@rimelight/security 0.0.2 → 0.0.4

package/README.md

@@ -0,0 +1,19 @@
+# Rimelight Entertainment Workspace
+
+## Structure
+
+### Apps (`/packages`)
+
+- **`rimelight.com`**: The main company website.
+- **`starter.rimelight.com`**: Our standardized starter template for Astro websites.
+
+### Packages (`/packages`)
+
+- **`@rimelight/auth`**: Authentication and authorization utilities for the Rimelight ecosystem.
+- **`@rimelight/cli`**: The command line interface for managing Rimelight projects.
+- **`@rimelight/cms`**: Enterprise content management, block rendering, and wiki engine.
+- **`@rimelight/docs`**: Documentation components and utilities.
+- **`@rimelight/i18n`**: Internationalization and localization tools.
+- **`@rimelight/security`**: Astro security integration (CSP, SRI, and more).
+- **`@rimelight/seo`**: SEO utilities including sitemap, robots, and meta components.
+- **`@rimelight/ui`**: Our component library used in all our web projects.

package/package.json

@@ -1,8 +1,23 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "private": false,
-  "description": "Rimelight Entertainment Security Middleware and Utilities.",
+  "description": "Rimelight Entertainment's Security Package",
+  "homepage": "https://rimelight.com/docs",
+  "bugs": {
+    "url": "https://github.com/Rimelight-Entertainment/rimelight/issues"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Rimelight Entertainment"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Rimelight-Entertainment/rimelight.git"
+  },
+  "files": [
+    "src"
+  ],
   "type": "module",
   "exports": {
     ".": "./src/integrations/index.ts",
@@ -13,12 +28,20 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "check": "pnpm audit --audit-level=moderate && vp check --fix && astro check"
+  },
   "devDependencies": {
-    "astro": "7.1.0",
+    "@astrojs/check": "0.9.10",
+    "@rimelight/config": "workspace:*",
+    "astro": "7.2.2",
     "typescript": "6.0.3"
   },
   "peerDependencies": {
-    "astro": ">=7.0.1"
+    "astro": ">=7.0.0"
+  },
+  "engines": {
+    "node": ">=26.7.0"
   },
-  "packageManager": "pnpm@11.9.0"
+  "packageManager": "pnpm@11.22.0"
 }

package/src/components/SecurityHead.astro

@@ -0,0 +1,117 @@
+---
+/**
+ * SecurityHead — Security infrastructure scripts for CSP Nonce patching & Trusted Types.
+ * Provided by @rimelight/security.
+ */
+---
+
+<!-- Trusted Types Policy -->
+<script>
+  (function() {
+    const w = window as any;
+    if (w.trustedTypes && w.trustedTypes.createPolicy) {
+      w.trustedTypes.createPolicy('default', {
+        createHTML: function(input: string) { return input; },
+        createScript: function(input: string) { return input; },
+        createScriptURL: function(input: string) { return input; }
+      });
+    }
+  })();
+</script>
+
+<!-- CSP Nonce Patching -->
+<script>
+  (function() {
+    const w = window as any;
+    const doc = document as any;
+    const elemProto = Element.prototype as any;
+
+    if (!w.initialCspNonce) {
+      w.initialCspNonce = document.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
+                          Array.from(document.querySelectorAll('script')).find(function(s: any) { return s.nonce; })?.nonce ||
+                          document.querySelector('script[nonce]')?.getAttribute('nonce') ||
+                          document.querySelector('style[nonce]')?.getAttribute('nonce');
+    }
+
+    var orig = doc.createElement;
+    doc.createElement = function(tag: string, opts?: ElementCreationOptions) {
+      var el = orig.call(document, tag, opts);
+      var lowTag = tag.toLowerCase();
+      if (lowTag === 'script' || lowTag === 'style') {
+        var nonce = w.initialCspNonce;
+        if (nonce) {
+          el.setAttribute('nonce', nonce);
+          el.nonce = nonce;
+        }
+      }
+      return el;
+    };
+
+    var origAppend = elemProto.appendChild;
+    elemProto.appendChild = function(child: any) {
+      if (child && (child.tagName === 'SCRIPT' || child.tagName === 'STYLE')) {
+        var nonce = w.initialCspNonce;
+        if (nonce && !child.getAttribute('nonce')) {
+          child.setAttribute('nonce', nonce);
+          child.nonce = nonce;
+        }
+      }
+      return origAppend.apply(this, [child]);
+    };
+
+    var origInsert = elemProto.insertBefore;
+    elemProto.insertBefore = function(newChild: any, refChild: any) {
+      if (newChild && (newChild.tagName === 'SCRIPT' || newChild.tagName === 'STYLE')) {
+        var nonce = w.initialCspNonce;
+        if (nonce && !newChild.getAttribute('nonce')) {
+          newChild.setAttribute('nonce', nonce);
+          newChild.nonce = nonce;
+        }
+      }
+      return origInsert.apply(this, [newChild, refChild]);
+    };
+
+    var origAppendMethod = elemProto.append;
+    if (origAppendMethod) {
+      elemProto.append = function(...nodes: (string | Node)[]) {
+        for (var i = 0; i < nodes.length; i++) {
+          var arg = nodes[i] as any;
+          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
+            var nonce = w.initialCspNonce;
+            if (nonce && !arg.getAttribute('nonce')) {
+              arg.setAttribute('nonce', nonce);
+              arg.nonce = nonce;
+            }
+          }
+        }
+        return origAppendMethod.apply(this, nodes);
+      };
+    }
+
+    var origPrependMethod = elemProto.prepend;
+    if (origPrependMethod) {
+      elemProto.prepend = function(...nodes: (string | Node)[]) {
+        for (var i = 0; i < nodes.length; i++) {
+          var arg = nodes[i] as any;
+          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
+            var nonce = w.initialCspNonce;
+            if (nonce && !arg.getAttribute('nonce')) {
+              arg.setAttribute('nonce', nonce);
+              arg.nonce = nonce;
+            }
+          }
+        }
+        return origPrependMethod.apply(this, nodes);
+      };
+    }
+
+    document.addEventListener('astro:before-swap', function(e: any) {
+      var incomingNonce =
+        e.newDocument?.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
+        Array.from((e.newDocument?.querySelectorAll('script[nonce]') || []) as any[]).find(function(s) { return s.getAttribute('nonce'); })?.getAttribute('nonce');
+      if (incomingNonce) {
+        w.initialCspNonce = incomingNonce;
+      }
+    });
+  })();
+</script>

package/src/middleware/dev-only.ts

@@ -0,0 +1,16 @@
+/**
+ * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+ * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+ * routes and `/api/dev/` API routes in a single place.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { devOnly } from "@rimelight/security/middleware"
+ *   app.use(devOnly)
+ */
+export const devOnly = async (c: any, next: any): Promise<Response> => {
+  if (!import.meta.env.DEV && c.req.path.includes("/dev/")) {
+    return c.notFound()
+  }
+  return next()
+}

package/src/middleware/index.ts

@@ -1 +1,2 @@
 export * from "./security"
+export * from "./dev-only"

package/src/middleware/security.ts

@@ -1,6 +1,14 @@
+import type { APIContext, MiddlewareNext } from "astro"
 import { defineMiddleware } from "astro:middleware"
-// @ts-ignore - virtual module generated by the SRI integration
-import { manifest } from "virtual:sri-manifest"
+
+// @ts-ignore virtual module resolved by SRI Vite plugin
+import { manifest as sriManifest } from "virtual:sri-manifest"
+
+function isManifestRecord(obj: unknown): obj is Record<string, string> {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
+}
+
+const manifest: Record<string, string> = isManifestRecord(sriManifest) ? sriManifest : {}
 
 declare const HTMLRewriter: any
 
@@ -78,9 +86,12 @@ function addSecurityHeaders(response: Response, origin?: string): Response {
 /**
  * Security Middleware: Injects SRI integrity attributes and security headers.
  */
-export const security = defineMiddleware(async (context, next) => {
-  // HTTP to HTTPS redirect only in production
-  if (import.meta.env.PROD && context.request.url.startsWith("http://")) {
+export const security = defineMiddleware(async (context: APIContext, next: MiddlewareNext) => {
+  // HTTP to HTTPS redirect only in production based on x-forwarded-proto
+  const isProd = import.meta.env.PROD
+  const isDev = import.meta.env.DEV
+  const proto = context.request.headers.get("x-forwarded-proto")
+  if (isProd && proto === "http") {
     const httpsUrl = context.request.url.replace(/^http:/, "https:")
     return Response.redirect(httpsUrl, 301)
   }
@@ -93,7 +104,7 @@ export const security = defineMiddleware(async (context, next) => {
     return addSecurityHeaders(response, context.url.origin)
   }
 
-  if (import.meta.env.DEV) {
+  if (isDev) {
     const cleanHeaders = new Headers(response.headers)
     cleanHeaders.delete("content-security-policy")
     let modifiedHtml = await response.text()
@@ -111,6 +122,11 @@ export const security = defineMiddleware(async (context, next) => {
     )
   }
 
+  // Generate a per-request nonce. Cloudflare reads 'nonce-*' from the CSP header and
+  // automatically applies it to any scripts it injects (e.g. challenge-platform).
+  // The nonce is also stamped on every <script> tag so Astro's own scripts still load.
+  const nonce = crypto.randomUUID().replace(/-/g, "")
+
   let cspHeader = response.headers.get("content-security-policy")
   const newHeaders = new Headers(response.headers)
 
@@ -121,24 +137,11 @@ export const security = defineMiddleware(async (context, next) => {
       .replace(/&#x0*27;/gi, "'")
       .replace(/&quot;/g, '"')
       .replace(/&amp;/g, "&")
-    newHeaders.set("content-security-policy", cspHeader)
-  }
 
-  const nonceValue = cspHeader ? crypto.randomUUID().replace(/-/g, "") : null
+    // Inject the nonce into script-src (additive alongside existing hashes)
+    cspHeader = cspHeader.replace(/(script-src\s)/i, `$1'nonce-${nonce}' `)
 
-  if (cspHeader && nonceValue) {
-    let newCsp = cspHeader
-    if (newCsp.includes("script-src ")) {
-      newCsp = newCsp.replace("script-src ", `script-src 'nonce-${nonceValue}' `)
-    } else {
-      newCsp = newCsp + `; script-src 'nonce-${nonceValue}'`
-    }
-    if (newCsp.includes("style-src ")) {
-      newCsp = newCsp.replace("style-src ", `style-src 'nonce-${nonceValue}' `)
-    } else {
-      newCsp = newCsp + `; style-src 'nonce-${nonceValue}'`
-    }
-    newHeaders.set("content-security-policy", newCsp)
+    newHeaders.set("content-security-policy", cspHeader)
   }
 
   if (typeof HTMLRewriter !== "undefined") {
@@ -167,33 +170,27 @@ export const security = defineMiddleware(async (context, next) => {
         })
     }
 
+    // Stamp nonce on every <script> tag so Astro's own scripts are still allowed
+    rewriter = rewriter.on("script", {
+      element(el: any) {
+        el.setAttribute("nonce", nonce)
+      }
+    })
+
+    // Inject a <meta name="csp-nonce"> so client JS can reliably read the
+    // current page's nonce (especially after View Transition navigations).
+    rewriter = rewriter.on("head", {
+      element(el: any) {
+        el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true })
+      }
+    })
+
     rewriter = rewriter.on('meta[http-equiv="content-security-policy" i]', {
       element(el: any) {
         el.remove()
       }
     })
 
-    if (nonceValue) {
-      rewriter = rewriter
-        .on("head", {
-          element(el: any) {
-            el.append(`<meta name="csp-nonce" content="${nonceValue}">`, { html: true })
-          }
-        })
-        .on("script", {
-          element(el: any) {
-            if (!el.getAttribute("nonce")) {
-              el.setAttribute("nonce", nonceValue)
-            }
-          }
-        })
-        .on("style", {
-          element(el: any) {
-            el.setAttribute("nonce", nonceValue)
-          }
-        })
-    }
-
     return addSecurityHeaders(
       rewriter.transform(
         new Response(response.body, {
@@ -214,6 +211,19 @@ export const security = defineMiddleware(async (context, next) => {
     ""
   )
 
+  // Inject a <meta name="csp-nonce"> into <head> so client JS can reliably
+  // read the current page's nonce after View Transition navigations.
+  modifiedHtml = modifiedHtml.replace(
+    /(<head(?:\s[^>]*)?>)/i,
+    `$1<meta name="csp-nonce" content="${nonce}">`
+  )
+
+  // Stamp nonce on every <script> tag (regex fallback path)
+  modifiedHtml = modifiedHtml.replace(
+    /<script(\s[^>]*)?>/gi,
+    (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`
+  )
+
   // Use pre-compiled regexes
   for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
     if (!hash) continue
@@ -229,21 +239,6 @@ export const security = defineMiddleware(async (context, next) => {
     )
   }
 
-  if (nonceValue) {
-    modifiedHtml = modifiedHtml.replace(
-      /<head([^>]*)>/i,
-      `<head$1>\n<meta name="csp-nonce" content="${nonceValue}">`
-    )
-    modifiedHtml = modifiedHtml.replace(
-      /<script(?![^>]*nonce=)([^>]*)>/gi,
-      `<script$1 nonce="${nonceValue}">`
-    )
-    modifiedHtml = modifiedHtml.replace(
-      /<style(?![^>]*nonce=)([^>]*)>/gi,
-      `<style$1 nonce="${nonceValue}">`
-    )
-  }
-
   return addSecurityHeaders(
     new Response(modifiedHtml, {
       status: response.status,

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Rimelight Entertainment
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/src/env.d.ts

@@ -1,5 +0,0 @@
-/// <reference types="astro/client" />
-
-declare module "virtual:sri-manifest" {
-  export const manifest: Record<string, string>
-}

package/tsconfig.json

@@ -1,17 +0,0 @@
-{
-  "extends": "astro/tsconfigs/strictest",
-  "include": [".astro/types.d.ts", "**/*"],
-  "exclude": ["dist"],
-  "compilerOptions": {
-    "plugins": [
-      {
-        "name": "@astrojs/ts-plugin"
-      }
-    ],
-    "paths": {
-      "@/*": ["./src/*"]
-    },
-    "allowArbitraryExtensions": true,
-    "jsx": "preserve"
-  }
-}