nuxt-csp-report 1.0.0-alpha.3 → 1.0.0

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-csp-report",
   "configKey": "cspReport",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/api/csp-report.post.js

@@ -1,4 +1,4 @@
-import { useRuntimeConfig, useStorage, readBody, defineEventHandler } from "#imports";
+import { useRuntimeConfig, useStorage, readBody, defineEventHandler, setResponseStatus } from "#imports";
 import { normalizeCspReport } from "../utils/normalizeCspReport.js";
 import { formatCspLog } from "../utils/formatCspLog.js";
 const runtimeConfig = useRuntimeConfig();
@@ -27,6 +27,7 @@ export default defineEventHandler(async (event) => {
     return { ok: true };
   } catch (err) {
     console.error("[nuxt-csp-report]", err);
-    return { ok: true };
+    setResponseStatus(event, 500);
+    return { ok: false };
   }
 });

package/dist/runtime/server/utils/normalizeCspReport.d.ts

@@ -41,7 +41,7 @@ declare const reportToEntrySchema: z.ZodObject<{
     url: z.ZodString;
     user_agent: z.ZodString;
 }, z.core.$loose>;
-declare const reportToSchema: z.ZodArray<z.ZodObject<{
+declare const _reportToSchema: z.ZodArray<z.ZodObject<{
     age: z.ZodNumber;
     body: z.ZodObject<{
         blockedURL: z.ZodString;
@@ -64,6 +64,6 @@ declare const reportToSchema: z.ZodArray<z.ZodObject<{
     user_agent: z.ZodString;
 }, z.core.$loose>>;
 export type ReportToEntryFormat = z.infer<typeof reportToEntrySchema>;
-export type ReportToFormat = z.infer<typeof reportToSchema>;
+export type ReportToFormat = z.infer<typeof _reportToSchema>;
 export declare function normalizeCspReport(input: unknown): NormalizedCspReport[];
 export {};

package/dist/runtime/server/utils/normalizeCspReport.js

@@ -32,42 +32,45 @@ const reportToEntrySchema = z.object({
   type: z.string(),
   url: z.string(),
   user_agent: z.string()
-}).passthrough();
-const reportToSchema = reportToEntrySchema.array();
+}).loose();
+const _reportToSchema = reportToEntrySchema.array();
 export function normalizeCspReport(input) {
-  if (!input) {
-    return [];
+  if (!input) return [];
+  if (typeof input === "object" && input !== null && "csp-report" in input) {
+    const parsed = reportUriSchema.safeParse(input);
+    if (!parsed.success) return [];
+    const report = parsed.data["csp-report"];
+    return [{
+      raw: parsed.data,
+      timestamp: Date.now(),
+      documentURL: report["document-uri"],
+      blockedURL: report["blocked-uri"],
+      directive: report["violated-directive"],
+      sourceFile: report["source-file"],
+      line: report["line-number"],
+      disposition: report["disposition"]
+    }];
   }
-  try {
-    if (typeof input === "object" && "csp-report" in input) {
-      const parsed = reportUriSchema.parse(input);
-      return [{
-        raw: parsed,
+  if (Array.isArray(input)) {
+    const reports = [];
+    for (const entry of input) {
+      const parsed = reportToEntrySchema.safeParse(entry);
+      if (!parsed.success) continue;
+      if (parsed.data.type !== "csp-violation") continue;
+      const { body } = parsed.data;
+      reports.push({
+        raw: parsed.data,
         timestamp: Date.now(),
-        documentURL: parsed["csp-report"]["document-uri"],
-        blockedURL: parsed["csp-report"]["blocked-uri"],
-        directive: parsed["csp-report"]["violated-directive"],
-        sourceFile: parsed["csp-report"]["source-file"],
-        line: parsed["csp-report"]["line-number"],
-        disposition: parsed["csp-report"]["disposition"]
-      }];
-    }
-    if (Array.isArray(input)) {
-      const parsed = reportToSchema.parse(input);
-      return parsed.map((item) => {
-        return {
-          raw: item,
-          timestamp: Date.now(),
-          documentURL: item.body.documentURL,
-          blockedURL: item.body.blockedURL,
-          directive: item.body.effectiveDirective,
-          sourceFile: item.body.sourceFile,
-          line: item.body.lineNumber,
-          disposition: item.body.disposition
-        };
+        documentURL: body.documentURL,
+        blockedURL: body.blockedURL,
+        directive: body.effectiveDirective,
+        sourceFile: body.sourceFile,
+        line: body.lineNumber,
+        column: body.columnNumber,
+        disposition: body.disposition
       });
     }
-  } catch {
+    return reports;
   }
   return [];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-csp-report",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0",
   "description": "A Nuxt module for collecting, normalizing, and persisting Content Security Policy reports",
   "repository": {
     "type": "git",
@@ -63,7 +63,7 @@
     "dev": "pnpm dev:prepare && nuxi dev playground",
     "dev:build": "nuxi build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
-    "release": "pnpm lint && pnpm test && pnpm prepack && changelogen --release --prerelease alpha && pnpm publish --tag alpha && git push --follow-tags",
+    "release": "pnpm lint && pnpm test && pnpm prepack && changelogen --release && pnpm publish && git push --follow-tags",
     "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest watch",