@stnd/modules 0.6.45 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @stnd/folios
 
+## 0.7.0
+
+### Minor Changes
+
+- Auto-bumped @stnd/modules due to modified code.
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/server@0.8.0
+
+## 0.6.46
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/icon@0.7.0
+  - @stnd/layout@0.7.7
+
 ## 0.6.45
 
 ### Patch Changes

package/headers/csp-report.js

@@ -0,0 +1,30 @@
+import { normaliseReports } from "@stnd/server/cspReports";
+import Log from "@stnd/log";
+
+export const prerender = false;
+
+const log = Log({ scope: "CSP" });
+const noContent = () =>
+  new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
+
+/**
+ * POST /api/csp-report — where browsers send content-security-policy violations
+ * (`report-uri` in the policy). Public by nature, so it only reduces the report
+ * to a few short fields and always answers 204.
+ *
+ * An app that wants the reports counted sets `locals.cspReports` from its own
+ * middleware: `{ record(reports, request): Promise<void> }` (it owns rate
+ * limiting and storage). Without one, each report is logged.
+ */
+export async function POST({ request, locals }) {
+  try {
+    const text = (await request.text()).slice(0, 8000);
+    const reports = normaliseReports(JSON.parse(text));
+    if (!reports.length) return noContent();
+    if (locals?.cspReports?.record) await locals.cspReports.record(reports, request);
+    else for (const r of reports) log.warn("CSP violation", r);
+  } catch {
+    /* a malformed report is not worth an error */
+  }
+  return noContent();
+}

package/headers/index.module.js

@@ -1,16 +1,26 @@
 /**
  * Security Headers core module
  *
- * Exposes the /_headers route via the Standard module system.
+ *  - Middleware: security headers (HSTS, nosniff, frame options, referrer and
+ *    permissions policies, a content-security-policy) on every response.
+ *    Policy lives in `@stnd/server/security`; an app extends it with
+ *    `standard({ security: { csp: { extend: { "script-src": [...] } } } })`.
+ *  - `/api/csp-report`: where the policy's violations are sent.
+ *  - `/_headers`: the same basics as a Cloudflare headers file.
  */
 export default {
   id: "stnd-headers",
   name: "Stnd :: Headers",
-  description: "Emits security headers (_headers) from site configuration.",
+  description: "Security headers on every response, and the CSP violation report endpoint.",
+  middleware: [{ entrypoint: "./middleware.js", order: -1000 }],
   routes: [
     {
       path: "/_headers",
       entrypoint: "./route.js",
     },
+    {
+      path: "/api/csp-report",
+      entrypoint: "./csp-report.js",
+    },
   ],
 };

package/headers/middleware.js

@@ -0,0 +1,14 @@
+import config from "virtual:stnd/config";
+import { withSecurityHeaders } from "@stnd/server/security";
+
+/**
+ * Every response, whichever way it was produced (page, API, redirect, error),
+ * leaves with the framework's security headers. Registered with a very low
+ * `order` so it wraps the whole middleware chain.
+ *
+ * Configured with `standard({ security: { csp: {...}, hsts, frameOptions } })`.
+ */
+export async function onRequest(context, next) {
+  const response = await next();
+  return withSecurityHeaders(response, context.url, config.security || {});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stnd/modules",
-  "version": "0.6.45",
+  "version": "0.7.0",
   "type": "module",
   "svelte": "./stripe/views/CheckoutView.svelte",
   "author": "Francis Fontaine",
@@ -18,9 +18,10 @@
   "dependencies": {
     "@astrojs/sitemap": "^3.7.3",
     "@stnd/client": "0.7.5",
-    "@stnd/icon": "0.6.0",
-    "@stnd/layout": "0.7.6",
+    "@stnd/icon": "0.7.0",
+    "@stnd/layout": "0.7.7",
     "@stnd/log": "0.5.2",
+    "@stnd/server": "0.8.0",
     "@stnd/styles": "0.13.0",
     "@stnd/utils": "0.7.3"
   },