nuxt-security-module 4.2.0 → 4.3.3

package/README.md

@@ -1,22 +1,48 @@
 # nuxt-security-module
 
+[![Apache-2.0 licensed][badge-license]][url-license]
+[![NPM version][badge-npm-version]][url-npm]
+[![NPM downloads][badge-npm-downloads]][url-npm]
+[![NPM Unpacked Size (with version)][badge-npm-unpacked-size]][url-npm]
+
 Nuxt security module for [Nitro 3](https://nitro.build) and h3 2. It sets security headers on rendered pages, a per-request nonce Content Security Policy with the nonce written onto the page's own tags, subresource integrity, a prerender policy as a `<meta>` element, the framework's `X-Powered-By` header removed, CORS, allowed methods, basic auth and a request size limit.
 
-It replaces [nuxt-security](https://github.com/Baroshem/nuxt-security). Its upstream audit, every issue it was held to, and the defaults it ships are on the documentation page: [nuxt-security-module](https://github.com/Esposter/Esposter/blob/main/apps/web/content/docs/nuxt-security-module/index.md).
+It replaces [nuxt-security](https://github.com/Baroshem/nuxt-security). Its upstream audit, every issue it was held to, and the defaults it ships are on the documentation page: [nuxt-security-module](https://github.com/Esposter/Esposter/blob/main/openspec/specs/nuxt-security-module/README.md).
 
 ## Table of Contents
 
+- 🚀 [Getting Started](#getting-started)
 - 📖 [Documentation](#documentation)
 - ⚖️ [License](#license)
 
 ---
 
+## <a name="getting-started">🚀 Getting Started</a>
+
+```bash
+pnpm i nuxt-security-module
+```
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({ modules: ["nuxt-security-module"] });
+```
+
 ## <a name="documentation">📖 Documentation</a>
 
-The module's option reference, its upstream audit and its defaults review live in the repository's documentation section, under `apps/web/content/docs/nuxt-security-module`. The package's status and the steps not yet built are on its index page.
+We highly recommend you take a look at the [documentation](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module) to level up.
+
+The module's option reference, its upstream audit and its defaults review live in the repository's [specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module). The package's status and the steps not yet built are in its `README.md` there.
 
 ---
 
 ## <a name="license">⚖️ License</a>
 
 Apache-2.0
+
+[badge-license]: https://img.shields.io/github/license/Esposter/Esposter.svg?color=blue
+[url-license]: https://github.com/Esposter/Esposter/blob/main/LICENSE
+[badge-npm-version]: https://img.shields.io/npm/v/nuxt-security-module/latest?color=brightgreen
+[url-npm]: https://www.npmjs.com/package/nuxt-security-module/v/latest
+[badge-npm-unpacked-size]: https://img.shields.io/npm/unpacked-size/nuxt-security-module/latest?label=npm
+[badge-npm-downloads]: https://img.shields.io/npm/dm/nuxt-security-module.svg

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+import { ModuleOptions } from "./models/ModuleOptions.js";
+import { SecurityRouteRules } from "./models/SecurityRouteRules.js";
+import { NuxtModule } from "@nuxt/schema";
+declare module "@nuxt/schema" {
+  interface NuxtConfig {
+    security?: Partial<ModuleOptions>;
+  }
+}
+declare module "h3/rules" {
+  interface RouteRuleConfig {
+    security?: SecurityRouteRules;
+  }
+}
+declare const securityModule: NuxtModule<Partial<ModuleOptions>>;
+export { type ModuleOptions, securityModule as default };

package/dist/index.js

@@ -0,0 +1,104 @@
+import { MODULE_NAME } from "./runtime/constants.js";
+import { checkIsRecord } from "./runtime/services/checkIsRecord.js";
+import { computeSubresourceIntegrityHashes } from "./services/computeSubresourceIntegrityHashes.js";
+import { getDefaultModuleOptions } from "./services/getDefaultModuleOptions.js";
+import { getPluginTemplate } from "./services/getPluginTemplate.js";
+import { getRemoveLoggersViteConfig } from "./services/getRemoveLoggersViteConfig.js";
+import { getRouteRulesTemplate } from "./services/getRouteRulesTemplate.js";
+import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
+import { getRouteSecurityRules } from "./services/getRouteSecurityRules.js";
+import { getStaticResourceHeaders } from "./services/getStaticResourceHeaders.js";
+import { getTypeTemplate } from "./services/getTypeTemplate.js";
+import { parseModuleOptions } from "./services/parseModuleOptions.js";
+import { defu } from "defu";
+import { addNitroPlugin, addServerHandler, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
+// src/module.ts
+const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
+const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
+const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
+const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
+const securityModule = defineNuxtModule({
+	meta: {
+		compatibility: { nuxt: ">=5.0.0-0" },
+		configKey: "security",
+		name: MODULE_NAME
+	},
+	setup(userOptions, nuxt) {
+		const options = parseModuleOptions(mergeModuleOptions(getDefaultModuleOptions(nuxt.options.dev, nuxt.options.devServer.url, userOptions.strict === true), userOptions));
+		if (!options.enabled) return;
+		const resolver = createResolver(import.meta.url);
+		const { basicAuth, ...publicOptions } = options;
+		if (basicAuth) {
+			const { private: privateRuntimeConfig } = nuxt.options.runtimeConfig;
+			nuxt.options.runtimeConfig.private = defu(checkIsRecord(privateRuntimeConfig) ? privateRuntimeConfig : {}, { basicAuth });
+		}
+		const routeSecurityRules = getRouteSecurityRules(nuxt.options.routeRules ?? {}, options);
+		addServerTemplate({
+			filename: ROUTE_RULES_TEMPLATE_FILENAME,
+			getContents: () => getRouteRulesTemplate({
+				"/**": publicOptions,
+				...routeSecurityRules
+			})
+		});
+		addServerTemplate({
+			filename: ROUTE_RULES_PLUGIN_FILENAME,
+			getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/routeRules"), "createRouteRulesPlugin", ROUTE_RULES_TEMPLATE_FILENAME)
+		});
+		addNitroPlugin(ROUTE_RULES_PLUGIN_FILENAME);
+		if (options.removeLoggers) nuxt.options.vite = defu(getRemoveLoggersViteConfig(), nuxt.options.vite);
+		if (options.headers) nuxt.options.routeRules = defu({ "/**": { headers: getStaticResourceHeaders(options.headers) } }, nuxt.options.routeRules);
+		if (options.nonce) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/nonce"));
+		if (options.sri) {
+			addServerTemplate({
+				filename: SRI_PLUGIN_FILENAME,
+				getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/subresourceIntegrity"), "createSubresourceIntegrityPlugin", SRI_HASHES_TEMPLATE_FILENAME)
+			});
+			addNitroPlugin(SRI_PLUGIN_FILENAME);
+		}
+		if (options.ssg) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/ssgHashes"));
+		if (options.headers) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/securityHeaders"));
+		if (options.hidePoweredBy) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/hidePoweredBy"));
+		if (options.csrf) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/csrf"),
+			middleware: true
+		});
+		if (options.rateLimiter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/rateLimiter"),
+			middleware: true
+		});
+		if (options.requestSizeLimiter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/requestSizeLimiter"),
+			middleware: true
+		});
+		if (options.corsHandler) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/corsHandler"),
+			middleware: true
+		});
+		if (options.allowedMethodsRestricter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/allowedMethodsRestricter"),
+			middleware: true
+		});
+		if (basicAuth) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/basicAuth"),
+			middleware: true
+		});
+		let sriHashes = {};
+		if (options.sri) {
+			addServerTemplate({
+				filename: SRI_HASHES_TEMPLATE_FILENAME,
+				getContents: () => `export default ${JSON.stringify(sriHashes)}\n`
+			});
+			nuxt.hook("nitro:build:before", async (nitro) => {
+				sriHashes = await computeSubresourceIntegrityHashes(nitro);
+			});
+		}
+		addTypeTemplate({
+			filename: `types/${MODULE_NAME}.d.ts`,
+			getContents: getTypeTemplate
+		}, {
+			nitro: true,
+			nuxt: true
+		});
+	}
+});
+export { securityModule as default };

package/dist/models/AllowedMethodsRestricterOptions.d.ts

@@ -0,0 +1,3 @@
+export interface AllowedMethodsRestricterOptions {
+  methods: string[];
+}

package/dist/models/BasicAuthOptions.d.ts

@@ -0,0 +1,7 @@
+export interface BasicAuthOptions {
+  exclude?: string[];
+  include?: string[];
+  message?: string;
+  name: string;
+  pass: string;
+}

package/dist/models/ContentSecurityPolicy.d.ts

@@ -0,0 +1 @@
+export type ContentSecurityPolicy = Record<string, boolean | string[] | undefined>;

package/dist/models/CorsHandlerOptions.d.ts

@@ -0,0 +1,11 @@
+export interface CorsHandlerOptions {
+  allowHeaders?: string[];
+  credentials?: boolean;
+  exposeHeaders?: string[];
+  maxAge?: string;
+  methods: string[];
+  origin: string | string[];
+  preflight?: {
+    statusCode: number;
+  };
+}

package/dist/models/CrossOriginEmbedderPolicy.d.ts

@@ -0,0 +1,6 @@
+export declare const CrossOriginEmbedderPolicy: {
+  readonly Credentialless: "credentialless";
+  readonly RequireCorp: "require-corp";
+  readonly UnsafeNone: "unsafe-none";
+};
+export type CrossOriginEmbedderPolicy = (typeof CrossOriginEmbedderPolicy)[keyof typeof CrossOriginEmbedderPolicy];

package/dist/models/CrossOriginEmbedderPolicy.js

@@ -0,0 +1,7 @@
+// src/models/CrossOriginEmbedderPolicy.ts
+const CrossOriginEmbedderPolicy = {
+	Credentialless: "credentialless",
+	RequireCorp: "require-corp",
+	UnsafeNone: "unsafe-none"
+};
+export { CrossOriginEmbedderPolicy };

package/dist/models/CsrfOptions.d.ts

@@ -0,0 +1,4 @@
+export interface CsrfOptions {
+  cookieName: string;
+  headerName: string;
+}

package/dist/models/ModuleOptions.d.ts

@@ -0,0 +1,25 @@
+import { AllowedMethodsRestricterOptions } from "./AllowedMethodsRestricterOptions.js";
+import { BasicAuthOptions } from "./BasicAuthOptions.js";
+import { CorsHandlerOptions } from "./CorsHandlerOptions.js";
+import { CsrfOptions } from "./CsrfOptions.js";
+import { RateLimiterOptions } from "./RateLimiterOptions.js";
+import { RequestSizeLimiterOptions } from "./RequestSizeLimiterOptions.js";
+import { SecurityHeaders } from "./SecurityHeaders.js";
+import { SsgOptions } from "./SsgOptions.js";
+export interface ModuleOptions {
+  allowedMethodsRestricter: AllowedMethodsRestricterOptions | false;
+  basicAuth: BasicAuthOptions | false;
+  contentSecurityPolicyReportOnly: boolean;
+  corsHandler: CorsHandlerOptions | false;
+  csrf: CsrfOptions | false;
+  enabled: boolean;
+  headers: false | SecurityHeaders;
+  hidePoweredBy: boolean;
+  nonce: boolean;
+  rateLimiter: false | RateLimiterOptions;
+  removeLoggers: boolean;
+  requestSizeLimiter: false | RequestSizeLimiterOptions;
+  sri: boolean;
+  ssg: false | SsgOptions;
+  strict: boolean;
+}

package/dist/models/PermissionsPolicy.d.ts

@@ -0,0 +1 @@
+export type PermissionsPolicy = Record<string, false | string[] | undefined>;

package/dist/models/RateLimitWindow.d.ts

@@ -0,0 +1,4 @@
+export interface RateLimitWindow {
+  count: number;
+  resetAt: number;
+}

package/dist/models/RateLimiterOptions.d.ts

@@ -0,0 +1,4 @@
+export interface RateLimiterOptions {
+  intervalInMilliseconds: number;
+  tokensPerInterval: number;
+}

package/dist/models/RateLimiterStore.d.ts

@@ -0,0 +1,4 @@
+import { RateLimitWindow } from "./RateLimitWindow.js";
+export interface RateLimiterStore {
+  increment: (key: string, intervalInMilliseconds: number) => Promise<RateLimitWindow>;
+}

package/dist/models/RequestSizeLimiterOptions.d.ts

@@ -0,0 +1,4 @@
+export interface RequestSizeLimiterOptions {
+  maxRequestSizeInBytes: number;
+  maxUploadFileRequestInBytes: number;
+}

package/dist/models/SecurityHeaders.d.ts

@@ -0,0 +1,20 @@
+import { ContentSecurityPolicy } from "./ContentSecurityPolicy.js";
+import { CrossOriginEmbedderPolicy } from "./CrossOriginEmbedderPolicy.js";
+import { PermissionsPolicy } from "./PermissionsPolicy.js";
+import { StrictTransportSecurity } from "./StrictTransportSecurity.js";
+import { XFrameOptions } from "./XFrameOptions.js";
+export interface SecurityHeaders {
+  contentSecurityPolicy?: ContentSecurityPolicy | false;
+  crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicy | false;
+  crossOriginOpenerPolicy?: false | string;
+  crossOriginResourcePolicy?: false | string;
+  originAgentCluster?: false | string;
+  permissionsPolicy?: false | PermissionsPolicy;
+  referrerPolicy?: false | string;
+  strictTransportSecurity?: false | StrictTransportSecurity;
+  xContentTypeOptions?: false | string;
+  xDNSPrefetchControl?: false | string;
+  xDownloadOptions?: false | string;
+  xFrameOptions?: false | XFrameOptions;
+  xPermittedCrossDomainPolicies?: false | string;
+}

package/dist/models/SecurityRouteRules.d.ts

@@ -0,0 +1,2 @@
+import { ModuleOptions } from "./ModuleOptions.js";
+export type SecurityRouteRules = Partial<ModuleOptions>;

package/dist/models/SecurityRules.d.ts

@@ -0,0 +1,2 @@
+import { ModuleOptions } from "./ModuleOptions.js";
+export type SecurityRules = Partial<ModuleOptions>;

package/dist/models/SsgOptions.d.ts

@@ -0,0 +1,7 @@
+export interface SsgOptions {
+  exportToPresets: boolean;
+  hashScripts: boolean;
+  hashStyles: boolean;
+  meta: boolean;
+  nitroHeaders: boolean;
+}

package/dist/models/StrictTransportSecurity.d.ts

@@ -0,0 +1,5 @@
+export interface StrictTransportSecurity {
+  includeSubdomains: boolean;
+  maxAge: number;
+  preload: boolean;
+}

package/dist/models/XFrameOptions.d.ts

@@ -0,0 +1,5 @@
+export declare const XFrameOptions: {
+  readonly Deny: "DENY";
+  readonly SameOrigin: "SAMEORIGIN";
+};
+export type XFrameOptions = (typeof XFrameOptions)[keyof typeof XFrameOptions];

package/dist/models/XFrameOptions.js

@@ -0,0 +1,6 @@
+// src/models/XFrameOptions.ts
+const XFrameOptions = {
+	Deny: "DENY",
+	SameOrigin: "SAMEORIGIN"
+};
+export { XFrameOptions };

package/dist/runtime/constants.d.ts

@@ -0,0 +1,22 @@
+import { SecurityHeaders } from "../models/SecurityHeaders.js";
+export declare const MODULE_NAME = "nuxt-security-module";
+export declare const ROUTE_RULES_HOOK: `${typeof MODULE_NAME}:routeRules`;
+export declare const SECURITY_HEADER_NAMES: Readonly<Record<keyof SecurityHeaders, string>>;
+export declare const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
+export declare const MAX_RATE_LIMIT_ENTRIES = 1e4;
+export declare const UNKNOWN_CLIENT_KEY = "unknown";
+export declare const CSRF_UNSAFE_METHODS: readonly string[];
+export declare const CSRF_TOKEN_BYTE_LENGTH = 32;
+export declare const NONCE_BYTE_LENGTH = 18;
+export declare const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
+export declare const SRI_HASH_ALGORITHM = "SHA-384";
+export declare const CSP_HASH_ALGORITHM = "SHA-256";
+export declare const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
+export declare const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
+export declare const HTML_ATTRIBUTE_REGEX: RegExp;
+export declare const HTML_TAG_REGEX: RegExp;
+export declare const NONCE_TAG_NAMES: readonly string[];
+export declare const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
+export declare const SIZE_LIMITED_METHODS: readonly string[];
+export declare const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
+export declare const BASIC_AUTHORIZATION_SCHEME = "Basic";

package/dist/runtime/constants.js

@@ -0,0 +1,51 @@
+// src/runtime/constants.ts
+const MODULE_NAME = "nuxt-security-module";
+const ROUTE_RULES_HOOK = `${MODULE_NAME}:routeRules`;
+const SECURITY_HEADER_NAMES = {
+	contentSecurityPolicy: "Content-Security-Policy",
+	crossOriginEmbedderPolicy: "Cross-Origin-Embedder-Policy",
+	crossOriginOpenerPolicy: "Cross-Origin-Opener-Policy",
+	crossOriginResourcePolicy: "Cross-Origin-Resource-Policy",
+	originAgentCluster: "Origin-Agent-Cluster",
+	permissionsPolicy: "Permissions-Policy",
+	referrerPolicy: "Referrer-Policy",
+	strictTransportSecurity: "Strict-Transport-Security",
+	xContentTypeOptions: "X-Content-Type-Options",
+	xDNSPrefetchControl: "X-DNS-Prefetch-Control",
+	xDownloadOptions: "X-Download-Options",
+	xFrameOptions: "X-Frame-Options",
+	xPermittedCrossDomainPolicies: "X-Permitted-Cross-Domain-Policies"
+};
+const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
+const MAX_RATE_LIMIT_ENTRIES = 1e4;
+const UNKNOWN_CLIENT_KEY = "unknown";
+const CSRF_UNSAFE_METHODS = [
+	"DELETE",
+	"PATCH",
+	"POST",
+	"PUT"
+];
+const CSRF_TOKEN_BYTE_LENGTH = 32;
+const NONCE_BYTE_LENGTH = 18;
+const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
+const SRI_HASH_ALGORITHM = "SHA-384";
+const CSP_HASH_ALGORITHM = "SHA-256";
+const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
+const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
+const HTML_ATTRIBUTE_PATTERN = String.raw`\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'<>=]+))?`;
+const HTML_ATTRIBUTE_REGEX = /\s+(?<name>[^\s"'<>/=]+)(?<assignment>\s*=\s*(?<value>"[^"]*"|'[^']*'|[^\s"'<>=]+))?/gu;
+const HTML_TAG_REGEX = new RegExp(String.raw`<(script|style)\b((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>([\s\S]*?)<\/\1\s*>|<([a-z][\w:-]*)((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>`, "giu");
+const NONCE_TAG_NAMES = [
+	"link",
+	"script",
+	"style"
+];
+const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
+const SIZE_LIMITED_METHODS = [
+	"DELETE",
+	"POST",
+	"PUT"
+];
+const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
+const BASIC_AUTHORIZATION_SCHEME = "Basic";
+export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, FILE_UPLOAD_CONTENT_TYPE, HTML_ATTRIBUTE_REGEX, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, PRERENDERED_HEADERS_DIRECTORY_NAME, PRERENDERED_HEADERS_FILE_NAME, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };

package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const hidePoweredBy: NitroAppPlugin;
+export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -0,0 +1,12 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { definePlugin } from "nitro";
+import { isEvent } from "nitro/h3";
+// src/runtime/nitro/plugins/hidePoweredBy.ts
+const hidePoweredBy = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("response", (_response, event) => {
+		if (!isEvent(event)) return;
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.hidePoweredBy) event.res.headers.delete("x-powered-by");
+	});
+});
+export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const noncePlugin: NitroAppPlugin;
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -0,0 +1,26 @@
+import { generateNonce } from "../../services/generateNonce.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { injectNonce } from "../../services/injectNonce.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/nonce.ts
+const HTML_SECTIONS = [
+	"body",
+	"bodyAppend",
+	"bodyPrepend",
+	"head"
+];
+const noncePlugin = definePlugin((nitroApp) => {
+	if (import.meta.prerender) return;
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.nonce) getSecurityState(event).nonce = generateNonce();
+	});
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		const nonce = getSecurityState(event).nonce;
+		if (!rules?.enabled || !rules.nonce || !rules.headers || !rules.headers.contentSecurityPolicy || !nonce) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectNonce(element, nonce));
+	});
+});
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/routeRules.d.ts

@@ -0,0 +1,3 @@
+import { SecurityRules } from "../../../models/SecurityRules.js";
+import { NitroAppPlugin } from "nitro/types";
+export declare const createRouteRulesPlugin: (routeRules: Record<string, SecurityRules>) => NitroAppPlugin;

package/dist/runtime/nitro/plugins/routeRules.js

@@ -0,0 +1,16 @@
+import { ROUTE_RULES_HOOK } from "../../constants.js";
+import { setSecurityRouteMatcher } from "../../services/securityRouteMatcher.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/routeRules.ts
+const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
+	let routesResolved;
+	nitroApp.hooks.hook("request", () => {
+		routesResolved ??= (async () => {
+			const routes = structuredClone(routeRules);
+			await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
+			setSecurityRouteMatcher(routes);
+		})();
+		return routesResolved;
+	});
+});
+export { createRouteRulesPlugin };

package/dist/runtime/nitro/plugins/securityHeaders.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const securityHeaders: NitroAppPlugin;
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/securityHeaders.js

@@ -0,0 +1,24 @@
+import { CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, SECURITY_HEADER_NAMES } from "../../constants.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { serializeSecurityHeaders } from "../../services/serializeSecurityHeaders.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/securityHeaders.ts
+const CONTENT_SECURITY_POLICY_HEADER_NAME = SECURITY_HEADER_NAMES.contentSecurityPolicy;
+const securityHeaders = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.headers) return;
+		const { contentSecurityPolicy } = rules.headers;
+		const serializedHeaders = serializeSecurityHeaders({
+			...rules.headers,
+			contentSecurityPolicy: contentSecurityPolicy ? updateContentSecurityPolicy(contentSecurityPolicy, getSecurityState(event)) : false
+		});
+		for (const [name, value] of Object.entries(serializedHeaders)) {
+			const isPolicy = name === CONTENT_SECURITY_POLICY_HEADER_NAME;
+			event.res.headers.set(isPolicy && rules.contentSecurityPolicyReportOnly ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME : name, value);
+		}
+	});
+});
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const ssgHashes: NitroAppPlugin;
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -0,0 +1,26 @@
+import { collectSsgHashes } from "../../services/collectSsgHashes.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/ssgHashes.ts
+const HTML_SECTIONS = [
+	"head",
+	"bodyPrepend",
+	"body",
+	"bodyAppend"
+];
+const ssgHashes = definePlugin((nitroApp) => {
+	if (!import.meta.prerender) return;
+	nitroApp.hooks.hook("render:html", async (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
+		const state = getSecurityState(event);
+		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
+		if (!rules.ssg.meta) return;
+		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
+		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
+	});
+});
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -0,0 +1,2 @@
+import { NitroAppPlugin } from "nitro/types";
+export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -0,0 +1,18 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/subresourceIntegrity.ts
+const HTML_SECTIONS = [
+	"body",
+	"bodyAppend",
+	"bodyPrepend",
+	"head"
+];
+const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.sri) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
+	});
+});
+export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const allowedMethodsRestricter: Middleware;
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -0,0 +1,14 @@
+import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+// src/runtime/server/middleware/allowedMethodsRestricter.ts
+const allowedMethodsRestricter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
+	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
+		status: 405,
+		statusText: "Method not allowed"
+	});
+});
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const basicAuthMiddleware: Middleware;
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -0,0 +1,22 @@
+import "../../constants.js";
+import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
+import { checkIsChallenged } from "../../services/checkIsChallenged.js";
+import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
+import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+import { useRuntimeConfig } from "nuxt/server";
+// src/runtime/server/middleware/basicAuth.ts
+const basicAuthMiddleware = defineMiddleware((event) => {
+	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
+	if (!basicAuth) return;
+	const { pathname } = event.url;
+	if (!checkIsChallenged(pathname, basicAuth)) return;
+	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
+	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
+	throw new HTTPError({
+		status: 401,
+		statusText: "Access denied"
+	});
+});
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const corsHandler: Middleware;
+export { corsHandler as default };