@stnd/modules 0.6.46 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @stnd/folios
 
+## 0.8.0
+
+### Minor Changes
+
+- Auto-bumped @stnd/modules due to modified code.
+
+## 0.7.0
+
+### Minor Changes
+
+- Auto-bumped @stnd/modules due to modified code.
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/server@0.8.0
+
 ## 0.6.46
 
 ### Patch Changes

package/headers/csp-report.js

@@ -0,0 +1,30 @@
+import { normaliseReports } from "@stnd/server/cspReports";
+import Log from "@stnd/log";
+
+export const prerender = false;
+
+const log = Log({ scope: "CSP" });
+const noContent = () =>
+  new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
+
+/**
+ * POST /api/csp-report — where browsers send content-security-policy violations
+ * (`report-uri` in the policy). Public by nature, so it only reduces the report
+ * to a few short fields and always answers 204.
+ *
+ * An app that wants the reports counted sets `locals.cspReports` from its own
+ * middleware: `{ record(reports, request): Promise<void> }` (it owns rate
+ * limiting and storage). Without one, each report is logged.
+ */
+export async function POST({ request, locals }) {
+  try {
+    const text = (await request.text()).slice(0, 8000);
+    const reports = normaliseReports(JSON.parse(text));
+    if (!reports.length) return noContent();
+    if (locals?.cspReports?.record) await locals.cspReports.record(reports, request);
+    else for (const r of reports) log.warn("CSP violation", r);
+  } catch {
+    /* a malformed report is not worth an error */
+  }
+  return noContent();
+}

package/headers/index.module.js

@@ -1,16 +1,29 @@
 /**
  * Security Headers core module
  *
- * Exposes the /_headers route via the Standard module system.
+ *  - Middleware: security headers (HSTS, nosniff, frame options, referrer and
+ *    permissions policies, a content-security-policy) on every response.
+ *    Policy lives in `@stnd/server/security`; an app extends it with
+ *    `standard({ security: { csp: { extend: { "script-src": [...] } } } })`.
+ *  - `/api/csp-report`: where the policy's violations are sent.
+ *  - Build: the same headers appended to `_headers` for prerendered files.
+ *  - `/_headers`: the same basics as a Cloudflare headers file.
  */
 export default {
   id: "stnd-headers",
   name: "Stnd :: Headers",
-  description: "Emits security headers (_headers) from site configuration.",
+  description: "Security headers on every response, and the CSP violation report endpoint.",
+  // Prerendered pages never reach the Worker: they get the same headers from the build's _headers file.
+  hooks: { "astro:build:done": [{ action: "./static-headers.js" }] },
+  middleware: [{ entrypoint: "./middleware.js", order: -1000 }],
   routes: [
     {
       path: "/_headers",
       entrypoint: "./route.js",
     },
+    {
+      path: "/api/csp-report",
+      entrypoint: "./csp-report.js",
+    },
   ],
 };

package/headers/middleware.js

@@ -0,0 +1,14 @@
+import config from "virtual:stnd/config";
+import { withSecurityHeaders } from "@stnd/server/security";
+
+/**
+ * Every response, whichever way it was produced (page, API, redirect, error),
+ * leaves with the framework's security headers. Registered with a very low
+ * `order` so it wraps the whole middleware chain.
+ *
+ * Configured with `standard({ security: { csp: {...}, hsts, frameOptions } })`.
+ */
+export async function onRequest(context, next) {
+  const response = await next();
+  return withSecurityHeaders(response, context.url, config.security || {});
+}

package/headers/static-headers.js

@@ -0,0 +1,39 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Log from "@stnd/log";
+
+const log = Log({ scope: "Headers" });
+const MARKER = "# stnd:security-headers";
+
+/**
+ * astro:build:done — the middleware only sees responses the Worker produces.
+ * Prerendered pages are static files served straight from Cloudflare's asset
+ * store, never reaching it, so they get the same headers through the build's
+ * `_headers` file. Headers the app's own `_headers` already sets are left alone
+ * (Cloudflare would otherwise send both values).
+ */
+export default async function writeStaticHeaders({ dir }) {
+  const options = globalThis.__STANDARD_CONFIG__?.security || {};
+  if (options.enabled === false) return;
+
+  const { securityHeaders } = await import("@stnd/server/security");
+  const wanted = securityHeaders(new URL("https://static.invalid/"), "text/html", options);
+
+  const outDir = fileURLToPath(dir);
+  const file = path.join(outDir, "_headers");
+  const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+  if (existing.includes(MARKER)) return;
+
+  const declared = new Set(
+    [...existing.matchAll(/^[ \t]+([A-Za-z0-9-]+):/gm)].map((m) => m[1].toLowerCase()),
+  );
+  const lines = Object.entries(wanted)
+    .filter(([name]) => !declared.has(name.toLowerCase()))
+    .map(([name, value]) => `  ${name}: ${value}`);
+  if (!lines.length) return;
+
+  const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}\n${MARKER}\n/*\n${lines.join("\n")}\n`;
+  fs.writeFileSync(file, existing + block);
+  log.info(`Security headers added to ${path.relative(process.cwd(), file) || file} for prerendered files`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stnd/modules",
-  "version": "0.6.46",
+  "version": "0.8.0",
   "type": "module",
   "svelte": "./stripe/views/CheckoutView.svelte",
   "author": "Francis Fontaine",
@@ -19,8 +19,9 @@
     "@astrojs/sitemap": "^3.7.3",
     "@stnd/client": "0.7.5",
     "@stnd/icon": "0.7.0",
-    "@stnd/layout": "0.7.7",
     "@stnd/log": "0.5.2",
+    "@stnd/server": "0.8.0",
+    "@stnd/layout": "0.7.7",
     "@stnd/styles": "0.13.0",
     "@stnd/utils": "0.7.3"
   },