@zudojs/http 0.1.0 → 1.1.0

package/dist/httpCors/http.cors.js

@@ -0,0 +1,480 @@
+/**
+ * HTTP CORS utilities.
+ *
+ * Provides parsing, validation, policy evaluation, and response-header
+ * generation for Cross-Origin Resource Sharing.
+ */
+import { assertSafeHeaderValue } from "../httpHeaders/security/index.js";
+/* -------------------------------------------------------------------------- */
+/* Constants                                                                  */
+/* -------------------------------------------------------------------------- */
+export const CORS_ORIGIN_HEADER = "Access-Control-Allow-Origin";
+export const CORS_METHODS_HEADER = "Access-Control-Allow-Methods";
+export const CORS_HEADERS_HEADER = "Access-Control-Allow-Headers";
+export const CORS_EXPOSE_HEADERS_HEADER = "Access-Control-Expose-Headers";
+export const CORS_CREDENTIALS_HEADER = "Access-Control-Allow-Credentials";
+export const CORS_MAX_AGE_HEADER = "Access-Control-Max-Age";
+export const CORS_REQUEST_METHOD_HEADER = "Access-Control-Request-Method";
+export const CORS_REQUEST_HEADERS_HEADER = "Access-Control-Request-Headers";
+export const CORS_VARY_HEADER = "Vary";
+export const DEFAULT_CORS_METHODS = Object.freeze([
+    "GET",
+    "HEAD",
+    "PUT",
+    "PATCH",
+    "POST",
+    "DELETE",
+]);
+export const DEFAULT_OPTIONS_SUCCESS_STATUS = 204;
+/* -------------------------------------------------------------------------- */
+/* Origin                                                                     */
+/* -------------------------------------------------------------------------- */
+export function normalizeOrigin(origin) {
+    if (origin === undefined || origin === null) {
+        return undefined;
+    }
+    const value = origin.trim();
+    if (value.length === 0) {
+        return undefined;
+    }
+    return value;
+}
+export function isWildcardOrigin(origin) {
+    return normalizeOrigin(origin) === "*";
+}
+/**
+ * Canonicalises an origin for comparison.
+ *
+ * An origin is scheme + host + port. Scheme and host are case-insensitive, the
+ * default port is implicit, and there is no path — so `HTTPS://App.Example.com`
+ * and `https://app.example.com:443/` are the same origin and must compare
+ * equal, while anything that is not a parseable http(s) origin falls back to a
+ * trimmed, lower-cased literal so that `"null"` still compares by value.
+ */
+export function canonicalizeOrigin(origin) {
+    const normalized = normalizeOrigin(origin);
+    if (!normalized) {
+        return undefined;
+    }
+    if (normalized === "*" || normalized.toLowerCase() === "null") {
+        return normalized === "*" ? "*" : "null";
+    }
+    try {
+        const url = new URL(normalized);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            return normalized.toLowerCase();
+        }
+        return url.origin.toLowerCase();
+    }
+    catch {
+        return normalized.toLowerCase();
+    }
+}
+/**
+ * Expands a configured origin into its literal entries. A `"*"` anywhere in an
+ * array is a wildcard for the whole list — the previous code only recognised
+ * the bare-string form, so `{ origin: ["*"], credentials: true }` passed the
+ * wildcard-plus-credentials guard and then reflected any origin verbatim.
+ */
+function configuredOriginList(configured) {
+    if (configured === undefined || typeof configured === "function") {
+        return undefined;
+    }
+    return typeof configured === "string" ? [configured] : [...configured];
+}
+/**
+ * True when the configured origin permits every origin.
+ */
+export function hasWildcardOrigin(configured) {
+    const list = configuredOriginList(configured);
+    if (!list) {
+        return false;
+    }
+    return list.some((entry) => entry.trim() === "*");
+}
+export function isNullOrigin(origin) {
+    return normalizeOrigin(origin) === "null";
+}
+export function isValidOrigin(origin) {
+    const normalized = normalizeOrigin(origin);
+    if (!normalized) {
+        return false;
+    }
+    if (normalized === "*" || normalized === "null") {
+        return true;
+    }
+    try {
+        const url = new URL(normalized);
+        return url.protocol === "http:" || url.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/* -------------------------------------------------------------------------- */
+/* Methods                                                                    */
+/* -------------------------------------------------------------------------- */
+export function normalizeMethods(methods) {
+    if (methods === undefined) {
+        return DEFAULT_CORS_METHODS;
+    }
+    const values = typeof methods === "string" ? splitHeaderList(methods) : methods;
+    return uniqueCaseInsensitive(values.map((method) => method.trim().toUpperCase()).filter(Boolean));
+}
+export function isMethodAllowed(method, allowedMethods) {
+    if (!method) {
+        return false;
+    }
+    const normalized = method.trim().toUpperCase();
+    return normalizeMethods(allowedMethods).some((allowed) => allowed === normalized);
+}
+/* -------------------------------------------------------------------------- */
+/* Headers                                                                    */
+/* -------------------------------------------------------------------------- */
+export function normalizeHeaderNames(headers) {
+    if (headers === undefined) {
+        return [];
+    }
+    const values = typeof headers === "string" ? splitHeaderList(headers) : headers;
+    return uniqueCaseInsensitive(values.map((header) => header.trim().toLowerCase()).filter(Boolean));
+}
+export function areHeadersAllowed(requestedHeaders, allowedHeaders) {
+    const requested = normalizeHeaderNames(requestedHeaders);
+    if (requested.length === 0) {
+        return true;
+    }
+    const allowed = normalizeHeaderNames(allowedHeaders);
+    if (allowed.includes("*")) {
+        return true;
+    }
+    return requested.every((header) => allowed.includes(header));
+}
+export function parseRequestedHeaders(value) {
+    return normalizeHeaderNames(value ?? undefined);
+}
+/* -------------------------------------------------------------------------- */
+/* Origin Matching                                                            */
+/* -------------------------------------------------------------------------- */
+/**
+ * Decides whether a request origin is permitted by the configured origin.
+ *
+ * Matching is **exact on the canonical origin**. It is deliberately not
+ * `startsWith`, `endsWith`, `includes` or an unescaped regex built from the
+ * configured value: against `https://example.com`, all of those admit
+ * `https://evil-example.com.attacker.com`, `https://example.com.evil.tld` or
+ * `https://example.como`. A caller that needs subdomain matching must supply a
+ * predicate function and take responsibility for anchoring it.
+ *
+ * The opaque origin `null` (sandboxed iframes, `file://`, some redirects) is
+ * only allowed when `"null"` is configured explicitly. It is never covered by
+ * `"*"`, because reflecting it grants access to content any page can produce.
+ */
+export async function matchesOrigin(configured, requestOrigin) {
+    if (!requestOrigin || configured === undefined) {
+        return false;
+    }
+    const origin = normalizeOrigin(requestOrigin);
+    if (!origin) {
+        return false;
+    }
+    if (typeof configured === "function") {
+        return Boolean(await configured(origin));
+    }
+    const canonical = canonicalizeOrigin(origin);
+    if (!canonical) {
+        return false;
+    }
+    const list = configuredOriginList(configured) ?? [];
+    const explicit = list.some((entry) => canonicalizeOrigin(entry) === canonical);
+    if (explicit) {
+        return true;
+    }
+    if (canonical === "null") {
+        return false;
+    }
+    return list.some((entry) => entry.trim() === "*");
+}
+/* -------------------------------------------------------------------------- */
+/* Policy                                                                     */
+/* -------------------------------------------------------------------------- */
+export function createCorsPolicy(options = {}) {
+    const origin = options.origin ?? "*";
+    const methods = normalizeMethods(options.methods);
+    const allowedHeaders = normalizeHeaderNames(options.allowedHeaders);
+    const exposedHeaders = normalizeHeaderNames(options.exposedHeaders);
+    const credentials = options.credentials ?? false;
+    const wildcard = hasWildcardOrigin(origin);
+    /*
+     * Checked against the whole normalised set, not just the bare-string form:
+     * `{ origin: ["*"], credentials: true }` used to pass here and then reflect
+     * the request origin verbatim alongside
+     * `Access-Control-Allow-Credentials: true`, which is a total same-origin
+     * policy bypass for every origin on the internet.
+     */
+    if (credentials && wildcard) {
+        throw new TypeError("Wildcard CORS origin cannot be used with credentials.");
+    }
+    if (options.maxAge !== undefined) {
+        validateMaxAge(options.maxAge);
+    }
+    return {
+        origin,
+        methods,
+        allowedHeaders,
+        exposedHeaders,
+        credentials,
+        maxAge: options.maxAge,
+        wildcard,
+        preflightContinue: options.preflightContinue ?? false,
+        optionsSuccessStatus: getPreflightStatus(options),
+    };
+}
+/* -------------------------------------------------------------------------- */
+/* Request Classification                                                     */
+/* -------------------------------------------------------------------------- */
+export function isCorsRequest(request) {
+    return Boolean(normalizeOrigin(request.origin));
+}
+export function isPreflightRequest(request) {
+    return Boolean(normalizeOrigin(request.origin) &&
+        request.method?.trim().toUpperCase() === "OPTIONS" &&
+        request.requestMethod);
+}
+export function isSimpleCorsRequest(request) {
+    return isCorsRequest(request) && !isPreflightRequest(request);
+}
+/* -------------------------------------------------------------------------- */
+/* Preflight                                                                  */
+/* -------------------------------------------------------------------------- */
+export function validatePreflight(request, policy) {
+    if (!isPreflightRequest(request)) {
+        return false;
+    }
+    if (!request.requestMethod ||
+        !isMethodAllowed(request.requestMethod, policy.methods)) {
+        return false;
+    }
+    const requestedHeaders = parseRequestedHeaders(request.requestHeaders);
+    return areHeadersAllowed(requestedHeaders, policy.allowedHeaders);
+}
+/* -------------------------------------------------------------------------- */
+/* Response Headers                                                           */
+/* -------------------------------------------------------------------------- */
+export async function createCorsHeaders(request, policy) {
+    const origin = normalizeOrigin(request.origin);
+    if (!origin) {
+        return {};
+    }
+    const originAllowed = await matchesOrigin(policy.origin, origin);
+    if (!originAllowed) {
+        return {};
+    }
+    const headers = {};
+    const wildcardOrigin = policy.wildcard ?? hasWildcardOrigin(policy.origin);
+    if (wildcardOrigin && !policy.credentials) {
+        headers[CORS_ORIGIN_HEADER] = "*";
+    }
+    else {
+        /*
+         * Reflection. The value came off the wire, so it goes through the single
+         * hardened header validator before it can reach a response.
+         */
+        assertSafeHeaderValue(origin);
+        headers[CORS_ORIGIN_HEADER] = origin;
+    }
+    if (policy.credentials) {
+        headers[CORS_CREDENTIALS_HEADER] = "true";
+    }
+    if (policy.exposedHeaders.length > 0) {
+        headers[CORS_EXPOSE_HEADERS_HEADER] = policy.exposedHeaders.join(", ");
+    }
+    if (isPreflightRequest(request)) {
+        if (policy.methods.length > 0) {
+            headers[CORS_METHODS_HEADER] = policy.methods.join(", ");
+        }
+        if (policy.allowedHeaders.length > 0) {
+            headers[CORS_HEADERS_HEADER] = policy.allowedHeaders.join(", ");
+        }
+        if (policy.maxAge !== undefined) {
+            headers[CORS_MAX_AGE_HEADER] = String(policy.maxAge);
+        }
+    }
+    return headers;
+}
+/* -------------------------------------------------------------------------- */
+/* Full Evaluation                                                            */
+/* -------------------------------------------------------------------------- */
+export async function evaluateCors(request, options) {
+    const policy = isCorsPolicy(options) ? options : createCorsPolicy(options);
+    const origin = normalizeOrigin(request.origin);
+    if (!origin) {
+        return {
+            allowed: false,
+            headers: {},
+            preflight: false,
+            vary: [],
+        };
+    }
+    const originAllowed = await matchesOrigin(policy.origin, origin);
+    if (!originAllowed) {
+        return {
+            allowed: false,
+            headers: {},
+            preflight: isPreflightRequest(request),
+            /* A rejection is always origin-dependent, so it always varies. */
+            vary: [...new Set(["Origin", ...getCorsVaryHeaders(request, policy)])],
+        };
+    }
+    const preflight = isPreflightRequest(request);
+    if (preflight && !validatePreflight(request, policy)) {
+        return {
+            allowed: false,
+            headers: {},
+            preflight: true,
+            vary: ["Origin", CORS_REQUEST_METHOD_HEADER, CORS_REQUEST_HEADERS_HEADER],
+        };
+    }
+    const headers = await createCorsHeaders(request, policy);
+    const vary = getCorsVaryHeaders(request, policy);
+    return {
+        allowed: true,
+        headers,
+        preflight,
+        vary,
+    };
+}
+/* -------------------------------------------------------------------------- */
+/* Vary                                                                       */
+/* -------------------------------------------------------------------------- */
+export function getCorsVaryHeaders(request, policy) {
+    const vary = new Set();
+    const wildcardOrigin = policy.wildcard ?? hasWildcardOrigin(policy.origin);
+    /*
+     * `Vary: Origin` is omitted only when the response genuinely does not depend
+     * on the origin, i.e. a credential-less wildcard that always emits `*`.
+     * Anything else — reflection, an allowlist, a predicate — must vary, or a
+     * shared cache will hand one origin's grant to every later requester.
+     */
+    if (!wildcardOrigin || policy.credentials) {
+        vary.add("Origin");
+    }
+    if (isPreflightRequest(request)) {
+        vary.add(CORS_REQUEST_METHOD_HEADER);
+        if (request.requestHeaders) {
+            vary.add(CORS_REQUEST_HEADERS_HEADER);
+        }
+    }
+    return [...vary];
+}
+export function formatVaryHeader(values) {
+    return uniqueCaseInsensitive(values).join(", ");
+}
+/* -------------------------------------------------------------------------- */
+/* Middleware Helpers                                                         */
+/* -------------------------------------------------------------------------- */
+export function shouldHandlePreflight(request) {
+    return isPreflightRequest(request);
+}
+export function getPreflightStatus(options = {}) {
+    const status = options.optionsSuccessStatus ?? DEFAULT_OPTIONS_SUCCESS_STATUS;
+    if (!Number.isInteger(status) || status < 200 || status > 299) {
+        throw new RangeError("optionsSuccessStatus must be a valid 2xx HTTP status.");
+    }
+    return status;
+}
+/* -------------------------------------------------------------------------- */
+/* Serialization                                                              */
+/* -------------------------------------------------------------------------- */
+export function serializeCorsHeaders(headers, vary) {
+    const result = {
+        ...headers,
+    };
+    if (vary && vary.length > 0) {
+        result[CORS_VARY_HEADER] = formatVaryHeader(vary);
+    }
+    return result;
+}
+/* -------------------------------------------------------------------------- */
+/* Middleware Decision                                                        */
+/* -------------------------------------------------------------------------- */
+/**
+ * Evaluates a request against a CORS policy and returns everything a
+ * middleware needs: whether to answer the request itself, with what status,
+ * and which headers to set.
+ *
+ * This is the function a CORS middleware should be built on. It differs from
+ * the naive "always set `Access-Control-Allow-Origin: *`" approach in four
+ * ways that each matter:
+ *
+ * 1. A request with no `Origin` gets no CORS headers at all.
+ * 2. A disallowed origin gets no `Access-Control-Allow-Origin`, so the browser
+ *    blocks the read — rather than the server advertising a grant it did not
+ *    intend.
+ * 3. `Vary: Origin` is emitted on every origin-dependent response, allowed or
+ *    not, so a CDN cannot serve one origin's grant to another.
+ * 4. A preflight is answered here, before the router can 404/405 it.
+ */
+export async function evaluateCorsDecision(request, options) {
+    const policy = isCorsPolicy(options) ? options : createCorsPolicy(options);
+    const preflight = isPreflightRequest(request);
+    if (!isCorsRequest(request)) {
+        return {
+            isCorsRequest: false,
+            preflight: false,
+            allowed: false,
+            terminate: false,
+            status: policy.optionsSuccessStatus ?? DEFAULT_OPTIONS_SUCCESS_STATUS,
+            headers: {},
+        };
+    }
+    const result = await evaluateCors(request, policy);
+    const vary = result.vary.length > 0 ? result.vary : ["Origin"];
+    const status = policy.optionsSuccessStatus ?? DEFAULT_OPTIONS_SUCCESS_STATUS;
+    return {
+        isCorsRequest: true,
+        preflight,
+        allowed: result.allowed,
+        terminate: preflight && !(policy.preflightContinue ?? false),
+        status,
+        headers: serializeCorsHeaders(result.headers, vary),
+    };
+}
+/* -------------------------------------------------------------------------- */
+/* Internal Helpers                                                           */
+/* -------------------------------------------------------------------------- */
+function splitHeaderList(value) {
+    return value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function uniqueCaseInsensitive(values) {
+    const result = [];
+    const seen = new Set();
+    for (const value of values) {
+        const normalized = value.trim();
+        if (normalized.length === 0) {
+            continue;
+        }
+        const key = normalized.toLowerCase();
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        result.push(normalized);
+    }
+    return result;
+}
+function validateMaxAge(value) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new RangeError("CORS maxAge must be a non-negative safe integer.");
+    }
+}
+function isCorsPolicy(value) {
+    return ("methods" in value &&
+        Array.isArray(value.methods) &&
+        "allowedHeaders" in value &&
+        "exposedHeaders" in value &&
+        "credentials" in value);
+}
+//# sourceMappingURL=http.cors.js.map

package/dist/httpCsp/checks/httpCsp.checks.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CSP policy check functions.
+ */
+import type { CSPDirectives } from "../types/httpCsp.type.js";
+export declare function allowsSource(policy: string | CSPDirectives, directive: string, source: string): boolean;
+export declare function allowsInlineScript(policy: string | CSPDirectives): boolean;
+export declare function allowsEval(policy: string | CSPDirectives): boolean;
+export declare function allowsNonce(policy: string | CSPDirectives, nonce: string): boolean;
+//# sourceMappingURL=httpCsp.checks.d.ts.map

package/dist/httpCsp/checks/httpCsp.checks.js

@@ -0,0 +1,30 @@
+/**
+ * CSP policy check functions.
+ */
+import { getCSPDirective, getEffectiveDirective, } from "../parsing/httpCsp.parsing.js";
+import { sourceMatchesHost } from "../internal/httpCsp.internal.js";
+import { createNonceSource } from "../nonce/httpCsp.nonce.js";
+export function allowsSource(policy, directive, source) {
+    const values = getCSPDirective(policy, directive);
+    const normalized = source.trim();
+    if (values.includes("'none'")) {
+        return false;
+    }
+    if (values.includes("*")) {
+        return true;
+    }
+    return values.some((value) => value === normalized || sourceMatchesHost(value, normalized));
+}
+export function allowsInlineScript(policy) {
+    const values = getEffectiveDirective(policy, "script-src");
+    return values.includes("'unsafe-inline'");
+}
+export function allowsEval(policy) {
+    const values = getEffectiveDirective(policy, "script-src");
+    return (values.includes("'unsafe-eval'") || values.includes("'wasm-unsafe-eval'"));
+}
+export function allowsNonce(policy, nonce) {
+    const values = getEffectiveDirective(policy, "script-src");
+    return values.includes(createNonceSource(nonce));
+}
+//# sourceMappingURL=httpCsp.checks.js.map

package/dist/httpCsp/checks/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP policy check utilities.
+ */
+export { allowsSource, allowsInlineScript, allowsEval, allowsNonce, } from "./httpCsp.checks.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/checks/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP policy check utilities.
+ */
+export { allowsSource, allowsInlineScript, allowsEval, allowsNonce, } from "./httpCsp.checks.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/formatting/httpCsp.formatting.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CSP formatting and creation functions.
+ */
+import type { CSPDirectiveValue, CSPDirectives, CSPOptions, CSPResult } from "../types/httpCsp.type.js";
+export declare function formatCSP(directives: CSPDirectives | Readonly<Record<string, CSPDirectiveValue>>): string;
+export declare function createCSP(options?: CSPOptions | undefined): CSPResult;
+//# sourceMappingURL=httpCsp.formatting.d.ts.map

package/dist/httpCsp/formatting/httpCsp.formatting.js

@@ -0,0 +1,70 @@
+/**
+ * CSP formatting and creation functions.
+ */
+import { normalizeDirectiveName } from "../validation/httpCsp.validation.js";
+import { validateCSP } from "../validation/httpCsp.validate.js";
+import { normalizeDirectiveValues, freezeDirectives, addOptionalDirective, mergeDirectives, } from "../internal/httpCsp.internal.js";
+export function formatCSP(directives) {
+    const parts = [];
+    for (const [rawName, rawValues] of Object.entries(directives)) {
+        const name = normalizeDirectiveName(rawName);
+        const values = normalizeDirectiveValues(rawValues);
+        if (values.length === 0) {
+            parts.push(name);
+            continue;
+        }
+        parts.push(`${name} ${values.join(" ")}`);
+    }
+    return parts.join("; ");
+}
+export function createCSP(options = {}) {
+    const directives = {};
+    if (options.directives) {
+        mergeDirectives(directives, options.directives);
+    }
+    addOptionalDirective(directives, "default-src", options.defaultSrc);
+    addOptionalDirective(directives, "script-src", options.scriptSrc);
+    addOptionalDirective(directives, "style-src", options.styleSrc);
+    addOptionalDirective(directives, "img-src", options.imgSrc);
+    addOptionalDirective(directives, "font-src", options.fontSrc);
+    addOptionalDirective(directives, "connect-src", options.connectSrc);
+    addOptionalDirective(directives, "media-src", options.mediaSrc);
+    addOptionalDirective(directives, "object-src", options.objectSrc);
+    addOptionalDirective(directives, "frame-src", options.frameSrc);
+    addOptionalDirective(directives, "child-src", options.childSrc);
+    addOptionalDirective(directives, "worker-src", options.workerSrc);
+    addOptionalDirective(directives, "manifest-src", options.manifestSrc);
+    addOptionalDirective(directives, "base-uri", options.baseUri);
+    addOptionalDirective(directives, "form-action", options.formAction);
+    addOptionalDirective(directives, "frame-ancestors", options.frameAncestors);
+    addOptionalDirective(directives, "navigate-to", options.navigateTo);
+    addOptionalDirective(directives, "report-uri", options.reportUri);
+    addOptionalDirective(directives, "report-to", options.reportTo);
+    addOptionalDirective(directives, "sandbox", options.sandbox);
+    addOptionalDirective(directives, "require-trusted-types-for", options.requireTrustedTypesFor);
+    addOptionalDirective(directives, "trusted-types", options.trustedTypes);
+    if (options.upgradeInsecureRequests) {
+        directives["upgrade-insecure-requests"] = [];
+    }
+    if (options.blockAllMixedContent) {
+        directives["block-all-mixed-content"] = [];
+    }
+    const frozen = freezeDirectives(directives);
+    /*
+     * Belt and braces. `normalizeDirectiveValues` already rejects `;`, `,` and
+     * control characters at construction time, but `createCSP` can also be
+     * handed a pre-built `directives` record, and this is the last point before
+     * a policy string is produced. `validateCSP` previously existed with no
+     * call site at all.
+     */
+    if (!validateCSP(frozen)) {
+        throw new TypeError("Invalid Content-Security-Policy: a directive name or value is malformed.");
+    }
+    const policy = formatCSP(frozen);
+    return {
+        policy,
+        header: policy,
+        directives: frozen,
+    };
+}
+//# sourceMappingURL=httpCsp.formatting.js.map

package/dist/httpCsp/formatting/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP formatting utilities.
+ */
+export { formatCSP, createCSP } from "./httpCsp.formatting.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/formatting/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP formatting utilities.
+ */
+export { formatCSP, createCSP } from "./httpCsp.formatting.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/internal/httpCsp.internal.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Internal CSP helpers for splitting, normalizing, and freezing directives.
+ */
+import type { CSPDirectiveValue, CSPDirectives } from "../types/httpCsp.type.js";
+export declare function splitPolicy(value: string): string[];
+/**
+ * Splits and trims a directive value, rejecting anything that could change the
+ * shape of the resulting header.
+ *
+ * The check lives here, at the single point every directive value passes
+ * through, so no code path can construct an injected directive object in the
+ * first place — rather than relying on a validator that a caller might skip.
+ */
+export declare function normalizeDirectiveValues(values: CSPDirectiveValue): string[];
+export declare function freezeDirectives(directives: Record<string, readonly string[]>): CSPDirectives;
+export declare function addOptionalDirective(target: Record<string, readonly string[]>, name: string, value: CSPDirectiveValue | undefined): void;
+export declare function mergeDirectives(target: Record<string, readonly string[]>, source: Readonly<Record<string, CSPDirectiveValue>>): void;
+export declare function sourceMatchesHost(configured: string, requested: string): boolean;
+//# sourceMappingURL=httpCsp.internal.d.ts.map