@teamscala/service-boot 0.23.399 → 0.23.401

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.399",
+  "version": "0.23.401",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-assessment-router.ts

@@ -190,7 +190,7 @@ async function sendAuthorityReportEmail(opts: {
 	const b = opts.stageBand;
 	const sectionHtml = (heading: string, inner: string) =>
 		inner
-			? `<h3 style="margin:24px 0 8px;font-size:15px;font-weight:700;color:${primary}">${heading}</h3>${inner}`
+			? `<h3 style="margin:24px 0 8px;font-size:16px;font-weight:700;color:${primary}">${heading}</h3>${inner}`
 			: "";
 	const paraHtml = (text?: string) =>
 		text ? `<p style="margin:0 0 12px;color:${muted}">${text}</p>` : "";
@@ -205,14 +205,14 @@ async function sendAuthorityReportEmail(opts: {
 			? b.priorityActions
 					.map(
 						(a) =>
-							`<p style="margin:0 0 10px"><strong style="color:${primary}">${a.title}</strong><br><span style="color:${muted}">${a.description ?? ""}</span></p>`,
+							`<p style="margin:0 0 10px"><strong style="font-size:14px;color:${primary}">${a.title}</strong><br><span style="color:${muted}">${a.description ?? ""}</span></p>`,
 					)
 					.join("")
 			: "";
 	const roadmapHtml = orderRoadmap(b?.roadmap)
 		.map(
 			(phase) =>
-				`<p style="margin:0 0 10px"><strong style="color:${primary}">${phase.focus ?? ""}</strong><br><span style="color:${muted}">${(phase.actions ?? []).join(" · ")}</span></p>`,
+				`<p style="margin:0 0 10px"><strong style="font-size:14px;color:${primary}">${phase.focus ?? ""}</strong><br><span style="color:${muted}">${(phase.actions ?? []).join(" · ")}</span></p>`,
 		)
 		.join("");
 	const notes = b?.pillarNotes ?? {};
@@ -220,7 +220,7 @@ async function sendAuthorityReportEmail(opts: {
 		? Object.entries(notes)
 				.map(
 					([k, v]) =>
-						`<p style="margin:0 0 8px;color:${muted}"><strong style="color:${primary};text-transform:capitalize">${k}</strong> — ${v}</p>`,
+						`<p style="margin:0 0 8px;color:${muted}"><strong style="font-size:14px;color:${primary};text-transform:capitalize">${k}</strong> — ${v}</p>`,
 				)
 				.join("")
 		: "";

package/src/security-headers.test.ts

@@ -80,3 +80,42 @@ describe("injectSecurityHeaders (fallback mode, no registry)", () => {
 		expect((res.headers.get("Content-Security-Policy") ?? "")).not.toContain("{{nonce}}");
 	});
 });
+
+describe("Cross-Origin-Resource-Policy — public assets stay embeddable", () => {
+	function appWithAssetRoute(): Hono {
+		const app = new Hono();
+		app.use("*", injectSecurityHeaders);
+		app.get("/api/assets/*", (c) => c.body("png-bytes", 200, { "Content-Type": "image/png" }));
+		app.get("/", (c) => c.text("ok"));
+		return app;
+	}
+
+	it("serves cross-origin CORP for /api/assets/* so an email can render the logo", async () => {
+		clearRegistryHeaders();
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		// same-origin here means every mail client and every other origin gets the
+		// image blocked at fetch while curl still sees 200 — the exact failure this
+		// guards. cross-origin is the only value that lets the embed through.
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+	});
+
+	it("keeps same-origin CORP on page responses", async () => {
+		clearRegistryHeaders();
+		const res = await appWithAssetRoute().request("/");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+	});
+
+	it("still serves cross-origin CORP for assets when the registry row is applied", async () => {
+		seedRegistryHeaders({ "Referrer-Policy": "strict-origin-when-cross-origin" });
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+		clearRegistryHeaders();
+	});
+
+	it("lets the registry row override CORP when it names the header", async () => {
+		seedRegistryHeaders({ "Cross-Origin-Resource-Policy": "same-site" });
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("same-site");
+		clearRegistryHeaders();
+	});
+});

package/src/security-headers.ts

@@ -35,7 +35,18 @@ const FALLBACK_CSP = [
 // present some browsers enforce it over CSP. Frame control is owned solely by
 // CSP frame-ancestors (registry security-headers config), which allows
 // platform self-framing — e.g. the GPT panel framing a forms page.
-const baseSecureHeaders = secureHeaders({ xFrameOptions: false });
+const baseSecureHeaders = secureHeaders({ xFrameOptions: false, crossOriginResourcePolicy: false });
+
+// Public brand assets are embedded BY DESIGN from other origins — most
+// importantly report emails, which render the org logo from the serving
+// origin. Hono's default CORP (same-origin) blocks every such embed at fetch
+// time, so the logo silently fails to load while the URL still answers 200 to
+// a non-browser client like curl. CORP cannot be corrected in the asset
+// handler: Hono's `c.res` setter copies already-set middleware headers over
+// the handler's response, so the middleware value always wins. The decision
+// therefore lives here — cross-origin for the public asset surface,
+// same-origin for every page and API response.
+const CROSS_ORIGIN_EMBEDDABLE_PREFIX = "/api/assets/";
 
 export async function injectSecurityHeaders(c: Context, next: Next) {
 	await baseSecureHeaders(c, async () => {});
@@ -55,5 +66,12 @@ export async function injectSecurityHeaders(c: Context, next: Next) {
 		}
 	}
 
+	if (!config?.["Cross-Origin-Resource-Policy"]) {
+		c.header(
+			"Cross-Origin-Resource-Policy",
+			new URL(c.req.url).pathname.startsWith(CROSS_ORIGIN_EMBEDDABLE_PREFIX) ? "cross-origin" : "same-origin",
+		);
+	}
+
 	await next();
 }