.mjs";
+import { AstroIntegration } from "astro";
+//#region src/integration.d.ts
+export interface RimelightSecurityOptions extends SecurityOptions {
+  /**
+   * Construction mode options & route injection settings
+   */
+  construction?: ConstructionOptions & {
+    /**
+     * Whether to automatically inject the construction page route. Defaults to true.
+     */
+    injectRoute?: boolean;
+    /**
+     * Pattern to inject for the construction route. Defaults to "/[locale]/construction" or
+     * "/construction".
+     */
+    routePattern?: string;
+  };
+}
+/**
+ * Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+ * automatically injects the construction mode page route.
+ */
+export declare function rimelightSecurity(options?: RimelightSecurityOptions): AstroIntegration;
+//#endregion
+export { rimelightSecurity as default };

package/dist/integration.mjs

@@ -0,0 +1,20 @@
+import { security } from "./vite.mjs";
+//#region src/integration.ts
+/**
+* Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+* automatically injects the construction mode page route.
+*/
+function rimelightSecurity(options = {}) {
+	return {
+		name: "@rimelight/security",
+		hooks: { "astro:config:setup": ({ injectRoute, updateConfig }) => {
+			if (options.construction?.injectRoute !== false) injectRoute({
+				pattern: options.construction?.routePattern || "/[locale]/construction",
+				entrypoint: "@rimelight/security/pages/construction.astro"
+			});
+			updateConfig({ vite: { plugins: [security(options)] } });
+		} }
+	};
+}
+//#endregion
+export { rimelightSecurity as default, rimelightSecurity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -17,7 +17,7 @@
   },
   "files": [
     "dist",
-    "src/components"
+    "src"
   ],
   "type": "module",
   "exports": {
@@ -33,17 +33,26 @@
       "types": "./dist/config/index.d.mts",
       "import": "./dist/config/index.mjs"
     },
+    "./integration": {
+      "types": "./dist/integration.d.mts",
+      "import": "./dist/integration.mjs"
+    },
+    "./components/*": "./src/components/*",
+    "./layouts/*": "./src/layouts/*",
+    "./pages/*": "./src/pages/*",
     "./*": "./src/*"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@rimelight/ui": "0.0.56"
+    "@rimelight/i18n": "0.0.17",
+    "@rimelight/seo": "0.0.13",
+    "@rimelight/ui": "0.0.57"
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.13",
+    "@rimelight/config": "0.0.16",
     "astro": "7.3.3",
     "hono": "4.13.8",
     "typescript": "6.0.3"

package/src/components/ConstructionPage.astro

@@ -0,0 +1,166 @@
+---
+import ConstructionLayout from "../layouts/ConstructionLayout.astro";
+import ConstructionSignIn from "./ConstructionSignIn.astro";
+import RLALogo from "@rimelight/ui/components/logo/RLALogo.astro";
+import RLALocaleSelector from "@rimelight/ui/components/locale-selector/RLALocaleSelector.astro";
+import { t, getLocale } from "@rimelight/i18n";
+import { siteConfig } from "virtual:rimelight/seo";
+
+export interface LocaleOption {
+  code: string;
+  label?: string;
+  href?: string;
+}
+
+export interface Props {
+  title?: string | undefined;
+  description?: string | undefined;
+  metaTitle?: string | undefined;
+  metaDescription?: string | undefined;
+  noindex?: boolean | undefined;
+  favicon?: string | undefined;
+
+  // Branding & Logo
+  logoAlt?: string | undefined;
+  siteName?: string | undefined;
+  copyright?: string | undefined;
+
+  // Locales
+  locales?: (LocaleOption | string)[] | undefined;
+  currentLocale?: string | undefined;
+  showLocaleSelector?: boolean | undefined;
+
+  // Guest Passphrase Form
+  allowAuth?: boolean | undefined;
+  endpoint?: string | undefined;
+  passphraseLabel?: string | undefined;
+  passphrasePlaceholder?: string | undefined;
+  rememberMeLabel?: string | undefined;
+  signInButtonLabel?: string | undefined;
+  loadingButtonLabel?: string | undefined;
+  returnLaterText?: string | undefined;
+
+  // Layout & Styling
+  class?: string | undefined;
+  containerClass?: string | undefined;
+  bodyClass?: string | undefined;
+}
+
+const {
+  title,
+  description,
+  metaTitle,
+  metaDescription,
+  noindex = true,
+  favicon,
+  logoAlt,
+  siteName = (siteConfig as any)?.["name"] || "Rimelight Entertainment",
+  copyright,
+  locales = [
+    { code: "en", label: "English" },
+    { code: "pt", label: "Português" },
+  ],
+  currentLocale,
+  showLocaleSelector = true,
+  allowAuth = true,
+  endpoint = "/api/construction-guest",
+  passphraseLabel,
+  passphrasePlaceholder,
+  rememberMeLabel,
+  signInButtonLabel,
+  loadingButtonLabel,
+  returnLaterText,
+  class: className = "flex min-h-screen flex-col items-center justify-center bg-black px-4 py-12",
+  containerClass = "z-10 w-full max-w-md space-y-8 text-center",
+  bodyClass = "isolate bg-black"
+} = Astro.props;
+
+// Safe i18n translation helper with fallback
+const translate = (key: string, fallback: string): string => {
+  try {
+    const val = t(key);
+    if (val && val !== key) return val;
+  } catch {}
+  return fallback;
+};
+
+const resolvedMetaTitle = metaTitle ?? translate("page_construction.meta_title", title ?? "Under Construction");
+const resolvedMetaDescription = metaDescription ?? translate("page_construction.meta_description", description ?? "This site is currently undergoing scheduled maintenance.");
+const resolvedTitle = title ?? translate("page_construction.title", "Under Construction");
+const resolvedDescription = description ?? translate("page_construction.description", "This site is currently undergoing scheduled maintenance and is restricted to authorized personnel.");
+
+const resolvedPassphraseLabel = passphraseLabel ?? translate("page_construction.form_passphrase_label", "Passphrase");
+const resolvedPassphrasePlaceholder = passphrasePlaceholder ?? translate("page_construction.form_passphrase_placeholder", "Enter passphrase...");
+const resolvedRememberMeLabel = rememberMeLabel ?? translate("page_construction.form_remember_me_label", "Remember me");
+const resolvedSignInButtonLabel = signInButtonLabel ?? translate("page_construction.form_sign_in_button", "Sign In");
+const resolvedCopyright = copyright ?? `© ${new Date().getFullYear()} ${siteName}`;
+
+let resolvedCurrentLocale = currentLocale;
+if (!resolvedCurrentLocale) {
+  try {
+    resolvedCurrentLocale = getLocale();
+  } catch {
+    resolvedCurrentLocale = "en";
+  }
+}
+---
+
+<ConstructionLayout
+  title={resolvedMetaTitle}
+  description={resolvedMetaDescription}
+  favicon={favicon}
+  noindex={noindex}
+  bodyClass={bodyClass}
+>
+  <slot name="head" slot="head" />
+
+  <div class={className}>
+    <div class={containerClass}>
+      <slot name="header">
+        <div class="flex flex-col items-center gap-4">
+          <slot name="logo">
+            <RLALogo class="h-12 w-auto text-white" variant="logomark" mode="white" alt={logoAlt || siteName} />
+          </slot>
+          <slot name="title">
+            <h1 class="m-0 text-3xl font-bold text-white sm:text-4xl">
+              {resolvedTitle}
+            </h1>
+          </slot>
+          <slot name="description">
+            <p class="m-0 text-neutral-400">
+              {resolvedDescription}
+            </p>
+          </slot>
+        </div>
+      </slot>
+
+      <slot name="header-extra" />
+
+      <slot name="form">
+        <ConstructionSignIn
+          allowAuth={allowAuth}
+          endpoint={endpoint}
+          passphraseLabel={resolvedPassphraseLabel}
+          passphrasePlaceholder={resolvedPassphrasePlaceholder}
+          rememberMeLabel={resolvedRememberMeLabel}
+          signInButtonLabel={resolvedSignInButtonLabel}
+          loadingButtonLabel={loadingButtonLabel}
+          returnLaterText={returnLaterText}
+        />
+      </slot>
+
+      <slot name="footer">
+        <div class="flex flex-col items-center gap-2 text-xs text-neutral-500">
+          <slot name="locale-selector">
+            {showLocaleSelector && locales && locales.length > 1 && (
+              <RLALocaleSelector locales={locales as any} currentLocale={resolvedCurrentLocale} />
+            )}
+          </slot>
+          <slot name="copyright">
+            <span>{resolvedCopyright}</span>
+          </slot>
+        </div>
+      </slot>
+    </div>
+  </div>
+</ConstructionLayout>

package/src/components/ConstructionSignIn.astro

@@ -6,15 +6,15 @@ import RLAButton from "@rimelight/ui/components/button/RLAButton.astro"
 import RLACheckbox from "@rimelight/ui/components/checkbox/RLACheckbox.astro"
 
 interface Props {
-  allowAuth?: boolean
-  endpoint?: string
-  passphraseLabel?: string
-  passphrasePlaceholder?: string
-  rememberMeLabel?: string
-  signInButtonLabel?: string
-  loadingButtonLabel?: string
-  returnLaterText?: string
-  class?: string
+  allowAuth?: boolean | undefined
+  endpoint?: string | undefined
+  passphraseLabel?: string | undefined
+  passphrasePlaceholder?: string | undefined
+  rememberMeLabel?: string | undefined
+  signInButtonLabel?: string | undefined
+  loadingButtonLabel?: string | undefined
+  returnLaterText?: string | undefined
+  class?: string | undefined
 }
 
 const {

package/src/config/index.ts

@@ -0,0 +1,2 @@
+export * from "../types"
+export * from "../csp"

package/src/csp.ts

@@ -0,0 +1,97 @@
+import type { SecurityOptions } from "./types"
+
+/**
+ * Builds the Content-Security-Policy header string dynamically for a given request nonce.
+ */
+export function buildCspHeader(options: SecurityOptions = {}, nonce?: string): string {
+  const domain = options.domain || ""
+
+  const imgSources = Array.from(
+    new Set([
+      "'self'",
+      "data:",
+      ...(domain ? [`https://cdn.${domain}`] : []),
+      "https://i3.ytimg.com",
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(options.imgSrc || [])
+    ])
+  )
+
+  const connectSources = Array.from(
+    new Set(["'self'", "https://cloudflareinsights.com", ...(options.connectSrc || [])])
+  )
+
+  const frameSources = Array.from(
+    new Set([
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(options.frameSrc || [])
+    ])
+  )
+
+  const scriptSources = Array.from(
+    new Set([
+      "'self'",
+      ...(nonce ? [`'nonce-${nonce}'`] : []),
+      "https://static.cloudflareinsights.com",
+      "https://betterlytics.io/analytics.js",
+      "'inline-speculation-rules'",
+      // Astro ClientRouter (View Transitions inline script sha)
+      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+      ...(options.scriptResources || [])
+    ])
+  )
+
+  const styleSources = Array.from(
+    new Set([
+      "'self'",
+      // Astro ClientRouter (View Transitions inline style sha)
+      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+      ...(options.styleResources || [])
+    ])
+  )
+
+  const defaultDirectives: Record<string, string[]> = {
+    "default-src": ["'none'"],
+    "img-src": imgSources,
+    "font-src": ["'self'"],
+    "connect-src": connectSources,
+    "frame-ancestors": ["'none'"],
+    "frame-src": frameSources,
+    "script-src": scriptSources,
+    "script-src-attr": ["'none'"],
+    "style-src": styleSources,
+    "base-uri": ["'self'"],
+    "form-action": ["'self'"],
+    "object-src": ["'none'"],
+    "manifest-src": ["'self'"],
+    "upgrade-insecure-requests": []
+  }
+
+  if (options.trustedTypes) {
+    defaultDirectives["require-trusted-types-for"] = ["'script'"]
+  }
+
+  // Merge custom directive overrides
+  if (options.directives) {
+    for (const [key, value] of Object.entries(options.directives)) {
+      if (value === false) {
+        delete defaultDirectives[key]
+      } else if (value === true) {
+        defaultDirectives[key] = []
+      } else if (Array.isArray(value)) {
+        defaultDirectives[key] = value
+      } else if (typeof value === "string") {
+        defaultDirectives[key] = value.split(" ").filter(Boolean)
+      }
+    }
+  }
+
+  return Object.entries(defaultDirectives)
+    .map(([directive, values]) => {
+      if (!values || values.length === 0) return directive
+      return `${directive} ${values.join(" ")}`
+    })
+    .join("; ")
+}

package/src/index.ts

@@ -0,0 +1,5 @@
+export * from "./vite"
+export * from "./types"
+export * from "./csp"
+export * from "./middleware/construction"
+export * from "./integration"

package/src/integration.ts

@@ -0,0 +1,51 @@
+import type { AstroIntegration } from "astro"
+import type { SecurityOptions, ConstructionOptions } from "./types"
+import { security } from "./vite"
+
+export interface RimelightSecurityOptions extends SecurityOptions {
+  /**
+   * Construction mode options & route injection settings
+   */
+  construction?: ConstructionOptions & {
+    /**
+     * Whether to automatically inject the construction page route. Defaults to true.
+     */
+    injectRoute?: boolean
+    /**
+     * Pattern to inject for the construction route. Defaults to "/[locale]/construction" or
+     * "/construction".
+     */
+    routePattern?: string
+  }
+}
+
+/**
+ * Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+ * automatically injects the construction mode page route.
+ */
+export function rimelightSecurity(options: RimelightSecurityOptions = {}): AstroIntegration {
+  return {
+    name: "@rimelight/security",
+    hooks: {
+      "astro:config:setup": ({ injectRoute, updateConfig }) => {
+        // 1. Inject Construction Page Route by default (unless explicitly disabled)
+        if (options.construction?.injectRoute !== false) {
+          const pattern = options.construction?.routePattern || "/[locale]/construction"
+          injectRoute({
+            pattern,
+            entrypoint: "@rimelight/security/pages/construction.astro"
+          })
+        }
+
+        // 2. Add Vite security plugin
+        updateConfig({
+          vite: {
+            plugins: [security(options)]
+          }
+        })
+      }
+    }
+  }
+}
+
+export default rimelightSecurity

package/src/layouts/ConstructionLayout.astro

@@ -0,0 +1,50 @@
+---
+import SecurityHead from "../components/SecurityHead.astro";
+import SEOHead from "@rimelight/seo/components/SEOHead.astro";
+import UIHead from "@rimelight/ui/components/head/UIHead.astro";
+import RLAMain from "@rimelight/ui/components/main/RLAMain.astro";
+import { siteConfig } from "virtual:rimelight/seo";
+import { Font } from "astro:assets";
+
+export interface Props {
+  title?: string | undefined;
+  description?: string | undefined;
+  favicon?: string | undefined;
+  noindex?: boolean | undefined;
+  class?: string | undefined;
+  bodyClass?: string | undefined;
+}
+
+const {
+  title = "Under Construction",
+  description = "This site is currently undergoing scheduled construction.",
+  favicon,
+  noindex = true,
+  class: className = "",
+  bodyClass = "isolate bg-black"
+} = Astro.props;
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <SecurityHead />
+    <SEOHead
+      title={title}
+      description={description}
+      config={siteConfig}
+      favicon={favicon}
+      noindex={noindex}
+    />
+    <UIHead />
+    <Font cssVariable="--font-sans" preload={true} />
+    <Font cssVariable="--font-serif" preload={true} />
+    <Font cssVariable="--font-mono" preload={true} />
+    <slot name="head" />
+  </head>
+  <body class={bodyClass}>
+    <RLAMain class={className}>
+      <slot />
+    </RLAMain>
+  </body>
+</html>