@rimelight/ui 0.0.36 → 0.0.37

package/src/config/security.ts

@@ -1,227 +0,0 @@
-import type { AstroUserConfig } from "astro"
-
-export type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>
-export type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>
-
-export interface SecurityConfigOptions {
-  /**
-   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
-   * standard allowedDomains and img-src CDN targets.
-   */
-  domain: string
-  /**
-   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
-   */
-  allowedDomains?: AstroSecurityConfig["allowedDomains"]
-  /**
-   * Additional sources to allow for img-src directive
-   */
-  imgSrc?: string[]
-  /**
-   * Additional sources to allow for connect-src directive
-   */
-  connectSrc?: string[]
-  /**
-   * Additional sources to allow for frame-src directive
-   */
-  frameSrc?: string[]
-  /**
-   * Additional script resources
-   */
-  scriptResources?: string[]
-  /**
-   * Additional style resources
-   */
-  styleResources?: string[]
-  /**
-   * Enables the 'require-trusted-types-for' directive
-   */
-  trustedTypes?: boolean
-  /**
-   * Direct overrides for any security config fields
-   */
-  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
-    csp?: Partial<AstroCspConfig>
-  }
-}
-
-/**
- * Generates a standard, strictly configured Security/CSP object for Astro configurations with
- * support for easy customization and additions per project.
- *
- * @example
- *   ;```ts
- *   // Default returned shape:
- *   {
- *   checkOrigin: true,
- *   allowedDomains: [
- *   {
- *   hostname: "**.domain.com",
- *   protocol: "https"
- *   }
- *   ],
- *   csp: {
- *   algorithm: "SHA-384",
- *   directives: [
- *   "default-src 'none'",
- *   "img-src 'self' data: https://cdn.domain.com https://i3.ytimg.com https://www.youtube.com https://www.youtube-nocookie.com",
- *   "font-src 'self'",
- *   "connect-src 'self' https://cloudflareinsights.com",
- *   "frame-ancestors 'none'",
- *   "frame-src https://www.youtube.com https://www.youtube-nocookie.com",
- *   "upgrade-insecure-requests",
- *   "base-uri 'self'",
- *   "form-action 'self'"
- *   ],
- *   scriptDirective: {
- *   resources: [
- *   "'self'",
- *   "https://static.cloudflareinsights.com",
- *   "https://betterlytics.io/analytics.js",
- *   "'inline-speculation-rules'"
- *   ]
- *   },
- *   styleDirective: {
- *   resources: [
- *   "'self'",
- *   "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='"
- *   ]
- *   }
- *   }
- *   }
- *   ```
- */
-export function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig {
-  const { domain, overrides } = options
-  const domainWithWildcard = `**.${domain}`
-
-  // 1. Build default allowed domains
-  const allowedDomains = [
-    {
-      hostname: domainWithWildcard,
-      protocol: "https" as const
-    },
-    ...(options.allowedDomains || [])
-  ]
-
-  // 2. Build CSP directives
-  const imgSources = Array.from(
-    new Set([
-      "'self'",
-      "data:",
-      `https://cdn.${domain}`,
-      "https://i3.ytimg.com",
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.imgSrc || [])
-    ])
-  )
-
-  const connectSources = Array.from(
-    new Set(["'self'", "https://cloudflareinsights.com", ...(options.connectSrc || [])])
-  )
-
-  const frameSources = Array.from(
-    new Set([
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.frameSrc || [])
-    ])
-  )
-
-  const baseDirectives: AstroCspConfig["directives"] = [
-    "default-src 'none'",
-    `img-src ${imgSources.join(" ")}`,
-    "font-src 'self'",
-    `connect-src ${connectSources.join(" ")}`,
-    "frame-ancestors 'none'",
-    `frame-src ${frameSources.join(" ")}`,
-    "upgrade-insecure-requests",
-    "base-uri 'self'",
-    "form-action 'self'",
-    "object-src 'none'",
-    "manifest-src 'self'",
-    ...(options.trustedTypes ? ["require-trusted-types-for 'script'" as const] : [])
-  ]
-
-  // 3. Build script & style directives
-  const scriptResources = Array.from(
-    new Set([
-      "'self'",
-      "https://static.cloudflareinsights.com",
-      "https://betterlytics.io/analytics.js",
-      "'inline-speculation-rules'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
-      ...(options.scriptResources || [])
-    ])
-  )
-
-  const styleResources = Array.from(
-    new Set([
-      "'self'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
-      ...(options.styleResources || [])
-    ])
-  )
-
-  // 4. Build base SecurityConfig
-  const securityConfig: AstroSecurityConfig = {
-    checkOrigin: true,
-    allowedDomains,
-    csp: {
-      algorithm: "SHA-384",
-      directives: baseDirectives,
-      scriptDirective: {
-        resources: scriptResources
-      },
-      styleDirective: {
-        resources: styleResources
-      }
-    }
-  }
-
-  // 5. Merge overrides
-  if (overrides) {
-    const { csp, ...restOverrides } = overrides
-    Object.assign(securityConfig, restOverrides)
-    if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
-      const currentCsp = securityConfig.csp
-      const mergedCsp: AstroCspConfig = {
-        ...currentCsp,
-        ...csp
-      }
-
-      if (csp.scriptDirective || currentCsp.scriptDirective) {
-        mergedCsp.scriptDirective = {
-          ...currentCsp.scriptDirective,
-          ...csp.scriptDirective,
-          resources: Array.from(
-            new Set([
-              ...(currentCsp.scriptDirective?.resources || []),
-              ...(csp.scriptDirective?.resources || [])
-            ])
-          )
-        }
-      }
-
-      if (csp.styleDirective || currentCsp.styleDirective) {
-        mergedCsp.styleDirective = {
-          ...currentCsp.styleDirective,
-          ...csp.styleDirective,
-          resources: Array.from(
-            new Set([
-              ...(currentCsp.styleDirective?.resources || []),
-              ...(csp.styleDirective?.resources || [])
-            ])
-          )
-        }
-      }
-
-      securityConfig.csp = mergedCsp
-    }
-  }
-
-  return securityConfig
-}

package/src/integrations/sri.ts

@@ -1,92 +0,0 @@
-import type { AstroIntegration } from "astro"
-import { createHash } from "node:crypto"
-
-interface SRIConfig {
-  security?: {
-    csp?: {
-      scriptDirective?: {
-        resources?: string[]
-      }
-    }
-  }
-}
-
-function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
-  if (!obj || typeof obj !== "object") throw new Error("Expected config")
-}
-
-/**
- * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
- * middleware.
- */
-export function sri(): AstroIntegration {
-  const sriManifest: Record<string, string> = {}
-
-  return {
-    name: "sri",
-    hooks: {
-      "astro:config:setup": async ({ updateConfig, config, logger }) => {
-        logger.info("Initializing SRI Discovery...")
-
-        // 1. Identify External Scripts from CSP config
-        // We look into the custom 'security' block in astro.config.mjs
-        assertSRIConfig(config)
-
-        const security = config.security
-        const externalUrls: string[] = []
-
-        if (security?.csp?.scriptDirective?.resources) {
-          for (const resource of security.csp.scriptDirective.resources) {
-            if (resource.startsWith("https://")) {
-              externalUrls.push(resource)
-            }
-          }
-        }
-
-        // 2. Fetch and Hash External Scripts
-        await Promise.all(
-          externalUrls.map(async (url) => {
-            try {
-              logger.info(`Fetching ${url} for SRI hashing...`)
-              const response = await fetch(url)
-              if (!response.ok) throw new Error(`HTTP ${response.status}`)
-
-              const buffer = await response.arrayBuffer()
-              const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
-
-              sriManifest[url] = `sha384-${hash}`
-              logger.info(`Successfully hashed ${url}`)
-            } catch (err: unknown) {
-              const message = err instanceof Error ? err.message : String(err)
-              logger.error(`Failed to fetch SRI for ${url}: ${message}`)
-            }
-          })
-        )
-
-        // 3. Provide hashes to the runtime via Vite's virtual module
-        const virtualModuleId = "virtual:sri-manifest"
-        const resolvedVirtualModuleId = "\0" + virtualModuleId
-
-        updateConfig({
-          vite: {
-            plugins: [
-              {
-                name: "vite-plugin-sri-manifest",
-                resolveId(id: string) {
-                  if (id === virtualModuleId) return resolvedVirtualModuleId
-                  return null
-                },
-                load(id: string) {
-                  if (id === resolvedVirtualModuleId) {
-                    return `export const manifest = ${JSON.stringify(sriManifest)};`
-                  }
-                  return null
-                }
-              }
-            ]
-          }
-        })
-      }
-    }
-  }
-}

package/src/middleware/index.ts

@@ -1 +0,0 @@
-export * from "./security"

package/src/middleware/security.ts

@@ -1,210 +0,0 @@
-import { defineMiddleware } from "astro:middleware"
-// @ts-ignore - virtual module generated by the SRI integration
-import { manifest } from "virtual:sri-manifest"
-
-declare const HTMLRewriter: any
-
-function assertManifest(obj: unknown): asserts obj is Record<string, string> {
-  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
-}
-
-function addSecurityHeaders(response: Response, origin?: string): Response {
-  const headers = new Headers(response.headers)
-  headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
-  headers.set("X-Content-Type-Options", "nosniff")
-  headers.set("X-Frame-Options", "DENY")
-  headers.set("Cross-Origin-Resource-Policy", "same-origin")
-  headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
-  headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()")
-  if (origin) {
-    headers.set(
-      "Link",
-      [
-        `<${origin}/sitemap-index.xml>; rel="sitemap"`,
-        `<${origin}/llms.txt>; rel="llms"`,
-        `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-        `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-      ].join(", ")
-    )
-  }
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  })
-}
-
-/**
- * Security Middleware: Injects SRI integrity attributes and security headers.
- */
-export const security = defineMiddleware(async (context, next) => {
-  // HTTP to HTTPS redirect only in production
-  if (import.meta.env.PROD && context.request.url.startsWith("http://")) {
-    const httpsUrl = context.request.url.replace(/^http:/, "https:")
-    return Response.redirect(httpsUrl, 301)
-  }
-
-  const response = await next()
-  const contentType = response.headers.get("content-type") || ""
-
-  if (import.meta.env.DEV) {
-    if (!contentType.includes("text/html")) {
-      return addSecurityHeaders(response, context.url.origin)
-    }
-    const cleanHeaders = new Headers(response.headers)
-    cleanHeaders.delete("content-security-policy")
-    let modifiedHtml = await response.text()
-    modifiedHtml = modifiedHtml.replace(
-      /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-      ""
-    )
-    return addSecurityHeaders(
-      new Response(modifiedHtml, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: cleanHeaders
-      }),
-      context.url.origin
-    )
-  }
-
-  let cspHeader = response.headers.get("content-security-policy")
-  const newHeaders = new Headers(response.headers)
-
-  if (cspHeader) {
-    // Unescape HTML entities (like &#39; or &#x27; to ') that Astro's native CSP generation mistakenly puts in the header
-    cspHeader = cspHeader
-      .replace(/&#0*39;/g, "'")
-      .replace(/&#x0*27;/gi, "'")
-      .replace(/&quot;/g, '"')
-      .replace(/&amp;/g, "&")
-    newHeaders.set("content-security-policy", cspHeader)
-  }
-
-  const nonceValue = cspHeader ? crypto.randomUUID().replace(/-/g, "") : null
-
-  if (cspHeader && nonceValue) {
-    let newCsp = cspHeader
-    if (newCsp.includes("script-src ")) {
-      newCsp = newCsp.replace("script-src ", `script-src 'nonce-${nonceValue}' `)
-    } else {
-      newCsp = newCsp + `; script-src 'nonce-${nonceValue}'`
-    }
-    if (newCsp.includes("style-src ")) {
-      newCsp = newCsp.replace("style-src ", `style-src 'nonce-${nonceValue}' `)
-    } else {
-      newCsp = newCsp + `; style-src 'nonce-${nonceValue}'`
-    }
-    newHeaders.set("content-security-policy", newCsp)
-  }
-
-  if (typeof HTMLRewriter !== "undefined") {
-    let rewriter = new HTMLRewriter()
-      .on("script[src]", {
-        element(el: any) {
-          const src = el.getAttribute("src")
-          if (src && manifest[src]) {
-            el.setAttribute("integrity", manifest[src])
-            el.setAttribute("crossorigin", "anonymous")
-          }
-        }
-      })
-      .on('link[rel="stylesheet"][href]', {
-        element(el: any) {
-          const href = el.getAttribute("href")
-          if (href && manifest[href]) {
-            el.setAttribute("integrity", manifest[href])
-            el.setAttribute("crossorigin", "anonymous")
-          }
-        }
-      })
-      .on('meta[http-equiv="content-security-policy" i]', {
-        element(el: any) {
-          el.remove()
-        }
-      })
-
-    if (nonceValue) {
-      rewriter = rewriter
-        .on("head", {
-          element(el: any) {
-            el.append(`<meta name="csp-nonce" content="${nonceValue}">`, { html: true })
-          }
-        })
-        .on("script", {
-          element(el: any) {
-            if (!el.getAttribute("nonce")) {
-              el.setAttribute("nonce", nonceValue)
-            }
-          }
-        })
-        .on("style", {
-          element(el: any) {
-            el.setAttribute("nonce", nonceValue)
-          }
-        })
-    }
-
-    return addSecurityHeaders(
-      rewriter.transform(
-        new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: newHeaders
-        })
-      ),
-      context.url.origin
-    )
-  }
-
-  let modifiedHtml = await response.text()
-
-  // Remove Astro-injected CSP meta tag to prevent duplicate CSP headers and HTML escaping errors
-  modifiedHtml = modifiedHtml.replace(
-    /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-    ""
-  )
-
-  assertManifest(manifest)
-
-  const entries = Object.entries(manifest)
-  for (const [url, hash] of entries) {
-    if (!hash) continue
-
-    const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g")
-    modifiedHtml = modifiedHtml.replace(
-      scriptRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-
-    const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
-    modifiedHtml = modifiedHtml.replace(
-      linkRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-  }
-
-  if (nonceValue) {
-    modifiedHtml = modifiedHtml.replace(
-      /<head([^>]*)>/i,
-      `<head$1>\n<meta name="csp-nonce" content="${nonceValue}">`
-    )
-    modifiedHtml = modifiedHtml.replace(
-      /<script(?![^>]*nonce=)([^>]*)>/gi,
-      `<script$1 nonce="${nonceValue}">`
-    )
-    modifiedHtml = modifiedHtml.replace(
-      /<style(?![^>]*nonce=)([^>]*)>/gi,
-      `<style$1 nonce="${nonceValue}">`
-    )
-  }
-
-  return addSecurityHeaders(
-    new Response(modifiedHtml, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: newHeaders
-    }),
-    context.url.origin
-  )
-})