nuxt-security-module 4.2.0 → 4.3.1

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/allowedMethodsRestricter.d.ts
+declare const allowedMethodsRestricter: Middleware;
+//#endregion
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -0,0 +1,15 @@
+import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+//#region src/runtime/server/middleware/allowedMethodsRestricter.ts
+const allowedMethodsRestricter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
+	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
+		status: 405,
+		statusText: "Method not allowed"
+	});
+});
+//#endregion
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/basicAuth.d.ts
+declare const basicAuthMiddleware: Middleware;
+//#endregion
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -0,0 +1,23 @@
+import "../../constants.js";
+import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
+import { checkIsChallenged } from "../../services/checkIsChallenged.js";
+import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
+import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+import { useRuntimeConfig } from "nuxt/server";
+//#region src/runtime/server/middleware/basicAuth.ts
+const basicAuthMiddleware = defineMiddleware((event) => {
+	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
+	if (!basicAuth) return;
+	const { pathname } = event.url;
+	if (!checkIsChallenged(pathname, basicAuth)) return;
+	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
+	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
+	throw new HTTPError({
+		status: 401,
+		statusText: "Access denied"
+	});
+});
+//#endregion
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/corsHandler.d.ts
+declare const corsHandler: Middleware;
+//#endregion
+export { corsHandler as default };

package/dist/runtime/server/middleware/corsHandler.js

@@ -0,0 +1,20 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { handleCors } from "nitro/h3";
+//#region src/runtime/server/middleware/corsHandler.ts
+const corsHandler = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.corsHandler) return;
+	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
+	handleCors(event, {
+		allowHeaders,
+		credentials,
+		exposeHeaders,
+		maxAge,
+		methods,
+		origin: [origin].flat(),
+		preflight
+	});
+});
+//#endregion
+export { corsHandler as default };

package/dist/runtime/server/middleware/csrf.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/csrf.d.ts
+declare const csrf: Middleware;
+//#endregion
+export { csrf as default };

package/dist/runtime/server/middleware/csrf.js

@@ -0,0 +1,28 @@
+import { CSRF_UNSAFE_METHODS } from "../../constants.js";
+import { checkIsCsrfTokenValid } from "../../services/checkIsCsrfTokenValid.js";
+import { generateRandomToken } from "../../services/generateRandomToken.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getCookie, setCookie } from "nitro/h3";
+//#region src/runtime/server/middleware/csrf.ts
+const csrf = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.csrf) return;
+	const { cookieName, headerName } = rules.csrf;
+	const cookieToken = getCookie(event, cookieName);
+	if (!CSRF_UNSAFE_METHODS.includes(event.req.method)) {
+		if (cookieToken === void 0) setCookie(event, cookieName, generateRandomToken(32), {
+			httpOnly: false,
+			path: "/",
+			sameSite: "strict",
+			secure: event.url.protocol === "https:"
+		});
+		return;
+	}
+	if (!checkIsCsrfTokenValid(cookieToken, event.req.headers.get(headerName))) throw new HTTPError({
+		status: 403,
+		statusText: "Forbidden"
+	});
+});
+//#endregion
+export { csrf as default };

package/dist/runtime/server/middleware/rateLimiter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/rateLimiter.d.ts
+declare const rateLimiter: Middleware;
+//#endregion
+export { rateLimiter as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -0,0 +1,22 @@
+import { MAX_RATE_LIMIT_ENTRIES } from "../../constants.js";
+import { createInMemoryRateLimiterStore } from "../../services/createInMemoryRateLimiterStore.js";
+import { getRetryAfterSeconds } from "../../services/getRetryAfterSeconds.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getRequestIP } from "nitro/h3";
+//#region src/runtime/server/middleware/rateLimiter.ts
+const rateLimiterStore = createInMemoryRateLimiterStore(MAX_RATE_LIMIT_ENTRIES);
+const rateLimiter = defineMiddleware(async (event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.rateLimiter) return;
+	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
+	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
+	if (retryAfterSeconds === void 0) return;
+	event.res.headers.set("Retry-After", String(retryAfterSeconds));
+	throw new HTTPError({
+		status: 429,
+		statusText: "Too Many Requests"
+	});
+});
+//#endregion
+export { rateLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/requestSizeLimiter.d.ts
+declare const requestSizeLimiter: Middleware;
+//#endregion
+export { requestSizeLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -0,0 +1,17 @@
+import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+//#region src/runtime/server/middleware/requestSizeLimiter.ts
+const requestSizeLimiter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.requestSizeLimiter) return;
+	const contentLength = event.req.headers.get("content-length");
+	const contentType = event.req.headers.get("content-type");
+	if (checkIsRequestTooLarge(event.req.method, contentLength, contentType, rules.requestSizeLimiter)) throw new HTTPError({
+		status: 413,
+		statusText: "Payload Too Large"
+	});
+});
+//#endregion
+export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBasicAuthorized.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/checkIsBasicAuthorized.d.ts
+export declare const checkIsBasicAuthorized: (authorization: null | string, { name, pass }: BasicAuthOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -0,0 +1,12 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
+//#region src/runtime/services/checkIsBasicAuthorized.ts
+const checkIsBasicAuthorized = (authorization, { name, pass }) => {
+	const credentials = getBasicAuthCredentials(authorization);
+	if (!credentials) return false;
+	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);
+	const isPassEqual = checkIsEqualInConstantTime(credentials.pass, pass);
+	return isNameEqual && isPassEqual;
+};
+//#endregion
+export { checkIsBasicAuthorized };

package/dist/runtime/services/checkIsChallenged.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/checkIsChallenged.d.ts
+export declare const checkIsChallenged: (path: string, { exclude, include }: BasicAuthOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsChallenged.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/checkIsChallenged.ts
+const checkIsChallenged = (path, { exclude = [], include = [] }) => {
+	const isIncluded = include.some((prefix) => path.startsWith(prefix));
+	const isExcluded = exclude.some((prefix) => path.startsWith(prefix));
+	return isIncluded || !isExcluded;
+};
+//#endregion
+export { checkIsChallenged };

package/dist/runtime/services/checkIsCsrfTokenValid.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsCsrfTokenValid.d.ts
+export declare const checkIsCsrfTokenValid: (cookieToken: string | undefined, headerToken: null | string) => boolean;
+//#endregion

package/dist/runtime/services/checkIsCsrfTokenValid.js

@@ -0,0 +1,8 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+//#region src/runtime/services/checkIsCsrfTokenValid.ts
+const checkIsCsrfTokenValid = (cookieToken, headerToken) => {
+	if (!cookieToken || !headerToken) return false;
+	return checkIsEqualInConstantTime(cookieToken, headerToken);
+};
+//#endregion
+export { checkIsCsrfTokenValid };

package/dist/runtime/services/checkIsEqualInConstantTime.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsEqualInConstantTime.d.ts
+export declare const checkIsEqualInConstantTime: (first: string, second: string) => boolean;
+//#endregion

package/dist/runtime/services/checkIsEqualInConstantTime.js

@@ -0,0 +1,11 @@
+//#region src/runtime/services/checkIsEqualInConstantTime.ts
+const checkIsEqualInConstantTime = (first, second) => {
+	const firstBytes = new TextEncoder().encode(first);
+	const secondBytes = new TextEncoder().encode(second);
+	if (firstBytes.length !== secondBytes.length) return false;
+	let difference = 0;
+	for (const [index, byte] of firstBytes.entries()) difference |= byte ^ (secondBytes[index] ?? 0);
+	return difference === 0;
+};
+//#endregion
+export { checkIsEqualInConstantTime };

package/dist/runtime/services/checkIsMethodAllowed.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsMethodAllowed.d.ts
+export declare const checkIsMethodAllowed: (method: string, methods: string[]) => boolean;
+//#endregion

package/dist/runtime/services/checkIsMethodAllowed.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/checkIsMethodAllowed.ts
+const checkIsMethodAllowed = (method, methods) => methods.includes(method);
+//#endregion
+export { checkIsMethodAllowed };

package/dist/runtime/services/checkIsRecord.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsRecord.d.ts
+export declare const checkIsRecord: (value: unknown) => value is Record<string, unknown>;
+//#endregion

package/dist/runtime/services/checkIsRecord.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/checkIsRecord.ts
+const checkIsRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#endregion
+export { checkIsRecord };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -0,0 +1,4 @@
+import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
+//#region src/runtime/services/checkIsRequestTooLarge.d.ts
+export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -0,0 +1,9 @@
+import { SIZE_LIMITED_METHODS } from "../constants.js";
+//#region src/runtime/services/checkIsRequestTooLarge.ts
+const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
+	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
+	const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
+	return Math.trunc(Number(contentLength)) >= limit;
+};
+//#endregion
+export { checkIsRequestTooLarge };

package/dist/runtime/services/collectSsgHashes.d.ts

@@ -0,0 +1,5 @@
+import { SsgOptions } from "../../models/SsgOptions.js";
+import { SecurityState } from "./getSecurityState.js";
+//#region src/runtime/services/collectSsgHashes.d.ts
+export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;
+//#endregion

package/dist/runtime/services/collectSsgHashes.js

@@ -0,0 +1,41 @@
+import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
+import { generateHash } from "./generateHash.js";
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+//#region src/runtime/services/collectSsgHashes.ts
+const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
+	"audioworklet",
+	"paintworklet",
+	"script",
+	"xslt"
+]);
+const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
+	const integrity = readHtmlTagAttribute(attributes, "integrity");
+	if (name === "script" && hashScripts) {
+		const source = readHtmlTagAttribute(attributes, "src");
+		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
+		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+		return;
+	}
+	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+	if (name !== "link" || integrity === void 0) return void 0;
+	const rel = readHtmlTagAttribute(attributes, "rel");
+	const as = readHtmlTagAttribute(attributes, "as") ?? "";
+	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
+	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
+};
+const collectSsgHashes = async (html, options) => {
+	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
+		(elementName ?? tagName ?? "").toLowerCase(),
+		elementAttributes ?? tagAttributes ?? "",
+		body
+	]);
+	const hashSources = await Promise.all(elements.map((element) => getSsgHashSource(element, options)));
+	const hashes = {
+		script: [],
+		style: []
+	};
+	for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
+	return hashes;
+};
+//#endregion
+export { collectSsgHashes };

package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts

@@ -0,0 +1,4 @@
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+//#region src/runtime/services/createInMemoryRateLimiterStore.d.ts
+export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;
+//#endregion

package/dist/runtime/services/createInMemoryRateLimiterStore.js

@@ -0,0 +1,22 @@
+//#region src/runtime/services/createInMemoryRateLimiterStore.ts
+const createInMemoryRateLimiterStore = (maxEntries) => {
+	const windows = /* @__PURE__ */ new Map();
+	return { increment: (key, intervalInMilliseconds) => {
+		const now = Date.now();
+		const current = windows.get(key);
+		const window = current && current.resetAt > now ? {
+			count: current.count + 1,
+			resetAt: current.resetAt
+		} : {
+			count: 1,
+			resetAt: now + intervalInMilliseconds
+		};
+		windows.delete(key);
+		windows.set(key, window);
+		const [oldestKey] = windows.keys();
+		if (windows.size > maxEntries && oldestKey !== void 0) windows.delete(oldestKey);
+		return Promise.resolve(window);
+	} };
+};
+//#endregion
+export { createInMemoryRateLimiterStore };

package/dist/runtime/services/generateHash.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateHash.d.ts
+export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;
+//#endregion

package/dist/runtime/services/generateHash.js

@@ -0,0 +1,9 @@
+//#region src/runtime/services/generateHash.ts
+const generateHash = async (content, hashAlgorithm) => {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
+	const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
+	const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
+	return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
+};
+//#endregion
+export { generateHash };

package/dist/runtime/services/generateNonce.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateNonce.d.ts
+export declare const generateNonce: () => string;
+//#endregion

package/dist/runtime/services/generateNonce.js

@@ -0,0 +1,6 @@
+import "../constants.js";
+import { generateRandomToken } from "./generateRandomToken.js";
+//#region src/runtime/services/generateNonce.ts
+const generateNonce = () => generateRandomToken(18);
+//#endregion
+export { generateNonce };

package/dist/runtime/services/generateRandomToken.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateRandomToken.d.ts
+export declare const generateRandomToken: (byteLength: number) => string;
+//#endregion

package/dist/runtime/services/generateRandomToken.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/generateRandomToken.ts
+const generateRandomToken = (byteLength) => {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
+};
+//#endregion
+export { generateRandomToken };

package/dist/runtime/services/getBasicAuthCredentials.d.ts

@@ -0,0 +1,6 @@
+//#region src/runtime/services/getBasicAuthCredentials.d.ts
+export declare const getBasicAuthCredentials: (authorization: null | string) => undefined | {
+  name: string;
+  pass: string;
+};
+//#endregion

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -0,0 +1,19 @@
+import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
+//#region src/runtime/services/getBasicAuthCredentials.ts
+const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
+const BASE64_QUANTUM_LENGTH = 4;
+const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
+const getBasicAuthCredentials = (authorization) => {
+	if (!authorization?.startsWith(`Basic `)) return void 0;
+	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();
+	if (!checkIsBase64(encoded)) return void 0;
+	const decoded = new TextDecoder().decode(Uint8Array.fromBase64(encoded));
+	const separatorIndex = decoded.indexOf(":");
+	if (separatorIndex === -1) return void 0;
+	return {
+		name: decoded.slice(0, separatorIndex),
+		pass: decoded.slice(separatorIndex + 1)
+	};
+};
+//#endregion
+export { getBasicAuthCredentials };

package/dist/runtime/services/getBasicAuthOptions.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/getBasicAuthOptions.d.ts
+export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;
+//#endregion

package/dist/runtime/services/getBasicAuthOptions.js

@@ -0,0 +1,17 @@
+import { checkIsRecord } from "./checkIsRecord.js";
+//#region src/runtime/services/getBasicAuthOptions.ts
+const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+const getBasicAuthOptions = (privateRuntimeConfig) => {
+	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
+	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;
+	if (typeof name !== "string" || typeof pass !== "string") return void 0;
+	return {
+		...checkIsStringList(exclude) && { exclude },
+		...checkIsStringList(include) && { include },
+		...typeof message === "string" && { message },
+		name,
+		pass
+	};
+};
+//#endregion
+export { getBasicAuthOptions };

package/dist/runtime/services/getRetryAfterSeconds.d.ts

@@ -0,0 +1,5 @@
+import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+//#region src/runtime/services/getRetryAfterSeconds.d.ts
+export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;
+//#endregion

package/dist/runtime/services/getRetryAfterSeconds.js

@@ -0,0 +1,9 @@
+//#region src/runtime/services/getRetryAfterSeconds.ts
+const MILLISECONDS_PER_SECOND = 1e3;
+const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
+	const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
+	if (count <= tokensPerInterval) return void 0;
+	return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
+};
+//#endregion
+export { getRetryAfterSeconds };

package/dist/runtime/services/getSecurityRules.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+import { H3Event } from "nitro/h3";
+//#region src/runtime/services/getSecurityRules.d.ts
+export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;
+//#endregion

package/dist/runtime/services/getSecurityRules.js

@@ -0,0 +1,15 @@
+import { mergeSecurityRules } from "./mergeSecurityRules.js";
+import { findSecurityRules } from "./securityRouteMatcher.js";
+//#region src/runtime/services/getSecurityRules.ts
+const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityRules = (event) => {
+	const cachedRules = securityRulesByEvent.get(event);
+	if (cachedRules) return cachedRules;
+	const matchedRules = findSecurityRules(event.url.pathname);
+	if (!matchedRules) return void 0;
+	const rules = mergeSecurityRules(...matchedRules.toReversed());
+	securityRulesByEvent.set(event, rules);
+	return rules;
+};
+//#endregion
+export { getSecurityRules };

package/dist/runtime/services/getSecurityState.d.ts

@@ -0,0 +1,11 @@
+import { H3Event } from "nitro/h3";
+//#region src/runtime/services/getSecurityState.d.ts
+export interface SecurityState {
+  hashes: {
+    script: string[];
+    style: string[];
+  };
+  nonce?: string;
+}
+export declare const getSecurityState: (event: H3Event) => SecurityState;
+//#endregion

package/dist/runtime/services/getSecurityState.js

@@ -0,0 +1,14 @@
+//#region src/runtime/services/getSecurityState.ts
+const securityStateByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityState = (event) => {
+	const cachedState = securityStateByEvent.get(event);
+	if (cachedState) return cachedState;
+	const state = { hashes: {
+		script: [],
+		style: []
+	} };
+	securityStateByEvent.set(event, state);
+	return state;
+};
+//#endregion
+export { getSecurityState };

package/dist/runtime/services/injectNonce.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/injectNonce.d.ts
+export declare const injectNonce: (html: string, nonce: string) => string;
+//#endregion

package/dist/runtime/services/injectNonce.js

@@ -0,0 +1,7 @@
+import { NONCE_TAG_NAMES } from "../constants.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
+//#region src/runtime/services/injectNonce.ts
+const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
+//#endregion
+export { injectNonce };

package/dist/runtime/services/injectSubresourceIntegrity.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/injectSubresourceIntegrity.d.ts
+export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;
+//#endregion

package/dist/runtime/services/injectSubresourceIntegrity.js

@@ -0,0 +1,22 @@
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+//#region src/runtime/services/injectSubresourceIntegrity.ts
+const RESOURCE_ATTRIBUTE_NAMES = {
+	link: "href",
+	script: "src"
+};
+const INTEGRITY_LINK_RELS = /* @__PURE__ */ new Set([
+	"modulepreload",
+	"preload",
+	"stylesheet"
+]);
+const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagName, attributes) => {
+	const resourceAttributeName = RESOURCE_ATTRIBUTE_NAMES[tagName.toLowerCase()];
+	if (!resourceAttributeName || readHtmlTagAttribute(attributes, "integrity") !== void 0) return void 0;
+	const resource = readHtmlTagAttribute(attributes, resourceAttributeName);
+	if (resource === void 0 || hashes[resource] === void 0) return void 0;
+	if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
+	return ` integrity="${hashes[resource]}"${attributes}`;
+});
+//#endregion
+export { injectSubresourceIntegrity };

package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts

@@ -0,0 +1,4 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+//#region src/runtime/services/insertContentSecurityPolicyMeta.d.ts
+export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;
+//#endregion

package/dist/runtime/services/insertContentSecurityPolicyMeta.js

@@ -0,0 +1,17 @@
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+//#region src/runtime/services/insertContentSecurityPolicyMeta.ts
+const META_CONTENT_SECURITY_POLICY_REGEX = /<meta\s+http-equiv=["']Content-Security-Policy["'][^>]*>/iu;
+const HEAD_CHARSET_REGEX = /<meta\s+charset=["'][^"']*["'][^>]*>/iu;
+const HEAD_OPEN_REGEX = /<head\b[^>]*>/iu;
+const insertContentSecurityPolicyMeta = (html, policy) => {
+	const metaTag = `<meta http-equiv="Content-Security-Policy" content="${serializeContentSecurityPolicy({
+		...policy,
+		"frame-ancestors": false
+	})}">`;
+	if (META_CONTENT_SECURITY_POLICY_REGEX.test(html)) return html.replace(META_CONTENT_SECURITY_POLICY_REGEX, metaTag);
+	const insertion = HEAD_CHARSET_REGEX.exec(html) ?? HEAD_OPEN_REGEX.exec(html);
+	const insertAt = insertion ? insertion.index + insertion[0].length : 0;
+	return html.slice(0, insertAt) + metaTag + html.slice(insertAt);
+};
+//#endregion
+export { insertContentSecurityPolicyMeta };

package/dist/runtime/services/mergeSecurityRules.d.ts

@@ -0,0 +1,4 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+//#region src/runtime/services/mergeSecurityRules.d.ts
+export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;
+//#endregion

package/dist/runtime/services/mergeSecurityRules.js

@@ -0,0 +1,11 @@
+import { createDefu } from "defu";
+//#region src/runtime/services/mergeSecurityRules.ts
+const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
+	if (Array.isArray(object[key]) || Array.isArray(value)) {
+		object[key] = value;
+		return true;
+	}
+});
+const mergeSecurityRules = (...rules) => mergeRulesWithReplacedArrays({}, ...rules);
+//#endregion
+export { mergeSecurityRules };

package/dist/runtime/services/readHtmlTagAttribute.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/readHtmlTagAttribute.d.ts
+export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;
+//#endregion