@rimelight/security 0.0.21 → 0.0.24

package/dist/middleware/construction.mjs

@@ -8,8 +8,14 @@ const DEFAULT_WHITELISTED_PATTERNS = [
 	"/_astro/",
 	"/_image",
 	"/favicon.",
+	"/apple-touch-icon",
+	"/site.webmanifest",
+	"manifest.json",
+	".webmanifest",
 	"/robots.txt",
 	"/sitemap",
+	"/rss.xml",
+	"/llms.txt",
 	"/.well-known/"
 ];
 const getPassphrase = (c, options) => {

package/dist/middleware/security.mjs

@@ -122,16 +122,7 @@ function security(options = {}) {
 			};
 			const reportOnlySimulation = {
 				...mergedOptions,
-				directives: {
-					...mergedOptions.directives,
-					"script-src-attr": ["'none'"],
-					"style-src": ["'self'", "'unsafe-inline'"],
-					"script-src": [
-						"'self'",
-						"'unsafe-inline'",
-						"'unsafe-eval'"
-					]
-				}
+				directives: { ...mergedOptions.directives }
 			};
 			c.res = applySecurityHeaders(response, {
 				...mergedOptions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.21",
+  "version": "0.0.24",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -50,13 +50,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@rimelight/i18n": "0.0.17",
-    "@rimelight/seo": "0.0.14",
-    "@rimelight/ui": "0.0.57"
+    "@rimelight/i18n": "0.0.20",
+    "@rimelight/seo": "0.0.17",
+    "@rimelight/ui": "0.0.60"
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.17",
+    "@rimelight/config": "0.0.20",
     "astro": "7.3.3",
     "hono": "4.13.8",
     "typescript": "6.0.3"
@@ -71,7 +71,7 @@
     }
   },
   "engines": {
-    "node": ">=26.8.2"
+    "node": ">=26.9.0"
   },
   "scripts": {
     "build": "vp pack",

package/src/components/SecurityHead.astro

@@ -1,166 +1,166 @@
----
-/**
- * SecurityHead — Security infrastructure scripts for CSP Nonce patching & Trusted Types.
- * Provided by @rimelight/security.
- */
----
-
-<!-- Trusted Types Policy -->
-<script>
-  (function() {
-    const w = window as any;
-    if (w.trustedTypes && w.trustedTypes.createPolicy) {
-      try {
-        if (!w.trustedTypes.defaultPolicy) {
-          w.trustedTypes.createPolicy('default', {
-            createHTML: function(input: string) { return input; },
-            createScript: function(input: string) { return input; },
-            createScriptURL: function(input: string) { return input; }
-          });
-        }
-      } catch {
-        // Policy already exists or cannot be created
-      }
-    }
-  })();
-</script>
-
-<!-- CSP Nonce Patching -->
-<script>
-  (function() {
-    const w = window as any;
-    const doc = document as any;
-    const elemProto = Element.prototype as any;
-
-    if (!w.initialCspNonce) {
-      w.initialCspNonce = document.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
-                          Array.from(document.querySelectorAll('script')).find(function(s: any) { return s.nonce; })?.nonce ||
-                          document.querySelector('script[nonce]')?.getAttribute('nonce') ||
-                          document.querySelector('style[nonce]')?.getAttribute('nonce');
-    }
-
-    var orig = doc.createElement;
-    doc.createElement = function(tag: string, opts?: ElementCreationOptions) {
-      var el = orig.call(document, tag, opts);
-      var lowTag = tag.toLowerCase();
-      if (lowTag === 'script' || lowTag === 'style') {
-        var nonce = w.initialCspNonce;
-        if (nonce) {
-          el.setAttribute('nonce', nonce);
-          el.nonce = nonce;
-        }
-      }
-      return el;
-    };
-
-    var origAppend = elemProto.appendChild;
-    elemProto.appendChild = function(child: any) {
-      if (child && (child.tagName === 'SCRIPT' || child.tagName === 'STYLE')) {
-        var nonce = w.initialCspNonce;
-        if (nonce && !child.getAttribute('nonce')) {
-          child.setAttribute('nonce', nonce);
-          child.nonce = nonce;
-        }
-      }
-      return origAppend.apply(this, [child]);
-    };
-
-    var origInsert = elemProto.insertBefore;
-    elemProto.insertBefore = function(newChild: any, refChild: any) {
-      if (newChild && (newChild.tagName === 'SCRIPT' || newChild.tagName === 'STYLE')) {
-        var nonce = w.initialCspNonce;
-        if (nonce && !newChild.getAttribute('nonce')) {
-          newChild.setAttribute('nonce', nonce);
-          newChild.nonce = nonce;
-        }
-      }
-      return origInsert.apply(this, [newChild, refChild]);
-    };
-
-    var origAppendMethod = elemProto.append;
-    if (origAppendMethod) {
-      elemProto.append = function(...nodes: (string | Node)[]) {
-        for (var i = 0; i < nodes.length; i++) {
-          var arg = nodes[i] as any;
-          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
-            var nonce = w.initialCspNonce;
-            if (nonce && !arg.getAttribute('nonce')) {
-              arg.setAttribute('nonce', nonce);
-              arg.nonce = nonce;
-            }
-          }
-        }
-        return origAppendMethod.apply(this, nodes);
-      };
-    }
-
-    var origPrependMethod = elemProto.prepend;
-    if (origPrependMethod) {
-      elemProto.prepend = function(...nodes: (string | Node)[]) {
-        for (var i = 0; i < nodes.length; i++) {
-          var arg = nodes[i] as any;
-          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
-            var nonce = w.initialCspNonce;
-            if (nonce && !arg.getAttribute('nonce')) {
-              arg.setAttribute('nonce', nonce);
-              arg.nonce = nonce;
-            }
-          }
-        }
-        return origPrependMethod.apply(this, nodes);
-      };
-    }
-
-    document.addEventListener('astro:before-swap', function(e: any) {
-      var incomingNonce =
-        e.newDocument?.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
-        Array.from((e.newDocument?.querySelectorAll('script[nonce]') || []) as any[]).find(function(s) { return s.getAttribute('nonce'); })?.getAttribute('nonce');
-      if (incomingNonce) {
-        w.initialCspNonce = incomingNonce;
-      }
-    });
-  })();
-</script>
-
-<!-- Development CSP Violation Reporter -->
-{import.meta.env.DEV && (
-  <script>
-    (function() {
-      // Ignore known internal dev-only tooling noise
-      function isDevInternal(e: SecurityPolicyViolationEvent): boolean {
-        const file = e.sourceFile || "";
-        const sample = e.sample || "";
-        const blockedUri = e.blockedURI || "";
-
-        if (file.includes("dev-toolbar") || file.includes("toolbar-") || file.includes("astro_runtime_client")) return true;
-        if (file.includes("vite/client") || file.includes("@vite/client") || file.includes("/@fs/") || file.includes("/@id/")) return true;
-        if (file.includes("node_modules/.vite") || file.includes("client:")) return true;
-        if (blockedUri.startsWith("ws://") || blockedUri.startsWith("wss://")) return true;
-        if (sample.includes("--astro-dev-toolbar") || sample.includes("astro-dev-toolbar")) return true;
-        return false;
-      }
-
-      const reported = new Set<string>();
-
-      window.addEventListener("securitypolicyviolation", function(e) {
-        if (e.disposition !== "report") return; // Only notify on report-only (prod violation simulation)
-        if (isDevInternal(e)) return;
-
-        const key = `${e.effectiveDirective}:${e.blockedURI || e.sample || ""}`;
-        if (reported.has(key)) return;
-        reported.add(key);
-
-        console.warn(
-          `%c[Rimelight Security]%c Allowed in DEV, but will fail in PRODUCTION:\n` +
-          `Directive: ${e.effectiveDirective}\n` +
-          (e.blockedURI ? `Blocked URI: ${e.blockedURI}\n` : "") +
-          (e.sourceFile ? `Source: ${e.sourceFile}:${e.lineNumber || 0}\n` : "") +
-          (e.sample ? `Sample: ${e.sample.slice(0, 100)}\n` : "") +
-          `Fix: Add to imgSrc, scriptResources, styleResources or use nonces in astro.config.ts`,
-          "background: #e11d48; color: white; padding: 2px 6px; border-radius: 4px; font-weight: bold;",
-          "color: inherit; font-weight: normal;"
-        );
-      });
-    })();
-  </script>
-)}
+---
+/**
+ * SecurityHead — Security infrastructure scripts for CSP Nonce patching & Trusted Types.
+ * Provided by @rimelight/security.
+ */
+---
+
+<!-- Trusted Types Policy -->
+<script>
+  (function() {
+    const w = window as any;
+    if (w.trustedTypes && w.trustedTypes.createPolicy) {
+      try {
+        if (!w.trustedTypes.defaultPolicy) {
+          w.trustedTypes.createPolicy('default', {
+            createHTML: function(input: string) { return input; },
+            createScript: function(input: string) { return input; },
+            createScriptURL: function(input: string) { return input; }
+          });
+        }
+      } catch {
+        // Policy already exists or cannot be created
+      }
+    }
+  })();
+</script>
+
+<!-- CSP Nonce Patching -->
+<script>
+  (function() {
+    const w = window as any;
+    const doc = document as any;
+    const elemProto = Element.prototype as any;
+
+    if (!w.initialCspNonce) {
+      w.initialCspNonce = document.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
+                          Array.from(document.querySelectorAll('script')).find(function(s: any) { return s.nonce; })?.nonce ||
+                          document.querySelector('script[nonce]')?.getAttribute('nonce') ||
+                          document.querySelector('style[nonce]')?.getAttribute('nonce');
+    }
+
+    var orig = doc.createElement;
+    doc.createElement = function(tag: string, opts?: ElementCreationOptions) {
+      var el = orig.call(document, tag, opts);
+      var lowTag = tag.toLowerCase();
+      if (lowTag === 'script' || lowTag === 'style') {
+        var nonce = w.initialCspNonce;
+        if (nonce) {
+          el.setAttribute('nonce', nonce);
+          el.nonce = nonce;
+        }
+      }
+      return el;
+    };
+
+    var origAppend = elemProto.appendChild;
+    elemProto.appendChild = function(child: any) {
+      if (child && (child.tagName === 'SCRIPT' || child.tagName === 'STYLE')) {
+        var nonce = w.initialCspNonce;
+        if (nonce && !child.getAttribute('nonce')) {
+          child.setAttribute('nonce', nonce);
+          child.nonce = nonce;
+        }
+      }
+      return origAppend.apply(this, [child]);
+    };
+
+    var origInsert = elemProto.insertBefore;
+    elemProto.insertBefore = function(newChild: any, refChild: any) {
+      if (newChild && (newChild.tagName === 'SCRIPT' || newChild.tagName === 'STYLE')) {
+        var nonce = w.initialCspNonce;
+        if (nonce && !newChild.getAttribute('nonce')) {
+          newChild.setAttribute('nonce', nonce);
+          newChild.nonce = nonce;
+        }
+      }
+      return origInsert.apply(this, [newChild, refChild]);
+    };
+
+    var origAppendMethod = elemProto.append;
+    if (origAppendMethod) {
+      elemProto.append = function(...nodes: (string | Node)[]) {
+        for (var i = 0; i < nodes.length; i++) {
+          var arg = nodes[i] as any;
+          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
+            var nonce = w.initialCspNonce;
+            if (nonce && !arg.getAttribute('nonce')) {
+              arg.setAttribute('nonce', nonce);
+              arg.nonce = nonce;
+            }
+          }
+        }
+        return origAppendMethod.apply(this, nodes);
+      };
+    }
+
+    var origPrependMethod = elemProto.prepend;
+    if (origPrependMethod) {
+      elemProto.prepend = function(...nodes: (string | Node)[]) {
+        for (var i = 0; i < nodes.length; i++) {
+          var arg = nodes[i] as any;
+          if (arg && (arg.tagName === 'SCRIPT' || arg.tagName === 'STYLE')) {
+            var nonce = w.initialCspNonce;
+            if (nonce && !arg.getAttribute('nonce')) {
+              arg.setAttribute('nonce', nonce);
+              arg.nonce = nonce;
+            }
+          }
+        }
+        return origPrependMethod.apply(this, nodes);
+      };
+    }
+
+    document.addEventListener('astro:before-swap', function(e: any) {
+      var incomingNonce =
+        e.newDocument?.querySelector('meta[name="csp-nonce"]')?.getAttribute('content') ||
+        Array.from((e.newDocument?.querySelectorAll('script[nonce]') || []) as any[]).find(function(s) { return s.getAttribute('nonce'); })?.getAttribute('nonce');
+      if (incomingNonce) {
+        w.initialCspNonce = incomingNonce;
+      }
+    });
+  })();
+</script>
+
+<!-- Development CSP Violation Reporter -->
+{import.meta.env.DEV && (
+  <script>
+    (function() {
+      // Ignore known internal dev-only tooling noise
+      function isDevInternal(e: SecurityPolicyViolationEvent): boolean {
+        const file = e.sourceFile || "";
+        const sample = e.sample || "";
+        const blockedUri = e.blockedURI || "";
+
+        if (file.includes("dev-toolbar") || file.includes("toolbar-") || file.includes("astro_runtime_client")) return true;
+        if (file.includes("vite/client") || file.includes("@vite/client") || file.includes("/@fs/") || file.includes("/@id/")) return true;
+        if (file.includes("node_modules/.vite") || file.includes("client:")) return true;
+        if (blockedUri.startsWith("ws://") || blockedUri.startsWith("wss://")) return true;
+        if (sample.includes("--astro-dev-toolbar") || sample.includes("astro-dev-toolbar")) return true;
+        return false;
+      }
+
+      const reported = new Set<string>();
+
+      window.addEventListener("securitypolicyviolation", function(e) {
+        if (e.disposition !== "report") return; // Only notify on report-only (prod violation simulation)
+        if (isDevInternal(e)) return;
+
+        const key = `${e.effectiveDirective}:${e.blockedURI || e.sample || ""}`;
+        if (reported.has(key)) return;
+        reported.add(key);
+
+        console.warn(
+          `%c[Rimelight Security]%c Allowed in DEV, but will fail in PRODUCTION:\n` +
+          `Directive: ${e.effectiveDirective}\n` +
+          (e.blockedURI ? `Blocked URI: ${e.blockedURI}\n` : "") +
+          (e.sourceFile ? `Source: ${e.sourceFile}:${e.lineNumber || 0}\n` : "") +
+          (e.sample ? `Sample: ${e.sample.slice(0, 100)}\n` : "") +
+          `Fix: Add to imgSrc, scriptResources, styleResources or use nonces in astro.config.ts`,
+          "background: #e11d48; color: white; padding: 2px 6px; border-radius: 4px; font-weight: bold;",
+          "color: inherit; font-weight: normal;"
+        );
+      });
+    })();
+  </script>
+)}

package/src/layouts/ConstructionLayout.astro

@@ -28,7 +28,6 @@ const {
 <!doctype html>
 <html lang="en">
   <head>
-    <SecurityHead />
     <SEOHead
       title={title}
       description={description}
@@ -36,6 +35,7 @@ const {
       favicon={favicon}
       noindex={noindex}
     />
+    <SecurityHead />
     <UIHead />
     <Font cssVariable="--font-sans" preload={true} />
     <Font cssVariable="--font-serif" preload={true} />

package/src/middleware/construction.ts

@@ -10,8 +10,14 @@ const DEFAULT_WHITELISTED_PATTERNS = [
   "/_astro/",
   "/_image",
   "/favicon.",
+  "/apple-touch-icon",
+  "/site.webmanifest",
+  "manifest.json",
+  ".webmanifest",
   "/robots.txt",
   "/sitemap",
+  "/rss.xml",
+  "/llms.txt",
   "/.well-known/"
 ]
 

package/src/middleware/security.ts

@@ -184,14 +184,12 @@ export function security(options: SecurityOptions = {}) {
         "img-src": ["'self'", "data:", "blob:", "https:", "http:"]
       }
 
-      // Prod simulation: check strict domain / asset permissions without tripping on Vite HMR inline CSS
+      // Prod simulation: check strict production directives in Report-Only mode
+      // so any violation that will break in production emits a warning in dev
       const reportOnlySimulation: SecurityOptions = {
         ...mergedOptions,
         directives: {
-          ...mergedOptions.directives,
-          "script-src-attr": ["'none'"],
-          "style-src": ["'self'", "'unsafe-inline'"],
-          "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"]
+          ...mergedOptions.directives
         }
       }