@rimelight/security 0.0.18 → 0.0.20

package/src/middleware/security.ts

@@ -0,0 +1,288 @@
+import type { SecurityOptions } from "../types"
+import { buildCspHeader } from "../csp"
+
+import { manifest as sriManifest } from "virtual:sri-manifest"
+import { config as pluginConfig } from "virtual:rimelight-security-config"
+
+function isManifestRecord(obj: unknown): obj is Record<string, string> {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
+}
+
+function isConfigRecord(obj: unknown): obj is SecurityOptions {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
+}
+
+const manifest: Record<string, string> = isManifestRecord(sriManifest) ? sriManifest : {}
+const defaultPluginConfig: SecurityOptions = isConfigRecord(pluginConfig) ? pluginConfig : {}
+
+declare const HTMLRewriter: any
+
+function applySecurityHeaders(
+  response: Response,
+  options: SecurityOptions,
+  origin?: string,
+  nonce?: string,
+  reportOnlyOptions?: SecurityOptions
+): Response {
+  const cspHeader = buildCspHeader(options, nonce)
+  const reportOnlyHeader = reportOnlyOptions
+    ? buildCspHeader(
+        {
+          ...reportOnlyOptions,
+          directives: { ...reportOnlyOptions.directives, "upgrade-insecure-requests": false }
+        },
+        nonce
+      )
+    : undefined
+
+  const headers = new Headers(response.headers)
+  headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
+  headers.set("X-Content-Type-Options", "nosniff")
+  headers.set("X-Frame-Options", "DENY")
+
+  if (options.crossOriginResourcePolicy !== false) {
+    headers.set(
+      "Cross-Origin-Resource-Policy",
+      typeof options.crossOriginResourcePolicy === "string"
+        ? options.crossOriginResourcePolicy
+        : "same-origin"
+    )
+  }
+
+  if (options.crossOriginOpenerPolicy !== false) {
+    headers.set(
+      "Cross-Origin-Opener-Policy",
+      typeof options.crossOriginOpenerPolicy === "string"
+        ? options.crossOriginOpenerPolicy
+        : "same-origin"
+    )
+  }
+
+  if (options.crossOriginEmbedderPolicy !== false) {
+    headers.set(
+      "Cross-Origin-Embedder-Policy",
+      typeof options.crossOriginEmbedderPolicy === "string"
+        ? options.crossOriginEmbedderPolicy
+        : "credentialless"
+    )
+  }
+
+  headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
+  headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
+  headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
+
+  if (cspHeader) {
+    headers.set("Content-Security-Policy", cspHeader)
+  }
+
+  if (reportOnlyHeader) {
+    headers.set("Content-Security-Policy-Report-Only", reportOnlyHeader)
+  }
+
+  if (origin) {
+    headers.set(
+      "Link",
+      [
+        `<${origin}/sitemap-index.xml>; rel="sitemap"`,
+        `<${origin}/llms.txt>; rel="llms"`,
+        `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+        `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+      ].join(", ")
+    )
+  }
+
+  if (options.headers) {
+    for (const [key, value] of Object.entries(options.headers)) {
+      headers.set(key, value)
+    }
+  }
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  })
+}
+
+/**
+ * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+ * CSP with per-request nonce, and SRI attributes.
+ */
+export function security(options: SecurityOptions = {}) {
+  const mergedOptions: SecurityOptions = {
+    ...defaultPluginConfig,
+    ...options,
+    allowedDomains: [
+      ...(defaultPluginConfig.allowedDomains || []),
+      ...(options.allowedDomains || [])
+    ],
+    imgSrc: [...(defaultPluginConfig.imgSrc || []), ...(options.imgSrc || [])],
+    connectSrc: [...(defaultPluginConfig.connectSrc || []), ...(options.connectSrc || [])],
+    frameSrc: [...(defaultPluginConfig.frameSrc || []), ...(options.frameSrc || [])],
+    scriptResources: [
+      ...(defaultPluginConfig.scriptResources || []),
+      ...(options.scriptResources || [])
+    ],
+    styleResources: [
+      ...(defaultPluginConfig.styleResources || []),
+      ...(options.styleResources || [])
+    ],
+    directives: {
+      ...defaultPluginConfig.directives,
+      ...options.directives
+    },
+    headers: {
+      ...defaultPluginConfig.headers,
+      ...options.headers
+    }
+  }
+
+  return async (c: any, next: any): Promise<Response | void> => {
+    const isProd = import.meta.env?.PROD ?? process.env["NODE_ENV"] === "production"
+    const isDev = import.meta.env?.DEV ?? process.env["NODE_ENV"] === "development"
+
+    const req = c.req?.raw || c.request || c.req
+    const proto = req?.headers?.get("x-forwarded-proto")
+    if (isProd && proto === "http" && req?.url) {
+      const httpsUrl = req.url.replace(/^http:/, "https:")
+      return Response.redirect(httpsUrl, 301)
+    }
+
+    await next()
+
+    const response: Response = c.res
+    if (!response) return
+
+    const contentType = response.headers.get("content-type") || ""
+    const origin = req?.url ? new URL(req.url).origin : undefined
+
+    // For non-HTML responses (e.g. JSON API, static images), apply headers only
+    if (!contentType.includes("text/html")) {
+      c.res = applySecurityHeaders(response, mergedOptions, origin)
+      return c.res
+    }
+
+    // In dev mode, keep active CSP relaxed for Vite/Toolbar.
+    // In Report-Only, enforce strict prod external origins (img-src, connect-src, frame-src)
+    // while permitting dev-internal inline styles/scripts so the browser doesn't spam for Vite HMR.
+    if (isDev) {
+      const devDirectives: Record<string, string[] | boolean> = {
+        ...mergedOptions.directives,
+        "default-src": false,
+        "script-src": [
+          "'self'",
+          "'unsafe-inline'",
+          "'unsafe-eval'",
+          "https:",
+          "http:",
+          "ws:",
+          "wss:"
+        ],
+        "script-src-attr": ["'unsafe-inline'"],
+        "style-src": ["'self'", "'unsafe-inline'", "https:", "http:"],
+        "connect-src": ["'self'", "ws:", "wss:", "http:", "https:"],
+        "img-src": ["'self'", "data:", "blob:", "https:", "http:"]
+      }
+
+      // Prod simulation: check strict domain / asset permissions without tripping on Vite HMR inline CSS
+      const reportOnlySimulation: SecurityOptions = {
+        ...mergedOptions,
+        directives: {
+          ...mergedOptions.directives,
+          "script-src-attr": ["'none'"],
+          "style-src": ["'self'", "'unsafe-inline'"],
+          "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"]
+        }
+      }
+
+      c.res = applySecurityHeaders(
+        response,
+        { ...mergedOptions, directives: devDirectives },
+        origin,
+        undefined,
+        reportOnlySimulation
+      )
+      return c.res
+    }
+
+    // Generate dynamic per-request nonce
+    const nonce = crypto.randomUUID().replace(/-/g, "")
+
+    // Use HTMLRewriter when available (Cloudflare Workers / Edge runtime)
+    if (typeof HTMLRewriter !== "undefined") {
+      let rewriter = new HTMLRewriter()
+
+      rewriter = rewriter
+        .on("script[src]", {
+          element(el: any) {
+            const src = el.getAttribute("src")
+            if (src && manifest[src]) {
+              el.setAttribute("integrity", manifest[src])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+        .on('link[rel="stylesheet"][href]', {
+          element(el: any) {
+            const href = el.getAttribute("href")
+            if (href && manifest[href]) {
+              el.setAttribute("integrity", manifest[href])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+        .on("script", {
+          element(el: any) {
+            el.setAttribute("nonce", nonce)
+          }
+        })
+        .on("head", {
+          element(el: any) {
+            el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true })
+          }
+        })
+
+      c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce)
+      return c.res
+    }
+
+    // Fallback path (Node / standard streams)
+    let modifiedHtml = await response.text()
+
+    modifiedHtml = modifiedHtml.replace(
+      /(<head(?:\s[^>]*)?>)/i,
+      `$1<meta name="csp-nonce" content="${nonce}">`
+    )
+
+    modifiedHtml = modifiedHtml.replace(
+      /<script(\s[^>]*)?>/gi,
+      (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`
+    )
+
+    for (const [url, hash] of Object.entries(manifest)) {
+      if (!hash) continue
+      const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g")
+      const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
+      modifiedHtml = modifiedHtml.replace(
+        scriptRegex,
+        `$1 integrity="${hash}" crossorigin="anonymous"$2`
+      )
+      modifiedHtml = modifiedHtml.replace(
+        linkRegex,
+        `$1 integrity="${hash}" crossorigin="anonymous"$2`
+      )
+    }
+
+    c.res = applySecurityHeaders(
+      new Response(modifiedHtml, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      }),
+      mergedOptions,
+      origin,
+      nonce
+    )
+    return c.res
+  }
+}

package/src/pages/construction.astro

@@ -0,0 +1,5 @@
+---
+import ConstructionPage from "../components/ConstructionPage.astro";
+---
+
+<ConstructionPage />

package/src/types.ts

@@ -0,0 +1,207 @@
+export interface SecurityOptions {
+  /**
+   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure standard
+   * allowed domains and img-src CDN targets.
+   */
+  domain?: string
+
+  /**
+   * Additional Allowed Domains for origin checking or cross-domain rules
+   */
+  allowedDomains?: string[]
+
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[]
+
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[]
+
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[]
+
+  /**
+   * Additional script resources / origins (e.g. "https://betterlytics.io")
+   */
+  scriptResources?: string[]
+
+  /**
+   * Additional style resources / origins
+   */
+  styleResources?: string[]
+
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean
+
+  /**
+   * Cross-Origin-Embedder-Policy header value. Allowed values: "require-corp", "credentialless",
+   * "unsafe-none" or false to disable. Defaults to "credentialless".
+   */
+  crossOriginEmbedderPolicy?:
+    | "require-corp"
+    | "credentialless"
+    | "unsafe-none"
+    | (string & {})
+    | false
+
+  /**
+   * Cross-Origin-Opener-Policy header value. Allowed values: "same-origin",
+   * "same-origin-allow-popups", "noopener-allow-popups", "unsafe-none" or false to disable.
+   * Defaults to "same-origin".
+   */
+  crossOriginOpenerPolicy?:
+    | "same-origin"
+    | "same-origin-allow-popups"
+    | "noopener-allow-popups"
+    | "unsafe-none"
+    | (string & {})
+    | false
+
+  /**
+   * Cross-Origin-Resource-Policy header value. Allowed values: "same-origin", "same-site",
+   * "cross-origin" or false to disable. Defaults to "same-origin".
+   */
+  crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin" | (string & {}) | false
+
+  /**
+   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.: {
+   * "frame-ancestors": ["'self'"] }
+   */
+  directives?: Record<string, string[] | string | boolean>
+
+  /**
+   * Custom headers to set on every response or overrides
+   */
+  headers?: Record<string, string>
+}
+
+export interface ConstructionOptions {
+  /**
+   * Environment variable key for construction mode flag ("true" | "false"). Defaults to
+   * "CONSTRUCTION_MODE".
+   */
+  modeEnvKey?: string
+
+  /**
+   * Environment variable key for the passphrase secret. Defaults to "CONSTRUCTION_PASSPHRASE".
+   */
+  passphraseEnvKey?: string
+
+  /**
+   * Explicit passphrase override (if not reading from env).
+   */
+  passphrase?: string
+
+  /**
+   * Cookie name used for guest authorization token. Defaults to "rimelight-construction-guest".
+   */
+  cookieName?: string
+
+  /**
+   * Cookie max age in seconds when "remember me" is enabled. Defaults to 7 days (604,800 seconds).
+   */
+  cookieMaxAge?: number
+
+  /**
+   * List of supported locales or custom resolver.
+   */
+  locales?: string[]
+
+  /**
+   * Custom locale extractor from request path.
+   */
+  getLocale?: (path: string) => string
+
+  /**
+   * Custom path for the construction page. Defaults to "/construction".
+   */
+  constructionPath?: string
+
+  /**
+   * API endpoint to automatically handle guest sign-in. Set to `false` to disable automatic API
+   * interception. Defaults to "/api/construction-guest".
+   */
+  apiPath?: string | false
+
+  /**
+   * Additional routes / prefixes to whitelist and skip gating.
+   */
+  whitelist?: (string | RegExp)[] | ((path: string) => boolean)
+
+  /**
+   * Custom authorization predicate. If returns true, request is allowed through. Defaults to
+   * checking `c.get("session") || await isConstructionGuest(c, options)`.
+   */
+  isAuthorized?: (c: any) => boolean | Promise<boolean>
+
+  /**
+   * Custom handler when unauthorized. Defaults to redirecting to
+   * `/${locale}/construction?redirect=${encodeURIComponent(path)}`.
+   */
+  onUnauthorized?: (
+    c: any,
+    meta: { locale: string; path: string; redirectUrl: string }
+  ) => Response | Promise<Response>
+}
+
+export interface RateLimiterBinding {
+  limit(options: { key: string }): Promise<{ success: boolean }>
+}
+
+export interface RateLimitOptions {
+  /**
+   * Name of the Cloudflare Rate Limiter binding on `c.env` / `env`.
+   *
+   * @default "MY_RATE_LIMITER"
+   */
+  bindingName?: string
+
+  /**
+   * Direct rate limiter instance or binding resolver.
+   */
+  limiter?: (c: any) => RateLimiterBinding | undefined
+
+  /**
+   * Routes / path prefixes or a custom predicate to check if the request should be rate limited.
+   * Can be an array of strings/RegExp or a matcher function `(c: any) => boolean`.
+   *
+   * @default ["/auth/sign-in", "/auth/sign-up", "/api/upload", "/api/chat"]
+   */
+  routes?: (string | RegExp)[] | ((c: any) => boolean)
+
+  /**
+   * Function to extract the rate limit key from the context (e.g., client IP, user ID, API key).
+   *
+   * @default c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown"
+   */
+  keyGenerator?: (c: any) => string | Promise<string>
+
+  /**
+   * Retry-After header value in seconds.
+   *
+   * @default 60
+   */
+  retryAfter?: number
+
+  /**
+   * Behavior when no rate limiter binding exists (e.g., in local development without mock binding).
+   *
+   * - "pass": Fail open (call `next()`)
+   * - "block": Fail closed (return 429/500)
+   *
+   * @default "pass"
+   */
+  fallback?: "pass" | "block"
+
+  /**
+   * Custom handler when the rate limit is exceeded.
+   */
+  onRateLimited?: (c: any, retryAfter: number) => Response | Promise<Response>
+}

package/src/virtual.d.ts

@@ -0,0 +1,16 @@
+declare module "virtual:rimelight-security-config" {
+  export const config: import("./types").SecurityOptions
+}
+
+declare module "virtual:sri-manifest" {
+  export const manifest: Record<string, string>
+}
+
+declare module "virtual:rimelight/seo" {
+  export const siteConfig: Record<string, any>
+  export const SEO_LOCALES: Array<{ code: string; label?: string; [key: string]: any }> | undefined
+  export const PRIVATE_PATH_PREFIXES: string[] | undefined
+  export const seoConfig: Record<string, any>
+  const defaultExport: Record<string, any>
+  export default defaultExport
+}

package/src/vite.ts

@@ -0,0 +1,114 @@
+import { createHash } from "node:crypto"
+
+import type { SecurityOptions } from "./types"
+
+export interface RimelightSecurityPlugin {
+  name: string
+  enforce?: "pre" | "post"
+  resolveId?: (id: string) => string | null | undefined
+  load?: (id: string) => string | null | undefined
+  buildStart?: () => Promise<void> | void
+  generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void
+  [key: string]: any
+}
+
+export interface SecurityPluginOptions extends SecurityOptions {
+  /**
+   * Additional external script/style URLs to fetch and hash for SRI at build time.
+   */
+  resources?: string[]
+}
+
+const DEFAULT_RESOURCES = ["https://betterlytics.io/analytics.js"]
+
+function hashContent(buffer: Buffer | ArrayBuffer | Uint8Array | string): string {
+  const hash = createHash("sha384")
+    .update(buffer as any)
+    .digest("base64")
+  return `sha384-${hash}`
+}
+
+/**
+ * Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
+ * etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
+ * scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
+ * (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+ */
+export function security(options: SecurityPluginOptions = {}): RimelightSecurityPlugin {
+  const sriManifest: Record<string, string> = {}
+  const externalUrls = Array.from(new Set([...DEFAULT_RESOURCES, ...(options.resources || [])]))
+
+  const sriVirtualId = "virtual:sri-manifest"
+  const resolvedSriVirtualId = "\0" + sriVirtualId
+
+  const configVirtualId = "virtual:rimelight-security-config"
+  const resolvedConfigVirtualId = "\0" + configVirtualId
+
+  return {
+    name: "vite-plugin-rimelight-security",
+    enforce: "post",
+
+    async buildStart() {
+      // 1. Fetch & Hash External Resources (3rd-party SRI)
+      if (process.env["NODE_ENV"] === "development") return
+
+      await Promise.all(
+        externalUrls.map(async (url) => {
+          if (!url.startsWith("https://")) return
+          try {
+            const parsed = new URL(url)
+            if (parsed.hostname.includes("*")) return
+            const pathname = parsed.pathname
+            if (pathname === "/" || pathname === "" || pathname.endsWith("/")) return
+
+            const response = await fetch(url)
+            if (!response.ok) return
+            const buffer = await response.arrayBuffer()
+            sriManifest[url] = hashContent(buffer)
+          } catch {
+            // Silently ignore unreachable external resources during build
+          }
+        })
+      )
+    },
+
+    generateBundle(_outputOptions, bundle) {
+      // 2. Hash Emitted Bundle Chunks & Assets (1st-party SRI)
+      for (const [fileName, chunk] of Object.entries(bundle)) {
+        if (!fileName.endsWith(".js") && !fileName.endsWith(".css")) continue
+
+        let content: string | Uint8Array | undefined
+        if (chunk.type === "chunk") {
+          content = chunk.code
+        } else if (chunk.type === "asset") {
+          content = chunk.source
+        }
+
+        if (content) {
+          const hash = hashContent(content)
+          // Store both absolute leading slash path and relative file name
+          sriManifest[`/${fileName.replace(/^\/+/, "")}`] = hash
+          sriManifest[fileName] = hash
+        }
+      }
+    },
+
+    resolveId(id: string) {
+      if (id === sriVirtualId) return resolvedSriVirtualId
+      if (id === configVirtualId) return resolvedConfigVirtualId
+      return null
+    },
+
+    load(id: string) {
+      if (id === resolvedSriVirtualId) {
+        return `export const manifest = ${JSON.stringify(sriManifest)};`
+      }
+      if (id === resolvedConfigVirtualId) {
+        return `export const config = ${JSON.stringify(options)};`
+      }
+      return null
+    }
+  }
+}
+
+export { security as sri }