nuxt-security-module 0.0.0-stage → 4.1.0

package/dist/services/getDefaultSecurityHeaders.js

@@ -0,0 +1,85 @@
+import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+//#region src/services/getDefaultSecurityHeaders.ts
+const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
+	contentSecurityPolicy: {
+		"base-uri": ["'none'"],
+		"default-src": ["'self'"],
+		"font-src": [
+			"'self'",
+			"https:",
+			"data:"
+		],
+		"form-action": ["'self'"],
+		"frame-ancestors": ["'self'"],
+		"img-src": ["'self'", "data:"],
+		"object-src": ["'none'"],
+		"script-src": isStrict ? [
+			"'self'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		] : [
+			"'self'",
+			"https:",
+			"'unsafe-inline'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		],
+		"script-src-attr": ["'none'"],
+		"style-src": [
+			"'self'",
+			"https:",
+			"'unsafe-inline'"
+		],
+		"upgrade-insecure-requests": true
+	},
+	crossOriginEmbedderPolicy: isDevelopment ? CrossOriginEmbedderPolicy.UnsafeNone : CrossOriginEmbedderPolicy.Credentialless,
+	crossOriginOpenerPolicy: "same-origin",
+	crossOriginResourcePolicy: "same-origin",
+	originAgentCluster: "?1",
+	permissionsPolicy: {
+		accelerometer: [],
+		autoplay: [],
+		camera: [],
+		"clipboard-read": [],
+		"clipboard-write": [],
+		"cross-origin-isolated": [],
+		"display-capture": [],
+		"encrypted-media": [],
+		fullscreen: [],
+		gamepad: [],
+		geolocation: [],
+		gyroscope: [],
+		hid: [],
+		"idle-detection": [],
+		"interest-cohort": [],
+		"keyboard-map": [],
+		magnetometer: [],
+		microphone: [],
+		midi: [],
+		payment: [],
+		"picture-in-picture": [],
+		"publickey-credentials-get": [],
+		"screen-wake-lock": [],
+		serial: [],
+		"sync-xhr": ["self"],
+		unload: [],
+		usb: [],
+		"web-share": [],
+		"xr-spatial-tracking": []
+	},
+	referrerPolicy: "no-referrer",
+	strictTransportSecurity: {
+		includeSubdomains: true,
+		maxAge: 63072e3,
+		preload: false
+	},
+	xContentTypeOptions: "nosniff",
+	xDNSPrefetchControl: "off",
+	xDownloadOptions: "noopen",
+	xFrameOptions: XFrameOptions.SameOrigin,
+	xPermittedCrossDomainPolicies: "none"
+});
+//#endregion
+export { getDefaultSecurityHeaders };

package/dist/services/getPluginTemplate.js

@@ -0,0 +1,10 @@
+//#region src/services/getPluginTemplate.ts
+const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
+	`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
+	`import data from ${JSON.stringify(dataPath)};`,
+	"",
+	`export default ${factoryName}(data);`,
+	""
+].join("\n");
+//#endregion
+export { getPluginTemplate };

package/dist/services/getRemoveLoggersViteConfig.js

@@ -0,0 +1,4 @@
+//#region src/services/getRemoveLoggersViteConfig.ts
+const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
+//#endregion
+export { getRemoveLoggersViteConfig };

package/dist/services/getRouteRulesTemplate.js

@@ -0,0 +1,4 @@
+//#region src/services/getRouteRulesTemplate.ts
+const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
+//#endregion
+export { getRouteRulesTemplate };

package/dist/services/getRouteSecurityRules.js

@@ -0,0 +1,17 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+import { mergeModuleOptions } from "./mergeModuleOptions.js";
+//#region src/services/getRouteSecurityRules.ts
+const getRouteSecurityRules = (routeRules, options) => {
+	const routeSecurityRules = {};
+	for (const [route, { security }] of Object.entries(routeRules)) {
+		if (security === void 0) continue;
+		if (Object.hasOwn(security, "basicAuth")) throw new TypeError(`nuxt-security-module: route ${route}: basicAuth cannot be set in a route rule`);
+		const result = moduleOptionsSchema.safeParse(mergeModuleOptions(options, security));
+		if (!result.success) throw new TypeError(`nuxt-security-module: route ${route}: ${formatZodIssues(result.error.issues)}`);
+		routeSecurityRules[route] = security;
+	}
+	return routeSecurityRules;
+};
+//#endregion
+export { getRouteSecurityRules };

package/dist/services/getStaticResourceHeaders.js

@@ -0,0 +1,12 @@
+import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
+//#region src/services/getStaticResourceHeaders.ts
+const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
+	referrerPolicy: headers.referrerPolicy,
+	strictTransportSecurity: headers.strictTransportSecurity,
+	xContentTypeOptions: headers.xContentTypeOptions,
+	xDownloadOptions: headers.xDownloadOptions,
+	xFrameOptions: headers.xFrameOptions,
+	xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
+});
+//#endregion
+export { getStaticResourceHeaders };

package/dist/services/getTypeTemplate.js

@@ -0,0 +1,25 @@
+import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
+//#region src/services/getTypeTemplate.ts
+const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
+import type { ModuleOptions } from '${MODULE_NAME}'
+
+declare module '#${MODULE_NAME}/route-rules.mjs' {
+  const routeRules: Record<string, Partial<ModuleOptions>>
+  export default routeRules
+}
+
+declare module '#${MODULE_NAME}/sri-hashes.mjs' {
+  const sriHashes: Record<string, string>
+  export default sriHashes
+}
+
+declare module 'nitro/types' {
+  interface NitroRuntimeHooks {
+    '${ROUTE_RULES_HOOK}': (routeRules: Record<string, Partial<ModuleOptions>>) => void | Promise<void>
+  }
+}
+
+export {}
+`;
+//#endregion
+export { getTypeTemplate };

package/dist/services/mergeModuleOptions.js

@@ -0,0 +1,39 @@
+//#region src/services/mergeModuleOptions.ts
+const mergeModuleOptions = (defaults, overrides) => ({
+	...defaults,
+	...overrides,
+	headers: mergeHeaders(defaults.headers, overrides.headers),
+	ssg: overrides.ssg === false ? false : {
+		...defaults.ssg,
+		...overrides.ssg
+	}
+});
+const mergeHeaders = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	return {
+		...defaults,
+		...overrides,
+		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
+		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
+	};
+};
+const mergeDirectives = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
+	else if (Array.isArray(value)) merged[directive] = [.../* @__PURE__ */ new Set([...Array.isArray(merged[directive]) ? merged[directive] : [], ...value])];
+	else merged[directive] = value;
+	return merged;
+};
+const mergeFeatures = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
+	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
+	return merged;
+};
+//#endregion
+export { mergeModuleOptions };

package/dist/services/parseModuleOptions.js

@@ -0,0 +1,10 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+//#region src/services/parseModuleOptions.ts
+const parseModuleOptions = (options) => {
+	const result = moduleOptionsSchema.safeParse(options);
+	if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
+	return result.data;
+};
+//#endregion
+export { parseModuleOptions };

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "nuxt-security-module",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "4.1.0",
+  "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
+  "license": "Apache-2.0",
+  "author": "Jimmy Chen",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Esposter/Esposter.git"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "dist/index.d.ts",
+  "imports": {
+    "#src/*": "./src/*.ts"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./runtime/constants": "./dist/runtime/constants.js",
+    "./runtime/nitro/plugins/hidePoweredBy": "./dist/runtime/nitro/plugins/hidePoweredBy.js",
+    "./runtime/nitro/plugins/nonce": "./dist/runtime/nitro/plugins/nonce.js",
+    "./runtime/nitro/plugins/routeRules": "./dist/runtime/nitro/plugins/routeRules.js",
+    "./runtime/nitro/plugins/securityHeaders": "./dist/runtime/nitro/plugins/securityHeaders.js",
+    "./runtime/nitro/plugins/ssgHashes": "./dist/runtime/nitro/plugins/ssgHashes.js",
+    "./runtime/nitro/plugins/subresourceIntegrity": "./dist/runtime/nitro/plugins/subresourceIntegrity.js",
+    "./runtime/server/middleware/allowedMethodsRestricter": "./dist/runtime/server/middleware/allowedMethodsRestricter.js",
+    "./runtime/server/middleware/basicAuth": "./dist/runtime/server/middleware/basicAuth.js",
+    "./runtime/server/middleware/corsHandler": "./dist/runtime/server/middleware/corsHandler.js",
+    "./runtime/server/middleware/csrf": "./dist/runtime/server/middleware/csrf.js",
+    "./runtime/server/middleware/rateLimiter": "./dist/runtime/server/middleware/rateLimiter.js",
+    "./runtime/server/middleware/requestSizeLimiter": "./dist/runtime/server/middleware/requestSizeLimiter.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "bench": "vitest bench --run",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
+    "lint": "eslint .",
+    "lint:fix": "eslint --fix .",
+    "test": "vitest",
+    "typecheck": "tsc"
+  },
+  "dependencies": {
+    "@nuxt/kit": "npm:@nuxt/kit-nightly@5x",
+    "@nuxt/schema": "npm:@nuxt/schema-nightly@5x",
+    "defu": "^6.1.7",
+    "rou3": "^1.0.0",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/core": "^0.18.5",
+    "@esposter/configuration": "4.1.0",
+    "@esposter/shared-node": "4.1.0",
+    "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
+    "@types/node": "^26.6.5",
+    "fast-check": "^4.10.2",
+    "h3": "^2.0.2",
+    "nitro": "npm:nitro-nightly@latest",
+    "publint": "^0.3.25",
+    "tsdown": "^0.23.1",
+    "vitest": "^5.0.4"
+  },
+  "peerDependencies": {
+    "nitro": "npm:nitro-nightly@latest",
+    "nuxt": "npm:nuxt-nightly@5x"
+  },
+  "gitHead": "68de4c22fa7591bf6f6cc0fab2c9a906d8c4d71a"
+}