@teamscala/service-boot 0.23.400 → 0.23.401

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.400",
+  "version": "0.23.401",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/security-headers.test.ts

@@ -80,3 +80,42 @@ describe("injectSecurityHeaders (fallback mode, no registry)", () => {
 		expect((res.headers.get("Content-Security-Policy") ?? "")).not.toContain("{{nonce}}");
 	});
 });
+
+describe("Cross-Origin-Resource-Policy — public assets stay embeddable", () => {
+	function appWithAssetRoute(): Hono {
+		const app = new Hono();
+		app.use("*", injectSecurityHeaders);
+		app.get("/api/assets/*", (c) => c.body("png-bytes", 200, { "Content-Type": "image/png" }));
+		app.get("/", (c) => c.text("ok"));
+		return app;
+	}
+
+	it("serves cross-origin CORP for /api/assets/* so an email can render the logo", async () => {
+		clearRegistryHeaders();
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		// same-origin here means every mail client and every other origin gets the
+		// image blocked at fetch while curl still sees 200 — the exact failure this
+		// guards. cross-origin is the only value that lets the embed through.
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+	});
+
+	it("keeps same-origin CORP on page responses", async () => {
+		clearRegistryHeaders();
+		const res = await appWithAssetRoute().request("/");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+	});
+
+	it("still serves cross-origin CORP for assets when the registry row is applied", async () => {
+		seedRegistryHeaders({ "Referrer-Policy": "strict-origin-when-cross-origin" });
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+		clearRegistryHeaders();
+	});
+
+	it("lets the registry row override CORP when it names the header", async () => {
+		seedRegistryHeaders({ "Cross-Origin-Resource-Policy": "same-site" });
+		const res = await appWithAssetRoute().request("/api/assets/org/logos/launcha.png");
+		expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("same-site");
+		clearRegistryHeaders();
+	});
+});

package/src/security-headers.ts

@@ -35,7 +35,18 @@ const FALLBACK_CSP = [
 // present some browsers enforce it over CSP. Frame control is owned solely by
 // CSP frame-ancestors (registry security-headers config), which allows
 // platform self-framing — e.g. the GPT panel framing a forms page.
-const baseSecureHeaders = secureHeaders({ xFrameOptions: false });
+const baseSecureHeaders = secureHeaders({ xFrameOptions: false, crossOriginResourcePolicy: false });
+
+// Public brand assets are embedded BY DESIGN from other origins — most
+// importantly report emails, which render the org logo from the serving
+// origin. Hono's default CORP (same-origin) blocks every such embed at fetch
+// time, so the logo silently fails to load while the URL still answers 200 to
+// a non-browser client like curl. CORP cannot be corrected in the asset
+// handler: Hono's `c.res` setter copies already-set middleware headers over
+// the handler's response, so the middleware value always wins. The decision
+// therefore lives here — cross-origin for the public asset surface,
+// same-origin for every page and API response.
+const CROSS_ORIGIN_EMBEDDABLE_PREFIX = "/api/assets/";
 
 export async function injectSecurityHeaders(c: Context, next: Next) {
 	await baseSecureHeaders(c, async () => {});
@@ -55,5 +66,12 @@ export async function injectSecurityHeaders(c: Context, next: Next) {
 		}
 	}
 
+	if (!config?.["Cross-Origin-Resource-Policy"]) {
+		c.header(
+			"Cross-Origin-Resource-Policy",
+			new URL(c.req.url).pathname.startsWith(CROSS_ORIGIN_EMBEDDABLE_PREFIX) ? "cross-origin" : "same-origin",
+		);
+	}
+
 	await next();
 }