@rimelight/security 0.0.19 → 0.0.21

package/src/middleware/security.ts

@@ -0,0 +1,288 @@
+import type { SecurityOptions } from "../types"
+import { buildCspHeader } from "../csp"
+
+import { manifest as sriManifest } from "virtual:sri-manifest"
+import { config as pluginConfig } from "virtual:rimelight-security-config"
+
+function isManifestRecord(obj: unknown): obj is Record<string, string> {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
+}
+
+function isConfigRecord(obj: unknown): obj is SecurityOptions {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
+}
+
+const manifest: Record<string, string> = isManifestRecord(sriManifest) ? sriManifest : {}
+const defaultPluginConfig: SecurityOptions = isConfigRecord(pluginConfig) ? pluginConfig : {}
+
+declare const HTMLRewriter: any
+
+function applySecurityHeaders(
+  response: Response,
+  options: SecurityOptions,
+  origin?: string,
+  nonce?: string,
+  reportOnlyOptions?: SecurityOptions
+): Response {
+  const cspHeader = buildCspHeader(options, nonce)
+  const reportOnlyHeader = reportOnlyOptions
+    ? buildCspHeader(
+        {
+          ...reportOnlyOptions,
+          directives: { ...reportOnlyOptions.directives, "upgrade-insecure-requests": false }
+        },
+        nonce
+      )
+    : undefined
+
+  const headers = new Headers(response.headers)
+  headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
+  headers.set("X-Content-Type-Options", "nosniff")
+  headers.set("X-Frame-Options", "DENY")
+
+  if (options.crossOriginResourcePolicy !== false) {
+    headers.set(
+      "Cross-Origin-Resource-Policy",
+      typeof options.crossOriginResourcePolicy === "string"
+        ? options.crossOriginResourcePolicy
+        : "same-origin"
+    )
+  }
+
+  if (options.crossOriginOpenerPolicy !== false) {
+    headers.set(
+      "Cross-Origin-Opener-Policy",
+      typeof options.crossOriginOpenerPolicy === "string"
+        ? options.crossOriginOpenerPolicy
+        : "same-origin"
+    )
+  }
+
+  if (options.crossOriginEmbedderPolicy !== false) {
+    headers.set(
+      "Cross-Origin-Embedder-Policy",
+      typeof options.crossOriginEmbedderPolicy === "string"
+        ? options.crossOriginEmbedderPolicy
+        : "credentialless"
+    )
+  }
+
+  headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
+  headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
+  headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
+
+  if (cspHeader) {
+    headers.set("Content-Security-Policy", cspHeader)
+  }
+
+  if (reportOnlyHeader) {
+    headers.set("Content-Security-Policy-Report-Only", reportOnlyHeader)
+  }
+
+  if (origin) {
+    headers.set(
+      "Link",
+      [
+        `<${origin}/sitemap-index.xml>; rel="sitemap"`,
+        `<${origin}/llms.txt>; rel="llms"`,
+        `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+        `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+      ].join(", ")
+    )
+  }
+
+  if (options.headers) {
+    for (const [key, value] of Object.entries(options.headers)) {
+      headers.set(key, value)
+    }
+  }
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  })
+}
+
+/**
+ * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+ * CSP with per-request nonce, and SRI attributes.
+ */
+export function security(options: SecurityOptions = {}) {
+  const mergedOptions: SecurityOptions = {
+    ...defaultPluginConfig,
+    ...options,
+    allowedDomains: [
+      ...(defaultPluginConfig.allowedDomains || []),
+      ...(options.allowedDomains || [])
+    ],
+    imgSrc: [...(defaultPluginConfig.imgSrc || []), ...(options.imgSrc || [])],
+    connectSrc: [...(defaultPluginConfig.connectSrc || []), ...(options.connectSrc || [])],
+    frameSrc: [...(defaultPluginConfig.frameSrc || []), ...(options.frameSrc || [])],
+    scriptResources: [
+      ...(defaultPluginConfig.scriptResources || []),
+      ...(options.scriptResources || [])
+    ],
+    styleResources: [
+      ...(defaultPluginConfig.styleResources || []),
+      ...(options.styleResources || [])
+    ],
+    directives: {
+      ...defaultPluginConfig.directives,
+      ...options.directives
+    },
+    headers: {
+      ...defaultPluginConfig.headers,
+      ...options.headers
+    }
+  }
+
+  return async (c: any, next: any): Promise<Response | void> => {
+    const isProd = import.meta.env?.PROD ?? process.env["NODE_ENV"] === "production"
+    const isDev = import.meta.env?.DEV ?? process.env["NODE_ENV"] === "development"
+
+    const req = c.req?.raw || c.request || c.req
+    const proto = req?.headers?.get("x-forwarded-proto")
+    if (isProd && proto === "http" && req?.url) {
+      const httpsUrl = req.url.replace(/^http:/, "https:")
+      return Response.redirect(httpsUrl, 301)
+    }
+
+    await next()
+
+    const response: Response = c.res
+    if (!response) return
+
+    const contentType = response.headers.get("content-type") || ""
+    const origin = req?.url ? new URL(req.url).origin : undefined
+
+    // For non-HTML responses (e.g. JSON API, static images), apply headers only
+    if (!contentType.includes("text/html")) {
+      c.res = applySecurityHeaders(response, mergedOptions, origin)
+      return c.res
+    }
+
+    // In dev mode, keep active CSP relaxed for Vite/Toolbar.
+    // In Report-Only, enforce strict prod external origins (img-src, connect-src, frame-src)
+    // while permitting dev-internal inline styles/scripts so the browser doesn't spam for Vite HMR.
+    if (isDev) {
+      const devDirectives: Record<string, string[] | boolean> = {
+        ...mergedOptions.directives,
+        "default-src": false,
+        "script-src": [
+          "'self'",
+          "'unsafe-inline'",
+          "'unsafe-eval'",
+          "https:",
+          "http:",
+          "ws:",
+          "wss:"
+        ],
+        "script-src-attr": ["'unsafe-inline'"],
+        "style-src": ["'self'", "'unsafe-inline'", "https:", "http:"],
+        "connect-src": ["'self'", "ws:", "wss:", "http:", "https:"],
+        "img-src": ["'self'", "data:", "blob:", "https:", "http:"]
+      }
+
+      // Prod simulation: check strict domain / asset permissions without tripping on Vite HMR inline CSS
+      const reportOnlySimulation: SecurityOptions = {
+        ...mergedOptions,
+        directives: {
+          ...mergedOptions.directives,
+          "script-src-attr": ["'none'"],
+          "style-src": ["'self'", "'unsafe-inline'"],
+          "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"]
+        }
+      }
+
+      c.res = applySecurityHeaders(
+        response,
+        { ...mergedOptions, directives: devDirectives },
+        origin,
+        undefined,
+        reportOnlySimulation
+      )
+      return c.res
+    }
+
+    // Generate dynamic per-request nonce
+    const nonce = crypto.randomUUID().replace(/-/g, "")
+
+    // Use HTMLRewriter when available (Cloudflare Workers / Edge runtime)
+    if (typeof HTMLRewriter !== "undefined") {
+      let rewriter = new HTMLRewriter()
+
+      rewriter = rewriter
+        .on("script[src]", {
+          element(el: any) {
+            const src = el.getAttribute("src")
+            if (src && manifest[src]) {
+              el.setAttribute("integrity", manifest[src])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+        .on('link[rel="stylesheet"][href]', {
+          element(el: any) {
+            const href = el.getAttribute("href")
+            if (href && manifest[href]) {
+              el.setAttribute("integrity", manifest[href])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+        .on("script", {
+          element(el: any) {
+            el.setAttribute("nonce", nonce)
+          }
+        })
+        .on("head", {
+          element(el: any) {
+            el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true })
+          }
+        })
+
+      c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce)
+      return c.res
+    }
+
+    // Fallback path (Node / standard streams)
+    let modifiedHtml = await response.text()
+
+    modifiedHtml = modifiedHtml.replace(
+      /(<head(?:\s[^>]*)?>)/i,
+      `$1<meta name="csp-nonce" content="${nonce}">`
+    )
+
+    modifiedHtml = modifiedHtml.replace(
+      /<script(\s[^>]*)?>/gi,
+      (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`
+    )
+
+    for (const [url, hash] of Object.entries(manifest)) {
+      if (!hash) continue
+      const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g")
+      const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
+      modifiedHtml = modifiedHtml.replace(
+        scriptRegex,
+        `$1 integrity="${hash}" crossorigin="anonymous"$2`
+      )
+      modifiedHtml = modifiedHtml.replace(
+        linkRegex,
+        `$1 integrity="${hash}" crossorigin="anonymous"$2`
+      )
+    }
+
+    c.res = applySecurityHeaders(
+      new Response(modifiedHtml, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      }),
+      mergedOptions,
+      origin,
+      nonce
+    )
+    return c.res
+  }
+}

package/src/pages/construction.astro

@@ -0,0 +1,5 @@
+---
+import ConstructionPage from "../components/ConstructionPage.astro";
+---
+
+<ConstructionPage />

package/src/turnstile.ts

@@ -0,0 +1,172 @@
+export interface TurnstileVerifyOptions {
+  /**
+   * The response token provided by the Turnstile client-side widget (e.g. `cf-turnstile-response`).
+   */
+  token?: string | null | undefined
+
+  /**
+   * The secret key for Turnstile verification. Can be passed directly or read from `env`.
+   */
+  secretKey?: string | undefined
+
+  /**
+   * The Cloudflare environment or process environment object containing TURNSTILE_SECRET_KEY /
+   * TURNSTILE_SITE_KEY.
+   */
+  env?: any
+
+  /**
+   * The client's IP address (e.g. from `CF-Connecting-IP` or `Astro.clientAddress`).
+   */
+  remoteIp?: string | undefined
+
+  /**
+   * Whether to fail open (succeed) if keys are not configured or during network errors. Defaults to
+   * `true` (safe for local development).
+   */
+  failOpen?: boolean | undefined
+
+  /**
+   * Custom verify endpoint URL. Defaults to
+   * `https://challenges.cloudflare.com/turnstile/v0/siteverify`.
+   */
+  endpoint?: string | undefined
+}
+
+export interface TurnstileVerifyResult {
+  success: boolean
+  error?: string | undefined
+  errorCodes?: string[] | undefined
+}
+
+interface CloudflareVerifyResponse {
+  "success": boolean
+  "error-codes"?: string[]
+  "challenge_ts"?: string
+  "hostname"?: string
+  "action"?: string
+  "cdata"?: string
+}
+
+/**
+ * Checks if Turnstile keys are present in the provided environment or `process.env`.
+ */
+export function isTurnstileEnabled(env?: any): boolean {
+  const siteKey =
+    env?.TURNSTILE_SITE_KEY ||
+    (typeof process !== "undefined" ? process.env?.["TURNSTILE_SITE_KEY"] : undefined)
+
+  const secretKey =
+    env?.TURNSTILE_SECRET_KEY ||
+    (typeof process !== "undefined" ? process.env?.["TURNSTILE_SECRET_KEY"] : undefined)
+
+  return Boolean(siteKey && secretKey)
+}
+
+/**
+ * Resolves the Turnstile secret key from options or environment.
+ */
+export function getTurnstileSecretKey(options: TurnstileVerifyOptions): string | undefined {
+  if (options.secretKey) return options.secretKey
+  const env = options.env
+  return (
+    env?.TURNSTILE_SECRET_KEY ||
+    (typeof process !== "undefined" ? process.env?.["TURNSTILE_SECRET_KEY"] : undefined)
+  )
+}
+
+/**
+ * Resolves the Turnstile site key from environment or process.env.
+ */
+export function getTurnstileSiteKey(env?: any): string | undefined {
+  return (
+    env?.TURNSTILE_SITE_KEY ||
+    (typeof process !== "undefined" ? process.env?.["TURNSTILE_SITE_KEY"] : undefined)
+  )
+}
+
+/**
+ * Verifies a Cloudflare Turnstile token on the server. Supports both options object and classic
+ * signature `(token, env, remoteIp)`.
+ */
+export async function verifyTurnstile(
+  tokenOrOptions: string | null | undefined | TurnstileVerifyOptions,
+  legacyEnv?: any,
+  legacyRemoteIp?: string
+): Promise<TurnstileVerifyResult> {
+  const options: TurnstileVerifyOptions =
+    typeof tokenOrOptions === "object" && tokenOrOptions !== null
+      ? tokenOrOptions
+      : {
+          token: tokenOrOptions,
+          env: legacyEnv,
+          remoteIp: legacyRemoteIp
+        }
+
+  const failOpen = options.failOpen ?? true
+  const token = options.token
+
+  // If Turnstile is not enabled (missing keys in env and no explicit secretKey), fail open for local dev
+  const secretKey = getTurnstileSecretKey(options)
+  if (!secretKey) {
+    if (failOpen) {
+      console.log(
+        "[Turnstile] Keys missing or not configured. Skipping verification (Failing Open for local dev)."
+      )
+      return { success: true }
+    }
+    return { success: false, error: "Turnstile secret key is not configured." }
+  }
+
+  if (!token) {
+    return { success: false, error: "Security check token is missing." }
+  }
+
+  try {
+    const endpoint = options.endpoint || "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        secret: secretKey,
+        response: token,
+        remoteip: options.remoteIp
+      })
+    })
+
+    if (!response.ok) {
+      if (failOpen) {
+        console.error(`[Turnstile] API returned status ${response.status}. Failing open.`)
+        return { success: true }
+      }
+      return {
+        success: false,
+        error: `Cloudflare Turnstile API returned status ${response.status}`
+      }
+    }
+
+    const data: CloudflareVerifyResponse = await response.json()
+    if (data.success) {
+      return { success: true }
+    }
+
+    const codes = data["error-codes"] || []
+    let msg = "Bot check verification failed."
+    if (codes.includes("timeout-or-duplicate")) {
+      msg = "Verification token expired or already used. Please refresh the security check."
+    } else if (codes.includes("invalid-input-response")) {
+      msg = "Invalid verification response. Please try again."
+    }
+
+    return { success: false, error: msg, errorCodes: codes }
+  } catch (err: any) {
+    console.error("[Turnstile Exception]", err)
+    if (failOpen) {
+      return { success: true }
+    }
+    return {
+      success: false,
+      error: err?.message || "Turnstile verification encountered an exception."
+    }
+  }
+}

package/src/types.ts

@@ -0,0 +1,213 @@
+export interface SecurityOptions {
+  /**
+   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure standard
+   * allowed domains and img-src CDN targets.
+   */
+  domain?: string
+
+  /**
+   * Additional Allowed Domains for origin checking or cross-domain rules
+   */
+  allowedDomains?: string[]
+
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[]
+
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[]
+
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[]
+
+  /**
+   * Additional script resources / origins (e.g. "https://betterlytics.io")
+   */
+  scriptResources?: string[]
+
+  /**
+   * Additional style resources / origins
+   */
+  styleResources?: string[]
+
+  /**
+   * Enables Cloudflare Turnstile CSP allowances (challenges.cloudflare.com in script-src,
+   * frame-src, connect-src). Defaults to true.
+   */
+  turnstile?: boolean
+
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean
+
+  /**
+   * Cross-Origin-Embedder-Policy header value. Allowed values: "require-corp", "credentialless",
+   * "unsafe-none" or false to disable. Defaults to "credentialless".
+   */
+  crossOriginEmbedderPolicy?:
+    | "require-corp"
+    | "credentialless"
+    | "unsafe-none"
+    | (string & {})
+    | false
+
+  /**
+   * Cross-Origin-Opener-Policy header value. Allowed values: "same-origin",
+   * "same-origin-allow-popups", "noopener-allow-popups", "unsafe-none" or false to disable.
+   * Defaults to "same-origin".
+   */
+  crossOriginOpenerPolicy?:
+    | "same-origin"
+    | "same-origin-allow-popups"
+    | "noopener-allow-popups"
+    | "unsafe-none"
+    | (string & {})
+    | false
+
+  /**
+   * Cross-Origin-Resource-Policy header value. Allowed values: "same-origin", "same-site",
+   * "cross-origin" or false to disable. Defaults to "same-origin".
+   */
+  crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin" | (string & {}) | false
+
+  /**
+   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.: {
+   * "frame-ancestors": ["'self'"] }
+   */
+  directives?: Record<string, string[] | string | boolean>
+
+  /**
+   * Custom headers to set on every response or overrides
+   */
+  headers?: Record<string, string>
+}
+
+export interface ConstructionOptions {
+  /**
+   * Environment variable key for construction mode flag ("true" | "false"). Defaults to
+   * "CONSTRUCTION_MODE".
+   */
+  modeEnvKey?: string
+
+  /**
+   * Environment variable key for the passphrase secret. Defaults to "CONSTRUCTION_PASSPHRASE".
+   */
+  passphraseEnvKey?: string
+
+  /**
+   * Explicit passphrase override (if not reading from env).
+   */
+  passphrase?: string
+
+  /**
+   * Cookie name used for guest authorization token. Defaults to "rimelight-construction-guest".
+   */
+  cookieName?: string
+
+  /**
+   * Cookie max age in seconds when "remember me" is enabled. Defaults to 7 days (604,800 seconds).
+   */
+  cookieMaxAge?: number
+
+  /**
+   * List of supported locales or custom resolver.
+   */
+  locales?: string[]
+
+  /**
+   * Custom locale extractor from request path.
+   */
+  getLocale?: (path: string) => string
+
+  /**
+   * Custom path for the construction page. Defaults to "/construction".
+   */
+  constructionPath?: string
+
+  /**
+   * API endpoint to automatically handle guest sign-in. Set to `false` to disable automatic API
+   * interception. Defaults to "/api/construction-guest".
+   */
+  apiPath?: string | false
+
+  /**
+   * Additional routes / prefixes to whitelist and skip gating.
+   */
+  whitelist?: (string | RegExp)[] | ((path: string) => boolean)
+
+  /**
+   * Custom authorization predicate. If returns true, request is allowed through. Defaults to
+   * checking `c.get("session") || await isConstructionGuest(c, options)`.
+   */
+  isAuthorized?: (c: any) => boolean | Promise<boolean>
+
+  /**
+   * Custom handler when unauthorized. Defaults to redirecting to
+   * `/${locale}/construction?redirect=${encodeURIComponent(path)}`.
+   */
+  onUnauthorized?: (
+    c: any,
+    meta: { locale: string; path: string; redirectUrl: string }
+  ) => Response | Promise<Response>
+}
+
+export interface RateLimiterBinding {
+  limit(options: { key: string }): Promise<{ success: boolean }>
+}
+
+export interface RateLimitOptions {
+  /**
+   * Name of the Cloudflare Rate Limiter binding on `c.env` / `env`.
+   *
+   * @default "MY_RATE_LIMITER"
+   */
+  bindingName?: string
+
+  /**
+   * Direct rate limiter instance or binding resolver.
+   */
+  limiter?: (c: any) => RateLimiterBinding | undefined
+
+  /**
+   * Routes / path prefixes or a custom predicate to check if the request should be rate limited.
+   * Can be an array of strings/RegExp or a matcher function `(c: any) => boolean`.
+   *
+   * @default ["/auth/sign-in", "/auth/sign-up", "/api/upload", "/api/chat"]
+   */
+  routes?: (string | RegExp)[] | ((c: any) => boolean)
+
+  /**
+   * Function to extract the rate limit key from the context (e.g., client IP, user ID, API key).
+   *
+   * @default c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown"
+   */
+  keyGenerator?: (c: any) => string | Promise<string>
+
+  /**
+   * Retry-After header value in seconds.
+   *
+   * @default 60
+   */
+  retryAfter?: number
+
+  /**
+   * Behavior when no rate limiter binding exists (e.g., in local development without mock binding).
+   *
+   * - "pass": Fail open (call `next()`)
+   * - "block": Fail closed (return 429/500)
+   *
+   * @default "pass"
+   */
+  fallback?: "pass" | "block"
+
+  /**
+   * Custom handler when the rate limit is exceeded.
+   */
+  onRateLimited?: (c: any, retryAfter: number) => Response | Promise<Response>
+}

package/src/virtual.d.ts

@@ -0,0 +1,16 @@
+declare module "virtual:rimelight-security-config" {
+  export const config: import("./types").SecurityOptions
+}
+
+declare module "virtual:sri-manifest" {
+  export const manifest: Record<string, string>
+}
+
+declare module "virtual:rimelight/seo" {
+  export const siteConfig: Record<string, any>
+  export const SEO_LOCALES: Array<{ code: string; label?: string; [key: string]: any }> | undefined
+  export const PRIVATE_PATH_PREFIXES: string[] | undefined
+  export const seoConfig: Record<string, any>
+  const defaultExport: Record<string, any>
+  export default defaultExport
+}