@vesk/runtime 0.2.65 → 0.2.66
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/request.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,UAAU,cAAc;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrB;AAWD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAI3D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAI3D;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAM9F;AAED,wBAAgB,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGlD;AAED,wBAAgB,UAAU,IAAI,cAAc,GAAG,IAAI,CAElD;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CA2BhD;AAED,UAAU,WAAW;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,UAAU,cAAc;IACvB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,cAAc,CA6C9D;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAyGxG;AAED,UAAU,WAAW;IACpB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,QAAQ,IAAI,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAgB,OAAO,IAAI,WAAW,CAyBrC;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,UAAU,KAAK,CAAC,CAIzD;AAED,wBAAgB,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAyBvE;AAED,qBAAa,aAAc,SAAQ,OAAO;IACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAErB,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW;IAOnD,IAAI,OAAO,IAAI,WAAW,CAWzB;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAwB;IAE7D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAyB;IAC7D,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAuB;IAE3D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAyB;IAC9D,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAuB;CAC5D;AAED,UAAU,oBAAqB,SAAQ,QAAQ;IAC9C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAC9C,KAAK,IAAI,oBAAoB,CAAC;IAC9B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QACtD,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACrE,GAAG,oBAAoB,CAAC;IACzB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,oBAAoB,CAAC;IAC3F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;IACrD,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;IAC7E,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAChD,OAAO,IAAI,oBAAoB,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,oBAAoB,CAAC;IAClH,qBAAqB,IAAI,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,cAAc;IAO/D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,cAAc;IAO1D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc;IAO3C,MAAM,CAAC,IAAI,IAAI,cAAc;CAM7B;AAED,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAElD,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAO;gBAClB,OAAO,SAAiE;CAIrF;AAED,qBAAa,WAAY,SAAQ,aAAa;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACtC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAEzB,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW;IAoCnD;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,CAMjB;IAED,kFAAkF;IAClF,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAK/B,8EAA8E;IAC9E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAGtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,WAAW;IAUxH,IAAI,SAAS,IAAI,GAAG,CAKnB;IAED,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlC;IACD,IAAI,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAsB;IAEzD,IAAI,EAAE,IAAI,MAAM,CAaf;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAmB;IAEnC,IAAI,QAAQ,IAAI,MAAM,CAUrB;IACD,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAyB;IAE/C,IAAI,QAAQ,IAAI,MAAM,CAKrB;IACD,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAyB;IAEzC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAapC,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGvC;IAED,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAKpC,YAAY,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GAAG,IAAI;IAKxE,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAK9B,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAO5D,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAK7C,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG/C;AAED,cAAM,aAAc,SAAQ,cAAc;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEhB,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,YAAY;IAOvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAKtC,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,KAAK,IAAI,aAAa;IAKtB;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI;IAQxB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAMvB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAMxB,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAMnC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;QAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QACtD,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAChE,GAAG,aAAa;IAYtB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,aAAa;IAIvF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,aAAa;IAK7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,aAAa;IAKrE,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa;IAKxC,OAAO,IAAI,aAAa;IAOxB,IAAI,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,aAAa;IAQ9G,qBAAqB,IAAI,IAAI;IAkB7B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,aAAa;IAO9D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,aAAa;IAIzD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa;IAI1C,MAAM,CAAC,IAAI,IAAI,aAAa;IAI5B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,aAAa;IAO7D,sFAAsF;IACtF,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,aAAa;CAG3E;AAED,eAAO,MAAM,YAAY,EAInB,OAAO,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,oBAAoB,CAAC,CAAC;AAE7F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAc/F;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,MAAM,EAAE;gBAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,EACpJ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAqC7B;AAiBD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI5F;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI3G;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxI;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIhH"}
|
package/dist/request.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { setSecurityOverride, getSecurityOverrides } from './security-overrides.js';
|
|
1
2
|
function getRequest() {
|
|
2
3
|
return globalThis.__vesk_request || null;
|
|
3
4
|
}
|
|
@@ -507,20 +508,26 @@ export class VeskRequest extends ServerRequest {
|
|
|
507
508
|
}
|
|
508
509
|
setCsp(policy) {
|
|
509
510
|
this._security.contentSecurityPolicy = policy;
|
|
511
|
+
setSecurityOverride('contentSecurityPolicy', policy);
|
|
510
512
|
}
|
|
511
513
|
setRateLimit(options) {
|
|
512
514
|
this._security.rateLimit = options;
|
|
515
|
+
setSecurityOverride('rateLimit', options);
|
|
513
516
|
}
|
|
514
517
|
setCsrf(enable) {
|
|
515
518
|
this._security.csrf = enable;
|
|
519
|
+
setSecurityOverride('csrf', enable);
|
|
516
520
|
}
|
|
517
521
|
setSecurityHeader(name, value) {
|
|
518
522
|
if (!this._security.customHeaders)
|
|
519
523
|
this._security.customHeaders = {};
|
|
520
524
|
this._security.customHeaders[name] = value;
|
|
525
|
+
const existing = this._security.customHeaders;
|
|
526
|
+
setSecurityOverride('customHeaders', { ...existing });
|
|
521
527
|
}
|
|
522
528
|
setTrustProxy(enable) {
|
|
523
529
|
this._security.trustProxy = enable;
|
|
530
|
+
setSecurityOverride('trustProxy', enable);
|
|
524
531
|
}
|
|
525
532
|
getSecurityOverrides() {
|
|
526
533
|
return this._security;
|
|
@@ -676,7 +683,9 @@ export const VeskResponse = new Proxy(_VeskResponse, {
|
|
|
676
683
|
export function applyRequestSecurity(request, response) {
|
|
677
684
|
if (!request || !response)
|
|
678
685
|
return;
|
|
679
|
-
|
|
686
|
+
// Prefer the per-request channel the servers read from; fall back to the
|
|
687
|
+
// request's own bag so direct callers keep working.
|
|
688
|
+
const overrides = getSecurityOverrides() || request.getSecurityOverrides?.() || {};
|
|
680
689
|
if (overrides.contentSecurityPolicy !== undefined) {
|
|
681
690
|
response.setCsp(overrides.contentSecurityPolicy);
|
|
682
691
|
}
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Per-request security overrides.
|
|
3
|
+
*
|
|
4
|
+
* `VeskRequest.setCsp()`, `.setSecurityHeader()`, `.setRateLimit()` and
|
|
5
|
+
* `.setCsrf()` accumulate overrides while a handler runs, and the servers have
|
|
6
|
+
* to apply them to the outgoing response. That channel did not exist: the
|
|
7
|
+
* setters wrote to a field on the request and nothing ever read it, so every
|
|
8
|
+
* one of those methods was a silent no-op in dev AND prod.
|
|
9
|
+
*
|
|
10
|
+
* The runtime and the adapter servers do not import each other (the runtime is
|
|
11
|
+
* injected into generated code as a string), so the channel is registered on
|
|
12
|
+
* `globalThis` instead of imported. State lives in an AsyncLocalStorage, so two
|
|
13
|
+
* concurrent requests cannot see each other's overrides — a plain module-level
|
|
14
|
+
* slot would let a slow request bleed its CSP into an unrelated one.
|
|
15
|
+
*
|
|
16
|
+
* This module must never touch `document`/`window`: it is pulled in by both
|
|
17
|
+
* the server and the client barrel.
|
|
18
|
+
*/
|
|
19
|
+
type Overrides = Record<string, unknown>;
|
|
20
|
+
/** Run `fn` with a fresh override bag; nested calls get their own bag. */
|
|
21
|
+
export declare function runWithSecurityOverrides<T>(fn: () => T): T;
|
|
22
|
+
/** Record one override. No-op outside a `runWithSecurityOverrides` scope. */
|
|
23
|
+
export declare function setSecurityOverride(key: string, value: unknown): void;
|
|
24
|
+
/** The overrides recorded so far, or null when nothing has been set. */
|
|
25
|
+
export declare function getSecurityOverrides(): Overrides | null;
|
|
26
|
+
export {};
|
|
27
|
+
//# sourceMappingURL=security-overrides.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"security-overrides.d.ts","sourceRoot":"","sources":["../src/security-overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiCzC,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAU1D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAGrE;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,IAAI,SAAS,GAAG,IAAI,CAIvD"}
|
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Per-request security overrides.
|
|
3
|
+
*
|
|
4
|
+
* `VeskRequest.setCsp()`, `.setSecurityHeader()`, `.setRateLimit()` and
|
|
5
|
+
* `.setCsrf()` accumulate overrides while a handler runs, and the servers have
|
|
6
|
+
* to apply them to the outgoing response. That channel did not exist: the
|
|
7
|
+
* setters wrote to a field on the request and nothing ever read it, so every
|
|
8
|
+
* one of those methods was a silent no-op in dev AND prod.
|
|
9
|
+
*
|
|
10
|
+
* The runtime and the adapter servers do not import each other (the runtime is
|
|
11
|
+
* injected into generated code as a string), so the channel is registered on
|
|
12
|
+
* `globalThis` instead of imported. State lives in an AsyncLocalStorage, so two
|
|
13
|
+
* concurrent requests cannot see each other's overrides — a plain module-level
|
|
14
|
+
* slot would let a slow request bleed its CSP into an unrelated one.
|
|
15
|
+
*
|
|
16
|
+
* This module must never touch `document`/`window`: it is pulled in by both
|
|
17
|
+
* the server and the client barrel.
|
|
18
|
+
*/
|
|
19
|
+
const g = globalThis;
|
|
20
|
+
// Node's AsyncLocalStorage, when there is one. Absent in the browser and in
|
|
21
|
+
// bundlers that stub it, where the fallback below keeps everything working
|
|
22
|
+
// (single-request-at-a-time).
|
|
23
|
+
function resolveAls() {
|
|
24
|
+
try {
|
|
25
|
+
const proc = g.process;
|
|
26
|
+
const mod = proc?.getBuiltinModule?.('async_hooks');
|
|
27
|
+
const ctor = mod?.AsyncLocalStorage;
|
|
28
|
+
return ctor ? new ctor() : null;
|
|
29
|
+
}
|
|
30
|
+
catch {
|
|
31
|
+
return null;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
const als = resolveAls();
|
|
35
|
+
// Fallback store for environments without AsyncLocalStorage (browser bundles,
|
|
36
|
+
// edge isolates). Correct for sequential requests, which is all it has to be.
|
|
37
|
+
let fallbackStore = null;
|
|
38
|
+
function current() {
|
|
39
|
+
if (als)
|
|
40
|
+
return als.getStore() ?? null;
|
|
41
|
+
return fallbackStore;
|
|
42
|
+
}
|
|
43
|
+
/** Run `fn` with a fresh override bag; nested calls get their own bag. */
|
|
44
|
+
export function runWithSecurityOverrides(fn) {
|
|
45
|
+
const bag = {};
|
|
46
|
+
if (als)
|
|
47
|
+
return als.run(bag, fn);
|
|
48
|
+
const prev = fallbackStore;
|
|
49
|
+
fallbackStore = bag;
|
|
50
|
+
try {
|
|
51
|
+
return fn();
|
|
52
|
+
}
|
|
53
|
+
finally {
|
|
54
|
+
fallbackStore = prev;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
/** Record one override. No-op outside a `runWithSecurityOverrides` scope. */
|
|
58
|
+
export function setSecurityOverride(key, value) {
|
|
59
|
+
const bag = current();
|
|
60
|
+
if (bag)
|
|
61
|
+
bag[key] = value;
|
|
62
|
+
}
|
|
63
|
+
/** The overrides recorded so far, or null when nothing has been set. */
|
|
64
|
+
export function getSecurityOverrides() {
|
|
65
|
+
const bag = current();
|
|
66
|
+
if (!bag)
|
|
67
|
+
return null;
|
|
68
|
+
return Object.keys(bag).length > 0 ? bag : null;
|
|
69
|
+
}
|
|
70
|
+
// Bridge for the servers, which cannot import this module. Registered at
|
|
71
|
+
// module load so `globalThis.__vesk_security.run(fn)` is always available in a
|
|
72
|
+
// process that has the runtime loaded.
|
|
73
|
+
const bridge = {
|
|
74
|
+
run: runWithSecurityOverrides,
|
|
75
|
+
get: getSecurityOverrides,
|
|
76
|
+
set: setSecurityOverride,
|
|
77
|
+
};
|
|
78
|
+
const existing = g.__vesk_security || {};
|
|
79
|
+
g.__vesk_security = { ...existing, ...bridge };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vesk/runtime",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.66",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Vesk runtime — reactivity, blocks, DOM operations, hydration",
|
|
6
6
|
"main": "./dist/index-client.js",
|
|
@@ -26,6 +26,14 @@
|
|
|
26
26
|
"types": "./dist/store.d.ts",
|
|
27
27
|
"default": "./dist/store.js"
|
|
28
28
|
},
|
|
29
|
+
"./request": {
|
|
30
|
+
"types": "./dist/request.d.ts",
|
|
31
|
+
"default": "./dist/request.js"
|
|
32
|
+
},
|
|
33
|
+
"./security": {
|
|
34
|
+
"types": "./dist/security-overrides.d.ts",
|
|
35
|
+
"default": "./dist/security-overrides.js"
|
|
36
|
+
},
|
|
29
37
|
"./path-store": {
|
|
30
38
|
"types": "./dist/path-store.d.ts",
|
|
31
39
|
"default": "./dist/path-store.js"
|
|
@@ -72,7 +80,7 @@
|
|
|
72
80
|
}
|
|
73
81
|
},
|
|
74
82
|
"dependencies": {
|
|
75
|
-
"@vesk/compiler": "^0.2.
|
|
83
|
+
"@vesk/compiler": "^0.2.66"
|
|
76
84
|
},
|
|
77
85
|
"scripts": {
|
|
78
86
|
"typecheck": "tsc --noEmit",
|