@scalar/fastify-api-reference 1.58.0 → 1.59.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @scalar/fastify-api-reference
 
+## 1.59.1
+
+## 1.59.0
+
+### Minor Changes
+
+- [#9422](https://github.com/scalar/scalar/pull/9422): Add a `nonce` option for Content Security Policy support.
+
+  When you pass a `nonce`, the rendered HTML stamps it onto the inline `<script>` and the CDN `<script>` tag (and Scalar's own `<style>` tags, plus a matching `<meta property="csp-nonce">`). This lets the API Reference run under a strict `script-src` with no `unsafe-inline` and no `unsafe-eval`.
+
+  ```ts
+  ApiReference({
+    url: '/openapi.json',
+    // Match this value in your `script-src` CSP directive.
+    nonce: 'r4nd0m',
+  })
+  ```
+
+  Note: `style-src` still needs `'unsafe-inline'`. The reference renders inline `style="…"` attributes, which a CSP nonce can never authorize (nonces only apply to `<script>`, `<style>` and `<link>` elements), so a nonce-only `style-src` is not possible. The win is a fully strict `script-src`.
+
 ## 1.58.0
 
 ### Patch Changes

package/dist/fastifyApiReference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastifyApiReference.d.ts","sourceRoot":"","sources":["../src/fastifyApiReference.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAiB,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI7G,OAAO,KAAK,EAA8D,0BAA0B,EAAE,MAAM,SAAS,CAAA;AAoDrH,QAAA,MAAM,mBAAmB,sIAwMxB,CAAA;AAED,eAAe,mBAAmB,CAAA"}
+{"version":3,"file":"fastifyApiReference.d.ts","sourceRoot":"","sources":["../src/fastifyApiReference.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAiB,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI7G,OAAO,KAAK,EAA8D,0BAA0B,EAAE,MAAM,SAAS,CAAA;AAoDrH,QAAA,MAAM,mBAAmB,sIAyMxB,CAAA;AAED,eAAe,mBAAmB,CAAA"}

package/dist/fastifyApiReference.js

@@ -187,12 +187,13 @@ const fastifyApiReference = fp((fastify, options, next) => {
                 };
             }
             // Respond with the HTML document
-            const { cdn, pageTitle, ...config } = configuration;
+            const { cdn, pageTitle, nonce, ...config } = configuration;
             return reply.header('Content-Type', 'text/html; charset=utf-8').send(renderApiReference({
                 config,
                 // We're using the bundled JS here by default, but the user can pass a CDN URL.
                 cdn: cdn ?? RELATIVE_JAVASCRIPT_PATH,
                 pageTitle,
+                nonce,
             }));
         },
     });