@salesforce/pwa-kit-runtime 3.2.0 → 3.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/pwa-kit-runtime",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "The PWAKit Runtime",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/pwa-kit-runtime#readme",
   "bugs": {
@@ -46,11 +46,11 @@
   },
   "devDependencies": {
     "@loadable/component": "^5.15.3",
-    "@salesforce/pwa-kit-dev": "3.2.0",
+    "@salesforce/pwa-kit-dev": "3.2.1",
     "@serverless/event-mocks": "^1.1.1",
     "aws-lambda-mock-context": "^3.2.1",
     "fs-extra": "^11.1.1",
-    "internal-lib-build": "3.2.0",
+    "internal-lib-build": "3.2.1",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
     "sinon": "^13.0.2",
@@ -58,7 +58,7 @@
     "supertest": "^4.0.2"
   },
   "peerDependencies": {
-    "@salesforce/pwa-kit-dev": "3.2.0"
+    "@salesforce/pwa-kit-dev": "3.2.1"
   },
   "peerDependenciesMeta": {
     "@salesforce/pwa-kit-dev": {
@@ -72,5 +72,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "5ec74f88e7bf9ba10a2f86f22a137311ee9bf1b9"
+  "gitHead": "2c8502478dc9f571f57042565d3d5938e46336a2"
 }

package/ssr/server/build-remote-server.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.once = exports.enforceSecurityHeaders = exports.RemoteServerFactory = exports.REMOTE_REQUIRED_ENV_VARS = void 0;
+exports.once = exports.RemoteServerFactory = exports.REMOTE_REQUIRED_ENV_VARS = void 0;
 var _path = _interopRequireDefault(require("path"));
 var _constants = require("./constants");
 var _ssrServer = require("../../utils/ssr-server");
@@ -523,7 +523,6 @@ const RemoteServerFactory = {
 
     // Apply the SSR middleware to any subsequent routes that we expect users
     // to add in their projects, like in any regular Express app.
-    app.use(enforceSecurityHeaders); // Must be AFTER prepNonProxyRequest, as they both modify setHeader.
     app.use(ssrMiddleware);
     app.use(errorHandlerMiddleware);
     applyPatches(options);
@@ -805,102 +804,6 @@ const RemoteServerFactory = {
   }
 };
 
-/**
- * Patches `res.setHeader` to ensure that the Content-Security-Policy header always includes the
- * directives required for PWA Kit to work.
- * @param {express.Request} req Express request object
- * @param {express.Response} res Express response object
- * @param {express.NextFunction} next Express next callback
- */
-exports.RemoteServerFactory = RemoteServerFactory;
-const enforceSecurityHeaders = (req, res, next) => {
-  /** CSP-compatible origin for Runtime Admin. */
-  // localhost doesn't include a protocol because different browsers behave differently :\
-  const runtimeAdmin = (0, _ssrServer.isRemote)() ? 'https://runtime.commercecloud.com' : 'localhost:*';
-  /**
-   * Map of directive names/values that are required for PWA Kit to work. Array values will be
-   * merged with user-provided values; boolean values will replace user-provided values.
-   * @type Object.<string, string[] | boolean>
-   */
-  const directives = {
-    'connect-src': ["'self'", runtimeAdmin],
-    'frame-ancestors': [runtimeAdmin],
-    'img-src': ["'self'", 'data:'],
-    'script-src': ["'self'", "'unsafe-eval'", runtimeAdmin],
-    // Always upgrade insecure requests when deployed, never upgrade on local dev server
-    'upgrade-insecure-requests': (0, _ssrServer.isRemote)()
-  };
-  const setHeader = res.setHeader;
-  res.setHeader = (name, value) => {
-    let modifiedValue = value;
-    switch (name === null || name === void 0 ? void 0 : name.toLowerCase()) {
-      case _constants.CONTENT_SECURITY_POLICY:
-        {
-          // If multiple Content-Security-Policy headers are provided, then the most restrictive
-          // option is chosen for each directive. Therefore, we must modify *all* directives to
-          // ensure that our required directives will work as expected.
-          // Ref: https://w3c.github.io/webappsec-csp/#multiple-policies
-          modifiedValue = Array.isArray(value) ? value.map(item => modifyDirectives(item, directives)) : modifyDirectives(value, directives);
-          break;
-        }
-      case _constants.STRICT_TRANSPORT_SECURITY:
-        {
-          // Block setting this header on local development server - it will break things!
-          if (!(0, _ssrServer.isRemote)()) return;
-          break;
-        }
-      default:
-        {
-          break;
-        }
-    }
-    return setHeader.call(res, name, modifiedValue);
-  };
-  // Provide an initial CSP (or patch the existing header)
-  res.setHeader(_constants.CONTENT_SECURITY_POLICY, res.getHeader(_constants.CONTENT_SECURITY_POLICY) ?? '');
-  // Provide an initial value for HSTS, if not already set - use default from `helmet`
-  if (!res.hasHeader(_constants.STRICT_TRANSPORT_SECURITY)) {
-    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=15552000; includeSubDomains');
-  }
-  next();
-};
-
-/**
- * Updates the given Content-Security-Policy header to include all directives required by PWA Kit.
- * @param {string} original Original Content-Security-Policy header
- * @returns {string} Modified Content-Security-Policy header
- * @private
- */
-exports.enforceSecurityHeaders = enforceSecurityHeaders;
-const modifyDirectives = (original, required) => {
-  const directives = original.trim().split(';').reduce((acc, directive) => {
-    const text = directive.trim();
-    if (text) {
-      const [name, ...values] = text.split(/ +/);
-      acc[name] = values;
-    }
-    return acc;
-  }, {});
-
-  // Add missing required CSP directives
-  for (const [name, value] of Object.entries(required)) {
-    if (value === true) {
-      // Boolean directive (required) - overwrite original value
-      directives[name] = [];
-    } else if (value === false) {
-      // Boolean directive (disabled) - delete original value
-      delete directives[name];
-    } else {
-      // Regular string[] directive - merge values
-      // Wrapping with `[...new Set(array)]` removes duplicate entries
-      directives[name] = [...new Set([...(directives[name] ?? []), ...value])];
-    }
-  }
-
-  // Re-construct header string
-  return Object.entries(directives).map(([name, values]) => [name, ...values].join(' ')).join(';');
-};
-
 /**
  * ExpressJS middleware that processes any non-proxy request passing
  * through the Express app.
@@ -917,6 +820,7 @@ const modifyDirectives = (original, required) => {
  *
  * @private
  */
+exports.RemoteServerFactory = RemoteServerFactory;
 const prepNonProxyRequest = (req, res, next) => {
   const options = req.app.options;
   if (!options.allowCookies) {

package/ssr/server/build-remote-server.test.js

@@ -1,7 +1,6 @@
 "use strict";
 
 var _buildRemoteServer = require("./build-remote-server");
-var _constants = require("./constants");
 /*
  * Copyright (c) 2021, salesforce.com, inc.
  * All rights reserved.
@@ -22,99 +21,4 @@ describe('the once function', () => {
     expect(fn.mock.calls).toHaveLength(1);
     expect(v1).toBe(v2); // The exact same instance
   });
-});
-
-describe('Content-Security-Policy enforcement', () => {
-  let res;
-
-  /** Sets the correct values for `isRemote()` to return true */
-  const mockProduction = () => {
-    process.env.AWS_LAMBDA_FUNCTION_NAME = 'testEnforceSecurityHeaders';
-  };
-  /**
-   * Helper to make expected CSP more readable. Asserts that the actual CSP header contains each
-   * of the expected directives.
-   * @param {string[]} expected Array of expected CSP directives
-   */
-  const expectDirectives = expected => {
-    const actual = res.getHeader(_constants.CONTENT_SECURITY_POLICY).split(';');
-    expect(actual).toEqual(expect.arrayContaining(expected));
-  };
-  beforeEach(() => {
-    const headers = {};
-    res = {
-      hasHeader: key => Object.hasOwn(headers, key),
-      getHeader: key => headers[key],
-      setHeader: (key, val) => headers[key] = val
-    };
-  });
-  // Revert state detected by `isRemote()`
-  afterEach(() => delete process.env.AWS_LAMBDA_FUNCTION_NAME);
-  test('adds required directives for development', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, '');
-    expectDirectives(["connect-src 'self' localhost:*", 'frame-ancestors localhost:*', "img-src 'self' data:", "script-src 'self' 'unsafe-eval' localhost:*"]);
-  });
-  test('adds required directives for production', () => {
-    mockProduction();
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, '');
-    expectDirectives(["connect-src 'self' https://runtime.commercecloud.com", 'frame-ancestors https://runtime.commercecloud.com', "img-src 'self' data:", "script-src 'self' 'unsafe-eval' https://runtime.commercecloud.com", 'upgrade-insecure-requests']);
-  });
-  test('merges with existing CSP directives', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, "connect-src test:* ; script-src 'unsafe-eval' test:*");
-    expectDirectives(["connect-src test:* 'self' localhost:*", "script-src 'unsafe-eval' test:* 'self' localhost:*"]);
-  });
-  test('allows other CSP directives', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'fake-directive test:*');
-    expectDirectives(['fake-directive test:*']);
-  });
-  test('enforces upgrade-insecure-requests disabled on development', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'upgrade-insecure-requests');
-    expect(res.getHeader(_constants.CONTENT_SECURITY_POLICY)).not.toContain('upgrade-insecure-requests');
-  });
-  test('enforces upgrade-insecure-requests enabled on production', () => {
-    mockProduction();
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'connect-src localhost:*');
-    expectDirectives(['upgrade-insecure-requests']);
-  });
-  test('adds directives even if setHeader is never called', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    expectDirectives(["img-src 'self' data:"]);
-  });
-  test('handles multiple CSP headers', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.CONTENT_SECURITY_POLICY, ['connect-src first.header', 'script-src second.header']);
-    const headers = res.getHeader(_constants.CONTENT_SECURITY_POLICY);
-    expect(headers).toHaveLength(2);
-    expect(headers[0]).toContain('connect-src first.header');
-    expect(headers[1]).toContain('script-src second.header');
-  });
-  test('does not modify unrelated headers', () => {
-    const header = 'Contentious-Secret-Police';
-    const value = 'connect-src unmodified fake directive';
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(header, value);
-    expect(res.getHeader(header)).toBe(value);
-  });
-  test('blocks Strict-Transport-Security header in development', () => {
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=12345');
-    expect(res.hasHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe(false);
-  });
-  test('allows Strict-Transport-Security header in production', () => {
-    mockProduction();
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=12345');
-    expect(res.getHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe('max-age=12345');
-  });
-  test('provides default value for Strict-Transport-Security header in production', () => {
-    mockProduction();
-    (0, _buildRemoteServer.enforceSecurityHeaders)({}, res, () => {});
-    expect(res.getHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe('max-age=15552000; includeSubDomains');
-  });
 });

package/utils/middleware/index.js

@@ -0,0 +1,16 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+var _security = require("./security");
+Object.keys(_security).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _security[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _security[key];
+    }
+  });
+});

package/utils/middleware/security.js

@@ -0,0 +1,111 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.defaultPwaKitSecurityHeaders = void 0;
+var _constants = require("../../ssr/server/constants");
+var _ssrServer = require("../ssr-server");
+/*
+ * Copyright (c) 2023, Salesforce, Inc.
+ * All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+
+/**
+ * This express middleware sets the Content-Security-Policy and Strict-Transport-Security headers to
+ * default values that are required for PWA Kit to work. It also patches `res.setHeader` to allow
+ * additional CSP directives to be added without removing the required directives, and it prevents
+ * the Strict-Transport-Security header from being set on the local dev server.
+ * @param {express.Request} req Express request object
+ * @param {express.Response} res Express response object
+ * @param {express.NextFunction} next Express next callback
+ */
+const defaultPwaKitSecurityHeaders = (req, res, next) => {
+  /** CSP-compatible origin for Runtime Admin. */
+  // localhost doesn't include a protocol because different browsers behave differently :\
+  const runtimeAdmin = (0, _ssrServer.isRemote)() ? 'https://runtime.commercecloud.com' : 'localhost:*';
+  /**
+   * Map of directive names/values that are required for PWA Kit to work. Array values will be
+   * merged with user-provided values; boolean values will replace user-provided values.
+   * @type Object.<string, string[] | boolean>
+   */
+  const directives = {
+    'connect-src': ["'self'", runtimeAdmin],
+    'frame-ancestors': [runtimeAdmin],
+    'img-src': ["'self'", 'data:'],
+    'script-src': ["'self'", "'unsafe-eval'", runtimeAdmin],
+    // Always upgrade insecure requests when deployed, never upgrade on local dev server
+    'upgrade-insecure-requests': (0, _ssrServer.isRemote)()
+  };
+  const setHeader = res.setHeader;
+  res.setHeader = (name, value) => {
+    let modifiedValue = value;
+    switch (name === null || name === void 0 ? void 0 : name.toLowerCase()) {
+      case _constants.CONTENT_SECURITY_POLICY:
+        {
+          // If multiple Content-Security-Policy headers are provided, then the most restrictive
+          // option is chosen for each directive. Therefore, we must modify *all* directives to
+          // ensure that our required directives will work as expected.
+          // Ref: https://w3c.github.io/webappsec-csp/#multiple-policies
+          modifiedValue = Array.isArray(value) ? value.map(item => modifyDirectives(item, directives)) : modifyDirectives(value, directives);
+          break;
+        }
+      case _constants.STRICT_TRANSPORT_SECURITY:
+        {
+          // Block setting this header on local development server - it will break things!
+          if (!(0, _ssrServer.isRemote)()) return;
+          break;
+        }
+      default:
+        {
+          break;
+        }
+    }
+    return setHeader.call(res, name, modifiedValue);
+  };
+  // Provide an initial CSP (or patch the existing header)
+  res.setHeader(_constants.CONTENT_SECURITY_POLICY, res.getHeader(_constants.CONTENT_SECURITY_POLICY) ?? '');
+  // Provide an initial value for HSTS, if not already set - use default from `helmet`
+  if (!res.hasHeader(_constants.STRICT_TRANSPORT_SECURITY)) {
+    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=15552000; includeSubDomains');
+  }
+  next();
+};
+
+/**
+ * Updates the given Content-Security-Policy header to include all directives required by PWA Kit.
+ * @param {string} original Original Content-Security-Policy header
+ * @returns {string} Modified Content-Security-Policy header
+ * @private
+ */
+exports.defaultPwaKitSecurityHeaders = defaultPwaKitSecurityHeaders;
+const modifyDirectives = (original, required) => {
+  const directives = original.trim().split(';').reduce((acc, directive) => {
+    const text = directive.trim();
+    if (text) {
+      const [name, ...values] = text.split(/ +/);
+      acc[name] = values;
+    }
+    return acc;
+  }, {});
+
+  // Add missing required CSP directives
+  for (const [name, value] of Object.entries(required)) {
+    if (value === true) {
+      // Boolean directive (required) - overwrite original value
+      directives[name] = [];
+    } else if (value === false) {
+      // Boolean directive (disabled) - delete original value
+      delete directives[name];
+    } else {
+      // Regular string[] directive - merge values
+      // Wrapping with `[...new Set(array)]` removes duplicate entries
+      directives[name] = [...new Set([...(directives[name] ?? []), ...value])];
+    }
+  }
+
+  // Re-construct header string
+  return Object.entries(directives).map(([name, values]) => [name, ...values].join(' ')).join(';');
+};

package/utils/middleware/security.test.js

@@ -0,0 +1,105 @@
+"use strict";
+
+var _constants = require("../../ssr/server/constants");
+var _security = require("./security");
+/*
+ * Copyright (c) 2023, Salesforce, Inc.
+ * All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+
+describe('Content-Security-Policy enforcement', () => {
+  let res;
+
+  /** Sets the correct values for `isRemote()` to return true */
+  const mockProduction = () => {
+    process.env.AWS_LAMBDA_FUNCTION_NAME = 'testEnforceSecurityHeaders';
+  };
+  /**
+   * Helper to make expected CSP more readable. Asserts that the actual CSP header contains each
+   * of the expected directives.
+   * @param {string[]} expected Array of expected CSP directives
+   */
+  const expectDirectives = expected => {
+    const actual = res.getHeader(_constants.CONTENT_SECURITY_POLICY).split(';');
+    expect(actual).toEqual(expect.arrayContaining(expected));
+  };
+  beforeEach(() => {
+    const headers = {};
+    res = {
+      hasHeader: key => Object.hasOwn(headers, key),
+      getHeader: key => headers[key],
+      setHeader: (key, val) => headers[key] = val
+    };
+  });
+  // Revert state detected by `isRemote()`
+  afterEach(() => delete process.env.AWS_LAMBDA_FUNCTION_NAME);
+  test('adds required directives for development', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, '');
+    expectDirectives(["connect-src 'self' localhost:*", 'frame-ancestors localhost:*', "img-src 'self' data:", "script-src 'self' 'unsafe-eval' localhost:*"]);
+  });
+  test('adds required directives for production', () => {
+    mockProduction();
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, '');
+    expectDirectives(["connect-src 'self' https://runtime.commercecloud.com", 'frame-ancestors https://runtime.commercecloud.com', "img-src 'self' data:", "script-src 'self' 'unsafe-eval' https://runtime.commercecloud.com", 'upgrade-insecure-requests']);
+  });
+  test('merges with existing CSP directives', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, "connect-src test:* ; script-src 'unsafe-eval' test:*");
+    expectDirectives(["connect-src test:* 'self' localhost:*", "script-src 'unsafe-eval' test:* 'self' localhost:*"]);
+  });
+  test('allows other CSP directives', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'fake-directive test:*');
+    expectDirectives(['fake-directive test:*']);
+  });
+  test('enforces upgrade-insecure-requests disabled on development', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'upgrade-insecure-requests');
+    expect(res.getHeader(_constants.CONTENT_SECURITY_POLICY)).not.toContain('upgrade-insecure-requests');
+  });
+  test('enforces upgrade-insecure-requests enabled on production', () => {
+    mockProduction();
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, 'connect-src localhost:*');
+    expectDirectives(['upgrade-insecure-requests']);
+  });
+  test('adds directives even if setHeader is never called', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    expectDirectives(["img-src 'self' data:"]);
+  });
+  test('handles multiple CSP headers', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.CONTENT_SECURITY_POLICY, ['connect-src first.header', 'script-src second.header']);
+    const headers = res.getHeader(_constants.CONTENT_SECURITY_POLICY);
+    expect(headers).toHaveLength(2);
+    expect(headers[0]).toContain('connect-src first.header');
+    expect(headers[1]).toContain('script-src second.header');
+  });
+  test('does not modify unrelated headers', () => {
+    const header = 'Contentious-Secret-Police';
+    const value = 'connect-src unmodified fake directive';
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(header, value);
+    expect(res.getHeader(header)).toBe(value);
+  });
+  test('blocks Strict-Transport-Security header in development', () => {
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=12345');
+    expect(res.hasHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe(false);
+  });
+  test('allows Strict-Transport-Security header in production', () => {
+    mockProduction();
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    res.setHeader(_constants.STRICT_TRANSPORT_SECURITY, 'max-age=12345');
+    expect(res.getHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe('max-age=12345');
+  });
+  test('provides default value for Strict-Transport-Security header in production', () => {
+    mockProduction();
+    (0, _security.defaultPwaKitSecurityHeaders)({}, res, () => {});
+    expect(res.getHeader(_constants.STRICT_TRANSPORT_SECURITY)).toBe('max-age=15552000; includeSubDomains');
+  });
+});