@rimelight/security 0.0.21 → 0.0.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/middleware/construction.mjs +6 -0
  2. package/dist/middleware/security.mjs +1 -10
  3. package/package.json +6 -6
  4. package/src/layouts/ConstructionLayout.astro +1 -1
  5. package/src/middleware/construction.ts +6 -0
  6. package/src/middleware/security.ts +3 -5
package/dist/middleware/construction.mjs CHANGED
@@ -8,8 +8,14 @@ const DEFAULT_WHITELISTED_PATTERNS = [
8
8
  "/_astro/",
9
9
  "/_image",
10
10
  "/favicon.",
11
+ "/apple-touch-icon",
12
+ "/site.webmanifest",
13
+ "manifest.json",
14
+ ".webmanifest",
11
15
  "/robots.txt",
12
16
  "/sitemap",
17
+ "/rss.xml",
18
+ "/llms.txt",
13
19
  "/.well-known/"
14
20
  ];
15
21
  const getPassphrase = (c, options) => {
package/dist/middleware/security.mjs CHANGED
@@ -122,16 +122,7 @@ function security(options = {}) {
122
122
  };
123
123
  const reportOnlySimulation = {
124
124
  ...mergedOptions,
125
- directives: {
126
- ...mergedOptions.directives,
127
- "script-src-attr": ["'none'"],
128
- "style-src": ["'self'", "'unsafe-inline'"],
129
- "script-src": [
130
- "'self'",
131
- "'unsafe-inline'",
132
- "'unsafe-eval'"
133
- ]
134
- }
125
+ directives: { ...mergedOptions.directives }
135
126
  };
136
127
  c.res = applySecurityHeaders(response, {
137
128
  ...mergedOptions,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@rimelight/security",
3
- "version": "0.0.21",
3
+ "version": "0.0.22",
4
4
  "private": false,
5
5
  "description": "Rimelight Entertainment's Security Package",
6
6
  "homepage": "https://rimelight.com/docs",
@@ -50,13 +50,13 @@
50
50
  "access": "public"
51
51
  },
52
52
  "dependencies": {
53
- "@rimelight/i18n": "0.0.17",
54
- "@rimelight/seo": "0.0.14",
55
- "@rimelight/ui": "0.0.57"
53
+ "@rimelight/i18n": "0.0.18",
54
+ "@rimelight/seo": "0.0.15",
55
+ "@rimelight/ui": "0.0.58"
56
56
  },
57
57
  "devDependencies": {
58
58
  "@astrojs/check": "0.9.10",
59
- "@rimelight/config": "0.0.17",
59
+ "@rimelight/config": "0.0.18",
60
60
  "astro": "7.3.3",
61
61
  "hono": "4.13.8",
62
62
  "typescript": "6.0.3"
@@ -71,7 +71,7 @@
71
71
  }
72
72
  },
73
73
  "engines": {
74
- "node": ">=26.8.2"
74
+ "node": ">=26.9.0"
75
75
  },
76
76
  "scripts": {
77
77
  "build": "vp pack",
package/src/layouts/ConstructionLayout.astro CHANGED
@@ -28,7 +28,6 @@ const {
28
28
  <!doctype html>
29
29
  <html lang="en">
30
30
  <head>
31
- <SecurityHead />
32
31
  <SEOHead
33
32
  title={title}
34
33
  description={description}
@@ -36,6 +35,7 @@ const {
36
35
  favicon={favicon}
37
36
  noindex={noindex}
38
37
  />
38
+ <SecurityHead />
39
39
  <UIHead />
40
40
  <Font cssVariable="--font-sans" preload={true} />
41
41
  <Font cssVariable="--font-serif" preload={true} />
package/src/middleware/construction.ts CHANGED
@@ -10,8 +10,14 @@ const DEFAULT_WHITELISTED_PATTERNS = [
10
10
  "/_astro/",
11
11
  "/_image",
12
12
  "/favicon.",
13
+ "/apple-touch-icon",
14
+ "/site.webmanifest",
15
+ "manifest.json",
16
+ ".webmanifest",
13
17
  "/robots.txt",
14
18
  "/sitemap",
19
+ "/rss.xml",
20
+ "/llms.txt",
15
21
  "/.well-known/"
16
22
  ]
17
23
 
package/src/middleware/security.ts CHANGED
@@ -184,14 +184,12 @@ export function security(options: SecurityOptions = {}) {
184
184
  "img-src": ["'self'", "data:", "blob:", "https:", "http:"]
185
185
  }
186
186
 
187
- // Prod simulation: check strict domain / asset permissions without tripping on Vite HMR inline CSS
187
+ // Prod simulation: check strict production directives in Report-Only mode
188
+ // so any violation that will break in production emits a warning in dev
188
189
  const reportOnlySimulation: SecurityOptions = {
189
190
  ...mergedOptions,
190
191
  directives: {
191
- ...mergedOptions.directives,
192
- "script-src-attr": ["'none'"],
193
- "style-src": ["'self'", "'unsafe-inline'"],
194
- "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"]
192
+ ...mergedOptions.directives
195
193
  }
196
194
  }
197
195