@thymian/rules-rfc-6797 0.0.0-stage → 0.3.0

package/dist/coverage.js

@@ -0,0 +1,160 @@
+// RFC 6797's denominator (ADR-0021 §5). RFC 6797 carries a real conformance
+// clause (§3: a conformant host implements every requirement applicable to
+// hosts), so its unit is a keyword paragraph — but only in the chapters a
+// host can be held to. §6 (the header field's syntax), §7 (the server
+// processing model) and §9.2 (the effective request URI) are the host's; §8
+// and §13 are the user agent's processing model, which Thymian cannot
+// observe; §11 and §12 open with "This section is non-normative."
+//
+// Counted from the document, never from the rules: derived by splitting
+// https://www.rfc-editor.org/rfc/rfc6797.txt (November 2012) into
+// paragraphs, dropping page headers and footers, and keeping every paragraph
+// of §6, §7 and §9.2 that contains at least one of MUST, MUST NOT, REQUIRED,
+// SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY or OPTIONAL. 14
+// qualify, and no page break in those sections splits a paragraph. Two of
+// them are NOTEs in §7 that quote a keyword to explain one; the counting
+// rule counts them. Three of §6.1's are addressed to the user agent; each is
+// a unit like any other.
+//
+// A unit's id is `<section>/<n>`: n is the paragraph's position among that
+// section's keyword paragraphs, so the id is re-derivable from the counting
+// rule alone.
+//
+// The per-rule entries arrive with the rules, grouped by the topic directory
+// the rule lives in; a unit no entry covers renders as not yet covered.
+import { defineCoverage } from '@thymian/core';
+const units = {
+    '6.1/1': 'The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.',
+    '6.1/2': 'All directives MUST appear only once in an STS header field.',
+    '6.1/3': 'UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.',
+    '6.1/4': 'If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.',
+    '6.1.1/1': 'The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.',
+    '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.",
+    '6.1.2/1': 'The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.',
+    '7.1/1': 'Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.',
+    '7.1/2': 'Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.',
+    '7.1/3': 'NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.',
+    '7.2/1': 'Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.',
+    '7.2/2': 'NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.',
+    '7.2/3': 'An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.',
+    '9.2/1': 'Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of "/".',
+};
+export default defineCoverage({
+    source: {
+        revision: 'RFC 6797 (November 2012)',
+        countingRule: 'One unit per paragraph of §6, §7 and §9.2 — the chapters addressed to the host — that contains a BCP 14 keyword.',
+        hasKeywordBasis: true,
+    },
+    units,
+    rules: {
+        // §6 — the header field's syntax.
+        'rfc6797/user-agent-must-enforce-hsts-policy': {
+            covers: ['6.1/1'],
+            declared: { types: ['informational'], severity: 'error' },
+        },
+        'rfc6797/hsts-host-must-not-repeat-sts-directives': {
+            covers: ['6.1/2'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        // 6.1/3 is addressed to the user agent, and its contrapositive is the
+        // host's: a header that does not conform is ignored, so the host MUST
+        // send one that does (7.1/1). One rule discharges both.
+        'rfc6797/hsts-host-must-send-sts-header-conforming-to-grammar': {
+            covers: ['6.1/3', '7.1/1'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        // 6.1/4's contrapositive: a directive RFC 6797 does not define is one a
+        // user agent will skip. Heuristic, because a directive defined later, or
+        // recognised by some user agents, is not a defect.
+        'rfc6797/user-agent-must-ignore-unrecognized-sts-directives': {
+            covers: ['6.1/4'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'hint' },
+            contexts: {
+                static: 'heuristic',
+                test: 'heuristic',
+                analytics: 'heuristic',
+            },
+        },
+        'rfc6797/hsts-host-must-send-max-age-directive': {
+            covers: ['6.1.1/1'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        'rfc6797/hsts-host-must-send-max-age-as-delta-seconds': {
+            covers: ['6.1.1/2'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        // 6.1.2/1 carries two claims: the directive is valueless (a syntax
+        // requirement), and it is OPTIONAL (a permission, checkable at `hint`).
+        'rfc6797/hsts-host-must-send-include-subdomains-without-value': {
+            covers: ['6.1.2/1'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        'rfc6797/hsts-host-may-assert-include-subdomains': {
+            covers: ['6.1.2/1'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'hint' },
+        },
+        // §7 — the server processing model.
+        // 7.1/1's other two clauses: the grammar is the syntax rule's above, and
+        // its conditional SHOULD — send the header — binds only a host that has
+        // chosen to be an HSTS Host, so it is carried by the presence convention,
+        // which covers no unit.
+        'rfc6797/hsts-host-must-send-only-one-sts-header': {
+            covers: ['7.1/1'],
+            declared: { types: ['test', 'analytics'], severity: 'error' },
+            contexts: {
+                static: {
+                    verdict: 'impossible',
+                    reason: 'not-representable',
+                    note: 'An API description declares response headers as a map keyed by name, so it cannot declare two Strict-Transport-Security field lines in one response.',
+                },
+            },
+        },
+        // A MAY is checkable at `hint`: the header is sent, or the mechanism
+        // goes unused.
+        'rfc6797/server-may-establish-hsts-over-secure-transport': {
+            covers: ['7.1/2'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'hint' },
+        },
+        'rfc6797/sts-header-inclusion-is-should-to-accommodate-caches': {
+            covers: ['7.1/3'],
+            declared: { types: ['informational'], severity: 'hint' },
+        },
+        // The SHOULD binds an HSTS Host, and whether the host behind a plain-http
+        // listener has chosen to be one is in no exchange: heuristic everywhere.
+        'rfc6797/hsts-host-should-redirect-insecure-requests-to-https': {
+            covers: ['7.2/1'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'warn' },
+            contexts: {
+                static: 'heuristic',
+                test: 'heuristic',
+                analytics: 'heuristic',
+            },
+        },
+        'rfc6797/https-redirect-is-should-for-deployment-reasons': {
+            covers: ['7.2/2'],
+            declared: { types: ['informational'], severity: 'hint' },
+        },
+        // Exact, although it binds an HSTS Host: sending the header is what makes
+        // a host one, so the condition is met by the header the rule looks for.
+        'rfc6797/hsts-host-must-not-send-sts-header-over-insecure-transport': {
+            covers: ['7.2/3'],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'error' },
+        },
+        // The two convention twins: each asks of every server, exactly, what the
+        // RFC asks only of an HSTS Host, so neither covers a unit.
+        'rfc6797/server-should-send-sts-header-over-secure-transport': {
+            covers: [],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'off' },
+        },
+        'rfc6797/server-should-redirect-insecure-requests-to-https': {
+            covers: [],
+            declared: { types: ['static', 'test', 'analytics'], severity: 'off' },
+        },
+        // §9.2 — the effective request URI.
+        'rfc6797/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris': {
+            covers: ['9.2/1'],
+            declared: { types: ['informational'], severity: 'error' },
+        },
+    },
+});
+//# sourceMappingURL=coverage.js.map

package/dist/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,4EAA4E;AAC5E,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,kEAAkE;AAClE,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,KAAK,GAAG;IACZ,OAAO,EACL,2HAA2H;IAC7H,OAAO,EAAE,8DAA8D;IACvE,OAAO,EACL,oIAAoI;IACtI,OAAO,EACL,+HAA+H;IACjI,SAAS,EACP,yGAAyG;IAC3G,SAAS,EACP,oGAAoG;IACtG,SAAS,EACP,+GAA+G;IACjH,OAAO,EACL,uIAAuI;IACzI,OAAO,EACL,qJAAqJ;IACvJ,OAAO,EACL,4FAA4F;IAC9F,OAAO,EACL,sHAAsH;IACxH,OAAO,EACL,6GAA6G;IAC/G,OAAO,EACL,0GAA0G;IAC5G,OAAO,EACL,0JAA0J;CACpJ,CAAC;AAEX,eAAe,cAAc,CAAC;IAC5B,MAAM,EAAE;QACN,QAAQ,EAAE,0BAA0B;QACpC,YAAY,EACV,kHAAkH;QACpH,eAAe,EAAE,IAAI;KACtB;IACD,KAAK;IACL,KAAK,EAAE;QACL,kCAAkC;QAClC,6CAA6C,EAAE;YAC7C,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SAC1D;QACD,kDAAkD,EAAE;YAClD,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,sEAAsE;QACtE,sEAAsE;QACtE,wDAAwD;QACxD,8DAA8D,EAAE;YAC9D,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1B,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,4DAA4D,EAAE;YAC5D,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtE,QAAQ,EAAE;gBACR,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,WAAW;aACvB;SACF;QACD,+CAA+C,EAAE;YAC/C,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,sDAAsD,EAAE;YACtD,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,mEAAmE;QACnE,wEAAwE;QACxE,8DAA8D,EAAE;YAC9D,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,iDAAiD,EAAE;YACjD,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;SACvE;QAED,oCAAoC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,wBAAwB;QACxB,iDAAiD,EAAE;YACjD,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC7D,QAAQ,EAAE;gBACR,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,mBAAmB;oBAC3B,IAAI,EAAE,sJAAsJ;iBAC7J;aACF;SACF;QACD,qEAAqE;QACrE,eAAe;QACf,yDAAyD,EAAE;YACzD,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;SACvE;QACD,8DAA8D,EAAE;YAC9D,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;SACzD;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D,EAAE;YAC9D,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtE,QAAQ,EAAE;gBACR,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,WAAW;aACvB;SACF;QACD,yDAAyD,EAAE;YACzD,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;SACzD;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE,EAAE;YACpE,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SACxE;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,6DAA6D,EAAE;YAC7D,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;SACtE;QACD,2DAA2D,EAAE;YAC3D,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;SACtE;QAED,oCAAoC;QACpC,4FAA4F,EAC1F;YACE,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;SAC1D;KACJ;CACF,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import { type RuleSet } from '@thymian/core';
+declare const rfc6797: RuleSet;
+export default rfc6797;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAiBvB,QAAA,MAAM,OAAO,EAAE,OAYd,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/index.js

@@ -0,0 +1,29 @@
+import { deriveMinimalProfile, } from '@thymian/core';
+import coverage from './coverage.js';
+// The opinionated layer: every convention rule on, at the severity its own
+// explanation argues for. Each convention asks of every server, exactly, what
+// RFC 6797 asks only of a host that has chosen to be an HSTS Host, which no
+// exchange shows; each replaces the RFC rule that reports the same wire fact,
+// so one response is reported once. The presence convention replaces 7.1's
+// MAY `hint`, the redirect convention replaces 7.2's heuristic rule.
+const recommended = {
+    'rfc6797/server-should-send-sts-header-over-secure-transport': 'error',
+    'rfc6797/server-may-establish-hsts-over-secure-transport': 'off',
+    'rfc6797/server-should-redirect-insecure-requests-to-https': 'error',
+    'rfc6797/hsts-host-should-redirect-insecure-requests-to-https': 'off',
+};
+const rfc6797 = {
+    name: 'rfc6797',
+    url: 'https://www.rfc-editor.org/rfc/rfc6797.html',
+    pattern: 'rules/**/*.rule.js',
+    profiles: {
+        recommended,
+        // Source fidelity: every rule at its shipped severity, which follows
+        // RFC 6797's keywords; convention rules stay off.
+        strict: {},
+        minimal: deriveMinimalProfile(coverage),
+    },
+    coverage,
+};
+export default rfc6797;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AAEvB,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,qEAAqE;AACrE,MAAM,WAAW,GAAuB;IACtC,6DAA6D,EAAE,OAAO;IACtE,yDAAyD,EAAE,KAAK;IAChE,2DAA2D,EAAE,OAAO;IACpE,8DAA8D,EAAE,KAAK;CACtE,CAAC;AAEF,MAAM,OAAO,GAAY;IACvB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,6CAA6C;IAClD,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE;QACR,WAAW;QACX,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC;KACxC;IACD,QAAQ;CACT,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.d.ts.map

package/dist/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.ts"],"names":[],"mappings":";AAEA,wBAqBU"}

package/dist/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.js

@@ -0,0 +1,12 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc6797/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris')
+    .severity('error')
+    .type('informational', 'peer-not-observable', 'The comparison happens inside whichever party compares two effective request URIs; neither URI, nor the outcome of comparing them, appears in any message. A redirect Location built from the effective request URI (§7.2) is checked by hsts-host-should-redirect-insecure-requests-to-https.')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-9.2')
+    .description('Effective request URIs are compared using the rules described in [RFC2616] Section 3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of "/".')
+    .summary('HSTS Host must not treat an empty path as "/" when comparing effective request URIs.')
+    .explanation('Under RFC 2616\'s comparison rules an empty path and "/" name the same resource; RFC 6797 keeps them apart when effective request URIs are compared. The distinction lives inside the party that does the comparing and never shows on the wire, so this rule documents the requirement rather than checking it.')
+    .appliesTo('server')
+    .done();
+//# sourceMappingURL=hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.js.map

package/dist/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.js","sourceRoot":"","sources":["../../../src/rules/effective-request-uri/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,4FAA4F,CAC7F;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CACH,eAAe,EACf,qBAAqB,EACrB,gSAAgS,CACjS;KACA,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,2LAA2L,CAC5L;KACA,OAAO,CACN,sFAAsF,CACvF;KACA,WAAW,CACV,kTAAkT,CACnT;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=hsts-host-must-not-send-sts-header-over-insecure-transport.rule.d.ts.map

package/dist/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-not-send-sts-header-over-insecure-transport.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.ts"],"names":[],"mappings":";AA+CA,wBAiBU"}

package/dist/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.js

@@ -0,0 +1,39 @@
+import { httpRule, protocol, } from '@thymian/core';
+import { carriesHeader } from '../utils/headers.js';
+import { violation } from '../utils/results.js';
+import { STS_HEADER } from '../utils/sts-field-value.js';
+import { isServerFallbackOrigin, serverFallbackSkip, } from '../utils/transport.js';
+const NAME = 'rfc6797/hsts-host-must-not-send-sts-header-over-insecure-transport';
+const MESSAGE = 'This response over non-secure transport (http) carries a Strict-Transport-Security header field. An HSTS Host MUST NOT include it in responses conveyed over non-secure transport.';
+// Sending the header at all is what makes a host an HSTS Host (§5.1), so the
+// condition in "An HSTS Host MUST NOT" is met by the very header this rule
+// looks for: exact in every context, never heuristic. The common interface
+// sees both facts — the scheme through its request filter, the header by
+// name — so one function serves every context; only whether the server URL
+// fallback is skipped differs. It is skipped only where a header is there to
+// be judged: without one, the response conforms whatever the scheme.
+function judgeTransport({ skipServerFallback, }) {
+    return (ctx) => ctx.validateCommonHttpTransactions(protocol('http'), (req, res, location) => {
+        if (!carriesHeader(res, STS_HEADER)) {
+            return [];
+        }
+        return skipServerFallback && isServerFallbackOrigin(req.origin)
+            ? [serverFallbackSkip(location, NAME)]
+            : [violation(location, MESSAGE)];
+    });
+}
+export default httpRule(NAME)
+    .severity('error')
+    .type('static', 'test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.2')
+    .description('An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.')
+    .summary('HSTS Host must not send Strict-Transport-Security over plain HTTP.')
+    .explanation('Over plain HTTP an attacker on the network can add, remove or rewrite any header, so a Strict-Transport-Security header received that way proves nothing about the host — which is why user agents must ignore it (RFC 6797 §8.1). Sending it anyway protects nobody, and it signals a deployment that does not distinguish its secure and insecure listeners: the same configuration that sends the header over http is often the one that serves real content there instead of redirecting to https.')
+    .appliesTo('server')
+    // `static` and `test` carry the described origin, so both skip the
+    // fallback; recorded traffic in `analytics` is real, so it never does.
+    .rule(judgeTransport({ skipServerFallback: true }))
+    .overrideAnalyticsRule(judgeTransport({ skipServerFallback: false }))
+    .done();
+//# sourceMappingURL=hsts-host-must-not-send-sts-header-over-insecure-transport.rule.js.map

package/dist/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-not-send-sts-header-over-insecure-transport.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-must-not-send-sts-header-over-insecure-transport.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,QAAQ,EACR,QAAQ,GAET,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAoB,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,IAAI,GACR,oEAAoE,CAAC;AAEvE,MAAM,OAAO,GACX,oLAAoL,CAAC;AAEvL,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,SAAS,cAAc,CAAC,EACtB,kBAAkB,GAGnB;IACC,OAAO,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,8BAA8B,CAChC,QAAQ,CAAC,MAAM,CAAC,EAChB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QACrB,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,kBAAkB,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7D,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC,CACF,CAAC;AACN,CAAC;AAED,eAAe,QAAQ,CAAC,IAAI,CAAC;KAC1B,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,0GAA0G,CAC3G;KACA,OAAO,CAAC,oEAAoE,CAAC;KAC7E,WAAW,CACV,weAAwe,CACze;KACA,SAAS,CAAC,QAAQ,CAAC;IACpB,mEAAmE;IACnE,uEAAuE;KACtE,IAAI,CAAC,cAAc,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;KAClD,qBAAqB,CAAC,cAAc,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;KACpE,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=hsts-host-must-send-only-one-sts-header.rule.d.ts.map

package/dist/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-send-only-one-sts-header.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.ts"],"names":[],"mappings":";AA6BA,wBAgBU"}

package/dist/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.js

@@ -0,0 +1,35 @@
+import { constant, httpRule } from '@thymian/core';
+import { violation } from '../utils/results.js';
+import { liveStsValues } from '../utils/sts-contexts.js';
+// Sending the header is what makes a host an HSTS Host (§5.1), so the
+// condition in "If an STS header field is included" is met by the very field
+// lines this rule counts: exact, never heuristic. `constant(true)` as the
+// candidate filter for the same reason as the value rules': `test` picks the
+// requests it sends over the described transactions, and a server that adds
+// a second field line where the description declares none is the case this
+// rule exists for.
+function checkLive(ctx) {
+    return ctx.validateHttpTransactions(constant(true), (_req, res, location) => {
+        const fieldLines = liveStsValues(res.headers);
+        return fieldLines.length > 1
+            ? [
+                violation(location, `This response carries ${fieldLines.length} Strict-Transport-Security header fields (${fieldLines.map((line) => `"${line}"`).join(', ')}). An HSTS Host MUST include only one; a UA processes only the first.`),
+            ]
+            : [];
+    });
+}
+// No `static`: an API description declares a response's headers as a map
+// keyed by name, which cannot hold two field lines of one header (the
+// coverage record's `not-representable` cell).
+export default httpRule('rfc6797/hsts-host-must-send-only-one-sts-header')
+    .severity('error')
+    .type('test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.1')
+    .description('If an STS header field is included, the HSTS Host MUST include only one such header field.')
+    .summary('HSTS Host must send only one Strict-Transport-Security header field.')
+    .explanation('Two Strict-Transport-Security header fields in one response usually mean two layers — the application and a proxy or CDN in front of it — each adding their own. A browser processes only the first and ignores the rest (RFC 6797 §8.1), so which policy takes effect depends on header order, and the one the operator actually configured may be the one that is silently dropped.')
+    .appliesTo('server')
+    .rule(checkLive)
+    .done();
+//# sourceMappingURL=hsts-host-must-send-only-one-sts-header.rule.js.map

package/dist/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-must-send-only-one-sts-header.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-must-send-only-one-sts-header.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAuB,MAAM,eAAe,CAAC;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,sEAAsE;AACtE,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,mBAAmB;AACnB,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAO,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QAC1E,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC;gBACE,SAAS,CACP,QAAQ,EACR,yBAAyB,UAAU,CAAC,MAAM,6CAA6C,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CAC/M;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,sEAAsE;AACtE,+CAA+C;AAC/C,eAAe,QAAQ,CAAC,iDAAiD,CAAC;KACvE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KACzB,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,4FAA4F,CAC7F;KACA,OAAO,CACN,sEAAsE,CACvE;KACA,WAAW,CACV,uXAAuX,CACxX;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,CAAC,SAAS,CAAC;KACf,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=hsts-host-should-redirect-insecure-requests-to-https.rule.d.ts.map

package/dist/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-should-redirect-insecure-requests-to-https.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.ts"],"names":[],"mappings":";AAcA,wBAkBU"}

package/dist/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.js

@@ -0,0 +1,24 @@
+import { httpRule } from '@thymian/core';
+import { redirectRuleFns } from '../utils/redirect.js';
+const NAME = 'rfc6797/hsts-host-should-redirect-insecure-requests-to-https';
+const { lint, test, analytics } = redirectRuleFns(NAME);
+// Heuristic in every context: the SHOULD binds an HSTS Host, and whether the
+// host behind a plain-http listener has chosen to be one is in no exchange —
+// a host that never opted into HSTS is not bound by §7.2. A heuristic rule is
+// never promoted, so the
+// `server-should-redirect-insecure-requests-to-https` convention rule asks
+// the same of every server, exactly, and replaces this one in `recommended`.
+export default httpRule(NAME)
+    .severity('warn')
+    .type('static', 'test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.2')
+    .description('If an HSTS Host receives an HTTP request message over a non-secure transport, it SHOULD send an HTTP response message containing a status code indicating a permanent redirect, such as status code 301, and a Location header field value containing either the HTTP request\'s original Effective Request URI altered as necessary to have a URI scheme of "https", or a URI generated according to local policy with a URI scheme of "https".')
+    .summary('HSTS Host should permanently redirect plain-HTTP requests to https.')
+    .explanation("A browser that has never seen a host's HSTS Policy still starts with plain HTTP, typically because a user typed the bare domain. Answering that request with a permanent redirect to https moves the user onto a secure connection, where the Strict-Transport-Security header can then be delivered. Serving content over HTTP instead keeps the user there, where any attacker on the network can read and rewrite the traffic; a temporary redirect (302, 307) moves the user too, but is followed again over HTTP on every visit.")
+    .appliesTo('server')
+    .overrideStaticRule(lint)
+    .overrideTest(test)
+    .overrideAnalyticsRule(analytics)
+    .done();
+//# sourceMappingURL=hsts-host-should-redirect-insecure-requests-to-https.rule.js.map

package/dist/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-should-redirect-insecure-requests-to-https.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/hsts-host-should-redirect-insecure-requests-to-https.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,IAAI,GAAG,8DAA8D,CAAC;AAE5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;AAExD,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,yBAAyB;AACzB,2EAA2E;AAC3E,6EAA6E;AAC7E,eAAe,QAAQ,CAAC,IAAI,CAAC;KAC1B,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,kbAAkb,CACnb;KACA,OAAO,CACN,qEAAqE,CACtE;KACA,WAAW,CACV,ugBAAugB,CACxgB;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,kBAAkB,CAAC,IAAI,CAAC;KACxB,YAAY,CAAC,IAAI,CAAC;KAClB,qBAAqB,CAAC,SAAS,CAAC;KAChC,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=https-redirect-is-should-for-deployment-reasons.rule.d.ts.map

package/dist/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-redirect-is-should-for-deployment-reasons.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.ts"],"names":[],"mappings":";AAIA,wBAqBU"}

package/dist/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.js

@@ -0,0 +1,14 @@
+import { httpRule } from '@thymian/core';
+// A NOTE the counting rule counts because it quotes a keyword to explain
+// one: a unit, but nothing any message could conform to or violate.
+export default httpRule('rfc6797/https-redirect-is-should-for-deployment-reasons')
+    .severity('hint')
+    .type('informational', 'nothing-to-check', 'A note explaining why the redirect before it is a SHOULD rather than a MUST; it states no requirement a message could meet or break. The redirect itself is checked by hsts-host-should-redirect-insecure-requests-to-https and, in the recommended profile, by the server-should-redirect-insecure-requests-to-https convention rule.')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.2')
+    .description('NOTE: The above behavior is a "SHOULD" rather than a "MUST" due to: risks in server-side non-secure-to-secure redirects [OWASP-TLSGuide]; and site deployment characteristics. For example, a site that incorporates third-party components may not behave correctly when doing server-side non-secure-to-secure redirects in the case of being accessed over non-secure transport but does behave correctly when accessed uniformly over secure transport. The latter is the case given an HSTS-capable UA that has already noted the site as a Known HSTS Host (by whatever means, e.g., prior interaction or UA configuration).')
+    .summary('Redirecting plain-HTTP requests to https is a SHOULD for deployment reasons.')
+    .explanation("RFC 6797 leaves the redirect a SHOULD because a server-side redirect from http to https carries risks of its own, and because a site built from third-party components can break when redirected mid-visit although it works when reached over https from the start — which is how a browser that already knows the host's policy reaches it.")
+    .appliesTo('server')
+    .done();
+//# sourceMappingURL=https-redirect-is-should-for-deployment-reasons.rule.js.map

package/dist/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-redirect-is-should-for-deployment-reasons.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/https-redirect-is-should-for-deployment-reasons.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,yEAAyE;AACzE,oEAAoE;AACpE,eAAe,QAAQ,CACrB,yDAAyD,CAC1D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CACH,eAAe,EACf,kBAAkB,EAClB,wUAAwU,CACzU;KACA,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,omBAAomB,CACrmB;KACA,OAAO,CACN,8EAA8E,CAC/E;KACA,WAAW,CACV,+UAA+U,CAChV;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-may-establish-hsts-over-secure-transport.rule.d.ts.map

package/dist/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-establish-hsts-over-secure-transport.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.ts"],"names":[],"mappings":";AAYA,wBAkBU"}

package/dist/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.js

@@ -0,0 +1,19 @@
+import { httpRule } from '@thymian/core';
+import { stsPresenceRuleFn } from '../utils/sts-contexts.js';
+const checkPresence = stsPresenceRuleFn('This response over secure transport (https) carries no Strict-Transport-Security header field. RFC 6797 lets a host establish HSTS by returning one; this response does not use it.');
+// A MAY is checkable at `hint`: the finding is "the protocol offers this
+// mechanism and it is not used", which claims no non-conformance. The
+// pre-load list the same paragraph permits is in no exchange, so a host that
+// relies on it alone is still hinted at here.
+export default httpRule('rfc6797/server-may-establish-hsts-over-secure-transport')
+    .severity('hint')
+    .type('static', 'test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.1')
+    .description('Establishing a given host as a Known HSTS Host, in the context of a given UA, MAY be accomplished over HTTP, which is in turn running over secure transport, by correctly returning (per this specification) at least one valid STS header field to the UA. Other mechanisms, such as a client-side pre-loaded Known HSTS Host list, MAY also be used.')
+    .summary('Server may establish HSTS by sending Strict-Transport-Security over https.')
+    .explanation('Returning a Strict-Transport-Security header over https is how a host tells browsers to use only https from then on; a response without it gives the browser nothing to note. The pre-load lists RFC 6797 also mentions are not visible in any exchange. The server-should-send-sts-header-over-secure-transport convention rule asks for the header outright and replaces this hint in the recommended profile.')
+    .appliesTo('server')
+    .rule(checkPresence)
+    .done();
+//# sourceMappingURL=server-may-establish-hsts-over-secure-transport.rule.js.map

package/dist/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-establish-hsts-over-secure-transport.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-may-establish-hsts-over-secure-transport.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,aAAa,GAAG,iBAAiB,CACrC,qLAAqL,CACtL,CAAC;AAEF,yEAAyE;AACzE,sEAAsE;AACtE,6EAA6E;AAC7E,8CAA8C;AAC9C,eAAe,QAAQ,CACrB,yDAAyD,CAC1D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,wVAAwV,CACzV;KACA,OAAO,CACN,4EAA4E,CAC7E;KACA,WAAW,CACV,kZAAkZ,CACnZ;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,CAAC,aAAa,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-should-redirect-insecure-requests-to-https.rule.d.ts.map

package/dist/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-redirect-insecure-requests-to-https.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.ts"],"names":[],"mappings":";AAeA,wBAgBU"}

package/dist/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.js

@@ -0,0 +1,25 @@
+import { httpRule } from '@thymian/core';
+import { redirectRuleFns } from '../utils/redirect.js';
+const NAME = 'rfc6797/server-should-redirect-insecure-requests-to-https';
+const { lint, test, analytics } = redirectRuleFns(NAME);
+// A convention rule, the exact twin of
+// `hsts-host-should-redirect-insecure-requests-to-https`: RFC 6797 asks for
+// the redirect only from a host that has chosen to be an HSTS Host, which no
+// exchange shows, so that rule is heuristic and can never be promoted.
+// Asking it of every server drops the condition and makes the check exact,
+// so this one ships `off`, covers no unit, and the `recommended` profile
+// turns it on in the other's place.
+export default httpRule(NAME)
+    .severity('off')
+    .type('static', 'test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.2')
+    .description('A server should answer every request over non-secure transport with a permanent redirect to the resource over https. RFC 6797 asks this only of an HSTS Host; this is a convention.')
+    .summary('Server should permanently redirect plain-HTTP requests to https.')
+    .explanation('RFC 6797 asks for this redirect only from a host that has already chosen to be an HSTS Host, and the recommended profile requires it of every server because a plain-HTTP request not answered by a permanent redirect — typically a typed bare domain on a first visit — is exactly the downgrade window HSTS exists to close, and the one place its header can never be delivered.')
+    .appliesTo('server')
+    .overrideStaticRule(lint)
+    .overrideTest(test)
+    .overrideAnalyticsRule(analytics)
+    .done();
+//# sourceMappingURL=server-should-redirect-insecure-requests-to-https.rule.js.map

package/dist/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-redirect-insecure-requests-to-https.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-should-redirect-insecure-requests-to-https.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,IAAI,GAAG,2DAA2D,CAAC;AAEzE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;AAExD,uCAAuC;AACvC,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,oCAAoC;AACpC,eAAe,QAAQ,CAAC,IAAI,CAAC;KAC1B,QAAQ,CAAC,KAAK,CAAC;KACf,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,qLAAqL,CACtL;KACA,OAAO,CAAC,kEAAkE,CAAC;KAC3E,WAAW,CACV,sXAAsX,CACvX;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,kBAAkB,CAAC,IAAI,CAAC;KACxB,YAAY,CAAC,IAAI,CAAC;KAClB,qBAAqB,CAAC,SAAS,CAAC;KAChC,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-should-send-sts-header-over-secure-transport.rule.d.ts.map

package/dist/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-send-sts-header-over-secure-transport.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.ts"],"names":[],"mappings":";AAeA,wBAkBU"}

package/dist/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.js

@@ -0,0 +1,22 @@
+import { httpRule } from '@thymian/core';
+import { stsPresenceRuleFn } from '../utils/sts-contexts.js';
+const checkPresence = stsPresenceRuleFn('This response over secure transport (https) carries no Strict-Transport-Security header field, so it gives the browser no HSTS Policy to note or refresh.');
+// A convention rule, the exact twin of 7.1's conditional SHOULD. RFC 6797
+// permits establishing HSTS by returning the header (a MAY, checked at `hint`
+// by `server-may-establish-hsts-over-secure-transport`) and asks it of every
+// response only from a host that has already chosen to be an HSTS Host,
+// which no single response shows. Asking it of every server drops the
+// condition and makes the check exact, so this one ships `off`, covers no
+// unit, and the `recommended` profile turns it on in the hint's place.
+export default httpRule('rfc6797/server-should-send-sts-header-over-secure-transport')
+    .severity('off')
+    .type('static', 'test', 'analytics')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.1')
+    .description('A server should include a Strict-Transport-Security header field in every response over secure transport. RFC 6797 does not require it of every server; this is a convention.')
+    .summary('Server should send Strict-Transport-Security in every response over https.')
+    .explanation("RFC 6797 only permits a host to establish HSTS by sending this header and asks it of every response only from a host that has already chosen to be an HSTS Host, and the recommended profile requires it of every server because, outside the browsers' pre-load lists, the header is the only way a browser learns the policy, so a response without it leaves every first visit, and every visit after the policy lapses, open to a downgrade to plain HTTP.")
+    .appliesTo('server')
+    .rule(checkPresence)
+    .done();
+//# sourceMappingURL=server-should-send-sts-header-over-secure-transport.rule.js.map

package/dist/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-send-sts-header-over-secure-transport.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/server-should-send-sts-header-over-secure-transport.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,aAAa,GAAG,iBAAiB,CACrC,2JAA2J,CAC5J,CAAC;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,eAAe,QAAQ,CACrB,6DAA6D,CAC9D;KACE,QAAQ,CAAC,KAAK,CAAC;KACf,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,+KAA+K,CAChL;KACA,OAAO,CACN,4EAA4E,CAC7E;KACA,WAAW,CACV,gcAAgc,CACjc;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,CAAC,aAAa,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sts-header-inclusion-is-should-to-accommodate-caches.rule.d.ts.map

package/dist/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-header-inclusion-is-should-to-accommodate-caches.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.ts"],"names":[],"mappings":";AAIA,wBAqBU"}

package/dist/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.js

@@ -0,0 +1,14 @@
+import { httpRule } from '@thymian/core';
+// A NOTE the counting rule counts because it quotes a keyword to explain
+// one: a unit, but nothing any message could conform to or violate.
+export default httpRule('rfc6797/sts-header-inclusion-is-should-to-accommodate-caches')
+    .severity('hint')
+    .type('informational', 'nothing-to-check', 'A note explaining why the requirement before it is a SHOULD rather than a MUST; it states no requirement a message could meet or break. Sending the header is checked by server-may-establish-hsts-over-secure-transport and, in the recommended profile, by the server-should-send-sts-header-over-secure-transport convention rule.')
+    .tags('security:transport')
+    .url('https://www.rfc-editor.org/rfc/rfc6797.html#section-7.1')
+    .description('NOTE: Including the STS header field is stipulated as a "SHOULD" in order to accommodate various server- and network-side caches and load-balancing configurations where it may be difficult to uniformly emit STS header fields on behalf of a given HSTS Host.')
+    .summary('Sending Strict-Transport-Security is a SHOULD to accommodate caches and load balancers.')
+    .explanation('RFC 6797 asks for the header on every response over https without requiring it, because a cache or load balancer in front of the host may answer with responses the host itself never emitted. That is also why a missing header is worth reporting: the layer that drops it is usually one the operator configured and forgot.')
+    .appliesTo('server')
+    .done();
+//# sourceMappingURL=sts-header-inclusion-is-should-to-accommodate-caches.rule.js.map

package/dist/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-header-inclusion-is-should-to-accommodate-caches.rule.js","sourceRoot":"","sources":["../../../src/rules/server-processing-model/sts-header-inclusion-is-should-to-accommodate-caches.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,yEAAyE;AACzE,oEAAoE;AACpE,eAAe,QAAQ,CACrB,8DAA8D,CAC/D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CACH,eAAe,EACf,kBAAkB,EAClB,uUAAuU,CACxU;KACA,IAAI,CAAC,oBAAoB,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,kQAAkQ,CACnQ;KACA,OAAO,CACN,yFAAyF,CAC1F;KACA,WAAW,CACV,iUAAiU,CAClU;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/syntax/hsts-host-may-assert-include-subdomains.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=hsts-host-may-assert-include-subdomains.rule.d.ts.map

package/dist/rules/syntax/hsts-host-may-assert-include-subdomains.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts-host-may-assert-include-subdomains.rule.d.ts","sourceRoot":"","sources":["../../../src/rules/syntax/hsts-host-may-assert-include-subdomains.rule.ts"],"names":[],"mappings":";AA0BA,wBAqBU"}