@stacksjs/server 0.72.8 → 0.72.9

package/dist/index.d.ts

@@ -4,3 +4,4 @@ export * from './imports';
 export * from './maintenance';
 export * from './proxy';
 export * from './redirects';
+export * from './security-headers';

package/dist/index.js

@@ -1 +1 @@
-export{config as server}from"./config";export*from"./controllers/base";export*from"./imports";export*from"./maintenance";export*from"./proxy";export*from"./redirects";
+export{config as server}from"./config";export*from"./controllers/base";export*from"./imports";export*from"./maintenance";export*from"./proxy";export*from"./redirects";export*from"./security-headers";

package/dist/security-headers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Normalise `config.server.security.embeddable` into the rules the
+ * per-response check reads.
+ *
+ * Resolved once at boot, mirroring `resolveApiProxyRules`: `@stacksjs/config`
+ * populates overrides asynchronously, so a per-request read would answer
+ * differently depending on how far boot had progressed.
+ *
+ * An entry ending in `/` is a prefix; anything else is an exact path.
+ */
+export declare function resolveEmbeddableRules(input?: readonly string[]): EmbeddableRules;
+/** Whether this path is one the app said another origin may frame. */
+export declare function isEmbeddablePath(pathname: string, rules: EmbeddableRules): boolean;
+/**
+ * Stamp the view security headers onto a response.
+ *
+ * Mutates `response.headers` in place and returns `undefined`, so a caller
+ * that has nothing else to change can leave the original response alone.
+ * A response with immutable headers (a `Response.redirect()`, for instance)
+ * cannot be mutated, so it is rebuilt and returned - the same shape
+ * `stacks-router.ts` already uses for this case.
+ *
+ * Never overwrites a header that is already set: an app that set its own
+ * `X-Frame-Options` in a template or a proxy has said something more
+ * specific.
+ */
+export declare function applyViewSecurityHeaders(req: Request, response: Response, rules: EmbeddableRules): Response | undefined;
+/** Test helper - reset the cached env-derived flag. */
+export declare function __resetViewSecurityHeadersCache(): void;
+/** Paths another origin is allowed to frame. */
+export declare interface EmbeddableRules {
+  paths: string[]
+  prefixes: string[]
+}

package/dist/security-headers.js

@@ -0,0 +1 @@
+import process from"node:process";let _isDisabledCache;function isDisabled(){if(_isDisabledCache!==void 0)return _isDisabledCache;_isDisabledCache=process.env.STACKS_SECURITY_HEADERS_DISABLE==="true";return _isDisabledCache}export function resolveEmbeddableRules(input){const paths=[],prefixes=[];for(const raw of input??[]){const entry=String(raw).trim();if(!entry||!entry.startsWith("/"))continue;if(entry.endsWith("/")&&entry.length>1){if(!prefixes.includes(entry))prefixes.push(entry);continue}if(!paths.includes(entry))paths.push(entry)}return{paths,prefixes}}function matchesPrefix(pathname,prefix){return pathname.startsWith(prefix)||pathname===prefix.slice(0,-1)}export function isEmbeddablePath(pathname,rules){if(rules.paths.includes(pathname))return!0;return rules.prefixes.some((prefix)=>matchesPrefix(pathname,prefix))}export function applyViewSecurityHeaders(req,response,rules){if(isDisabled())return;const embeddable=isEmbeddablePath(new URL(req.url).pathname,rules),wanted=[["X-Content-Type-Options","nosniff"],["Referrer-Policy","strict-origin-when-cross-origin"]];if(!embeddable)wanted.push(["X-Frame-Options","SAMEORIGIN"]);const missing=wanted.filter(([name])=>!response.headers.has(name));if(missing.length===0)return;try{for(const[name,value]of missing)response.headers.set(name,value);return}catch{const headers=new Headers(response.headers);for(const[name,value]of missing)headers.set(name,value);return new Response(response.body,{status:response.status,statusText:response.statusText,headers})}}export function __resetViewSecurityHeadersCache(){_isDisabledCache=void 0}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/server",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.8",
+  "version": "0.72.9",
   "description": "Local development and production-ready.",
   "author": "Chris Breuer",
   "contributors": [
@@ -58,11 +58,11 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@stacksjs/config": "0.72.8",
+    "@stacksjs/config": "0.72.9",
     "better-dx": "^0.2.23",
-    "@stacksjs/path": "0.72.8",
-    "@stacksjs/router": "0.72.8",
-    "@stacksjs/validation": "0.72.8"
+    "@stacksjs/path": "0.72.9",
+    "@stacksjs/router": "0.72.9",
+    "@stacksjs/validation": "0.72.9"
   },
   "dependencies": {
     "bun-plugin-auto-imports": "^0.4.0"