nuxt-security-module 4.3.1 → 4.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (135) hide show
  1. package/dist/index.d.ts +0 -2
  2. package/dist/index.js +1 -2
  3. package/dist/models/AllowedMethodsRestricterOptions.d.ts +1 -3
  4. package/dist/models/BasicAuthOptions.d.ts +1 -3
  5. package/dist/models/ContentSecurityPolicy.d.ts +1 -3
  6. package/dist/models/CorsHandlerOptions.d.ts +1 -3
  7. package/dist/models/CrossOriginEmbedderPolicy.d.ts +1 -3
  8. package/dist/models/CrossOriginEmbedderPolicy.js +1 -2
  9. package/dist/models/CsrfOptions.d.ts +1 -3
  10. package/dist/models/ModuleOptions.d.ts +1 -3
  11. package/dist/models/PermissionsPolicy.d.ts +1 -3
  12. package/dist/models/RateLimitWindow.d.ts +1 -3
  13. package/dist/models/RateLimiterOptions.d.ts +1 -3
  14. package/dist/models/RateLimiterStore.d.ts +1 -3
  15. package/dist/models/RequestSizeLimiterOptions.d.ts +1 -3
  16. package/dist/models/SecurityHeaders.d.ts +1 -3
  17. package/dist/models/SecurityRouteRules.d.ts +1 -3
  18. package/dist/models/SecurityRules.d.ts +1 -3
  19. package/dist/models/SsgOptions.d.ts +1 -3
  20. package/dist/models/StrictTransportSecurity.d.ts +1 -3
  21. package/dist/models/XFrameOptions.d.ts +1 -3
  22. package/dist/models/XFrameOptions.js +1 -2
  23. package/dist/runtime/constants.d.ts +1 -3
  24. package/dist/runtime/constants.js +1 -2
  25. package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts +0 -2
  26. package/dist/runtime/nitro/plugins/hidePoweredBy.js +1 -2
  27. package/dist/runtime/nitro/plugins/nonce.d.ts +0 -2
  28. package/dist/runtime/nitro/plugins/nonce.js +1 -2
  29. package/dist/runtime/nitro/plugins/routeRules.d.ts +1 -3
  30. package/dist/runtime/nitro/plugins/routeRules.js +1 -2
  31. package/dist/runtime/nitro/plugins/securityHeaders.d.ts +0 -2
  32. package/dist/runtime/nitro/plugins/securityHeaders.js +1 -2
  33. package/dist/runtime/nitro/plugins/ssgHashes.d.ts +0 -2
  34. package/dist/runtime/nitro/plugins/ssgHashes.js +1 -2
  35. package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts +1 -3
  36. package/dist/runtime/nitro/plugins/subresourceIntegrity.js +1 -2
  37. package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts +0 -2
  38. package/dist/runtime/server/middleware/allowedMethodsRestricter.js +1 -2
  39. package/dist/runtime/server/middleware/basicAuth.d.ts +0 -2
  40. package/dist/runtime/server/middleware/basicAuth.js +1 -2
  41. package/dist/runtime/server/middleware/corsHandler.d.ts +0 -2
  42. package/dist/runtime/server/middleware/corsHandler.js +1 -2
  43. package/dist/runtime/server/middleware/csrf.d.ts +0 -2
  44. package/dist/runtime/server/middleware/csrf.js +1 -2
  45. package/dist/runtime/server/middleware/rateLimiter.d.ts +0 -2
  46. package/dist/runtime/server/middleware/rateLimiter.js +1 -2
  47. package/dist/runtime/server/middleware/requestSizeLimiter.d.ts +0 -2
  48. package/dist/runtime/server/middleware/requestSizeLimiter.js +1 -2
  49. package/dist/runtime/services/checkIsBasicAuthorized.d.ts +1 -3
  50. package/dist/runtime/services/checkIsBasicAuthorized.js +1 -2
  51. package/dist/runtime/services/checkIsChallenged.d.ts +1 -3
  52. package/dist/runtime/services/checkIsChallenged.js +1 -2
  53. package/dist/runtime/services/checkIsCsrfTokenValid.d.ts +1 -3
  54. package/dist/runtime/services/checkIsCsrfTokenValid.js +1 -2
  55. package/dist/runtime/services/checkIsEqualInConstantTime.d.ts +1 -3
  56. package/dist/runtime/services/checkIsEqualInConstantTime.js +1 -2
  57. package/dist/runtime/services/checkIsMethodAllowed.d.ts +1 -3
  58. package/dist/runtime/services/checkIsMethodAllowed.js +1 -2
  59. package/dist/runtime/services/checkIsRecord.d.ts +1 -3
  60. package/dist/runtime/services/checkIsRecord.js +1 -2
  61. package/dist/runtime/services/checkIsRequestTooLarge.d.ts +1 -3
  62. package/dist/runtime/services/checkIsRequestTooLarge.js +1 -2
  63. package/dist/runtime/services/collectSsgHashes.d.ts +1 -3
  64. package/dist/runtime/services/collectSsgHashes.js +1 -2
  65. package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts +1 -3
  66. package/dist/runtime/services/createInMemoryRateLimiterStore.js +1 -2
  67. package/dist/runtime/services/generateHash.d.ts +1 -3
  68. package/dist/runtime/services/generateHash.js +1 -2
  69. package/dist/runtime/services/generateNonce.d.ts +1 -3
  70. package/dist/runtime/services/generateNonce.js +1 -2
  71. package/dist/runtime/services/generateRandomToken.d.ts +1 -3
  72. package/dist/runtime/services/generateRandomToken.js +1 -2
  73. package/dist/runtime/services/getBasicAuthCredentials.d.ts +1 -3
  74. package/dist/runtime/services/getBasicAuthCredentials.js +1 -2
  75. package/dist/runtime/services/getBasicAuthOptions.d.ts +1 -3
  76. package/dist/runtime/services/getBasicAuthOptions.js +1 -2
  77. package/dist/runtime/services/getRetryAfterSeconds.d.ts +1 -3
  78. package/dist/runtime/services/getRetryAfterSeconds.js +1 -2
  79. package/dist/runtime/services/getSecurityRules.d.ts +1 -3
  80. package/dist/runtime/services/getSecurityRules.js +1 -2
  81. package/dist/runtime/services/getSecurityState.d.ts +1 -3
  82. package/dist/runtime/services/getSecurityState.js +1 -2
  83. package/dist/runtime/services/injectNonce.d.ts +1 -3
  84. package/dist/runtime/services/injectNonce.js +1 -2
  85. package/dist/runtime/services/injectSubresourceIntegrity.d.ts +1 -3
  86. package/dist/runtime/services/injectSubresourceIntegrity.js +1 -2
  87. package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts +1 -3
  88. package/dist/runtime/services/insertContentSecurityPolicyMeta.js +1 -2
  89. package/dist/runtime/services/mergeSecurityRules.d.ts +1 -3
  90. package/dist/runtime/services/mergeSecurityRules.js +1 -2
  91. package/dist/runtime/services/readHtmlTagAttribute.d.ts +1 -3
  92. package/dist/runtime/services/readHtmlTagAttribute.js +1 -2
  93. package/dist/runtime/services/rewriteHtmlTags.d.ts +1 -3
  94. package/dist/runtime/services/rewriteHtmlTags.js +1 -2
  95. package/dist/runtime/services/securityRouteMatcher.d.ts +1 -3
  96. package/dist/runtime/services/securityRouteMatcher.js +1 -2
  97. package/dist/runtime/services/serializeBasicAuthChallenge.d.ts +1 -3
  98. package/dist/runtime/services/serializeBasicAuthChallenge.js +1 -2
  99. package/dist/runtime/services/serializeContentSecurityPolicy.d.ts +1 -3
  100. package/dist/runtime/services/serializeContentSecurityPolicy.js +1 -2
  101. package/dist/runtime/services/serializePermissionsPolicy.d.ts +1 -3
  102. package/dist/runtime/services/serializePermissionsPolicy.js +1 -2
  103. package/dist/runtime/services/serializeSecurityHeaders.d.ts +1 -3
  104. package/dist/runtime/services/serializeSecurityHeaders.js +1 -2
  105. package/dist/runtime/services/serializeStrictTransportSecurity.d.ts +1 -3
  106. package/dist/runtime/services/serializeStrictTransportSecurity.js +1 -2
  107. package/dist/runtime/services/stripHtmlTagAttribute.d.ts +1 -3
  108. package/dist/runtime/services/stripHtmlTagAttribute.js +1 -2
  109. package/dist/runtime/services/updateContentSecurityPolicy.d.ts +1 -3
  110. package/dist/runtime/services/updateContentSecurityPolicy.js +1 -2
  111. package/dist/schemas/allowedMethodsRestricterOptionsSchema.js +1 -2
  112. package/dist/schemas/basicAuthOptionsSchema.js +1 -2
  113. package/dist/schemas/contentSecurityPolicySchema.js +1 -2
  114. package/dist/schemas/corsHandlerOptionsSchema.js +1 -2
  115. package/dist/schemas/csrfOptionsSchema.js +1 -2
  116. package/dist/schemas/moduleOptionsSchema.js +1 -2
  117. package/dist/schemas/permissionsPolicySchema.js +1 -2
  118. package/dist/schemas/rateLimiterOptionsSchema.js +1 -2
  119. package/dist/schemas/requestSizeLimiterOptionsSchema.js +1 -2
  120. package/dist/schemas/securityHeadersSchema.js +1 -2
  121. package/dist/schemas/ssgOptionsSchema.js +1 -2
  122. package/dist/schemas/strictTransportSecurityOptionsSchema.js +1 -2
  123. package/dist/services/computeSubresourceIntegrityHashes.js +1 -2
  124. package/dist/services/formatZodIssues.js +1 -2
  125. package/dist/services/getDefaultModuleOptions.js +1 -2
  126. package/dist/services/getDefaultSecurityHeaders.js +1 -2
  127. package/dist/services/getPluginTemplate.js +1 -2
  128. package/dist/services/getRemoveLoggersViteConfig.js +1 -2
  129. package/dist/services/getRouteRulesTemplate.js +1 -2
  130. package/dist/services/getRouteSecurityRules.js +1 -2
  131. package/dist/services/getStaticResourceHeaders.js +1 -2
  132. package/dist/services/getTypeTemplate.js +1 -2
  133. package/dist/services/mergeModuleOptions.js +1 -2
  134. package/dist/services/parseModuleOptions.js +1 -2
  135. package/package.json +4 -4
@@ -4,7 +4,7 @@ import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
4
4
  import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
5
5
  import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
6
6
  import { z } from "zod";
7
- //#region src/schemas/securityHeadersSchema.ts
7
+ // src/schemas/securityHeadersSchema.ts
8
8
  const headerValueSchema = z.string().min(1);
9
9
  const securityHeadersSchema = z.strictObject({
10
10
  contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
@@ -21,5 +21,4 @@ const securityHeadersSchema = z.strictObject({
21
21
  xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
22
22
  xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
23
23
  });
24
- //#endregion
25
24
  export { securityHeadersSchema };
@@ -1,5 +1,5 @@
1
1
  import { z } from "zod";
2
- //#region src/schemas/ssgOptionsSchema.ts
2
+ // src/schemas/ssgOptionsSchema.ts
3
3
  const ssgOptionsSchema = z.strictObject({
4
4
  exportToPresets: z.boolean(),
5
5
  hashScripts: z.boolean(),
@@ -7,5 +7,4 @@ const ssgOptionsSchema = z.strictObject({
7
7
  meta: z.boolean(),
8
8
  nitroHeaders: z.boolean()
9
9
  });
10
- //#endregion
11
10
  export { ssgOptionsSchema };
@@ -1,9 +1,8 @@
1
1
  import { z } from "zod";
2
- //#region src/schemas/strictTransportSecurityOptionsSchema.ts
2
+ // src/schemas/strictTransportSecurityOptionsSchema.ts
3
3
  const strictTransportSecurityOptionsSchema = z.strictObject({
4
4
  includeSubdomains: z.boolean(),
5
5
  maxAge: z.int().nonnegative(),
6
6
  preload: z.boolean()
7
7
  });
8
- //#endregion
9
8
  export { strictTransportSecurityOptionsSchema };
@@ -3,7 +3,7 @@ import { generateHash } from "../runtime/services/generateHash.js";
3
3
  import { existsSync } from "node:fs";
4
4
  import { readFile, readdir } from "node:fs/promises";
5
5
  import { join, posix, relative, sep } from "node:path";
6
- //#region src/services/computeSubresourceIntegrityHashes.ts
6
+ // src/services/computeSubresourceIntegrityHashes.ts
7
7
  const computeSubresourceIntegrityHashes = async (nitro) => {
8
8
  const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
9
9
  const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
@@ -25,5 +25,4 @@ const computeSubresourceIntegrityHashes = async (nitro) => {
25
25
  }));
26
26
  return Object.fromEntries(hashEntries);
27
27
  };
28
- //#endregion
29
28
  export { computeSubresourceIntegrityHashes };
@@ -1,4 +1,4 @@
1
- //#region src/services/formatZodIssues.ts
1
+ // src/services/formatZodIssues.ts
2
2
  const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
3
3
  const getLeafIssues = (issue, parentPath) => {
4
4
  const path = [...parentPath, ...issue.path];
@@ -12,5 +12,4 @@ const formatLeafIssue = ({ issue, path }) => {
12
12
  return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
13
13
  };
14
14
  const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
15
- //#endregion
16
15
  export { formatZodIssues };
@@ -1,5 +1,5 @@
1
1
  import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
2
- //#region src/services/getDefaultModuleOptions.ts
2
+ // src/services/getDefaultModuleOptions.ts
3
3
  const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
4
4
  allowedMethodsRestricter: false,
5
5
  basicAuth: false,
@@ -37,5 +37,4 @@ const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
37
37
  },
38
38
  strict: isStrict
39
39
  });
40
- //#endregion
41
40
  export { getDefaultModuleOptions };
@@ -1,7 +1,7 @@
1
1
  import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
2
2
  import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
3
3
  import { XFrameOptions } from "../models/XFrameOptions.js";
4
- //#region src/services/getDefaultSecurityHeaders.ts
4
+ // src/services/getDefaultSecurityHeaders.ts
5
5
  const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
6
6
  contentSecurityPolicy: {
7
7
  "base-uri": ["'none'"],
@@ -81,5 +81,4 @@ const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
81
81
  xFrameOptions: XFrameOptions.SameOrigin,
82
82
  xPermittedCrossDomainPolicies: "none"
83
83
  });
84
- //#endregion
85
84
  export { getDefaultSecurityHeaders };
@@ -1,4 +1,4 @@
1
- //#region src/services/getPluginTemplate.ts
1
+ // src/services/getPluginTemplate.ts
2
2
  const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
3
3
  `import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
4
4
  `import data from ${JSON.stringify(dataPath)};`,
@@ -6,5 +6,4 @@ const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
6
6
  `export default ${factoryName}(data);`,
7
7
  ""
8
8
  ].join("\n");
9
- //#endregion
10
9
  export { getPluginTemplate };
@@ -1,4 +1,3 @@
1
- //#region src/services/getRemoveLoggersViteConfig.ts
1
+ // src/services/getRemoveLoggersViteConfig.ts
2
2
  const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
3
- //#endregion
4
3
  export { getRemoveLoggersViteConfig };
@@ -1,4 +1,3 @@
1
- //#region src/services/getRouteRulesTemplate.ts
1
+ // src/services/getRouteRulesTemplate.ts
2
2
  const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
3
- //#endregion
4
3
  export { getRouteRulesTemplate };
@@ -1,7 +1,7 @@
1
1
  import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
2
2
  import { formatZodIssues } from "./formatZodIssues.js";
3
3
  import { mergeModuleOptions } from "./mergeModuleOptions.js";
4
- //#region src/services/getRouteSecurityRules.ts
4
+ // src/services/getRouteSecurityRules.ts
5
5
  const getRouteSecurityRules = (routeRules, options) => {
6
6
  const routeSecurityRules = {};
7
7
  for (const [route, { security }] of Object.entries(routeRules)) {
@@ -13,5 +13,4 @@ const getRouteSecurityRules = (routeRules, options) => {
13
13
  }
14
14
  return routeSecurityRules;
15
15
  };
16
- //#endregion
17
16
  export { getRouteSecurityRules };
@@ -1,5 +1,5 @@
1
1
  import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
2
- //#region src/services/getStaticResourceHeaders.ts
2
+ // src/services/getStaticResourceHeaders.ts
3
3
  const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
4
4
  referrerPolicy: headers.referrerPolicy,
5
5
  strictTransportSecurity: headers.strictTransportSecurity,
@@ -8,5 +8,4 @@ const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
8
8
  xFrameOptions: headers.xFrameOptions,
9
9
  xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
10
10
  });
11
- //#endregion
12
11
  export { getStaticResourceHeaders };
@@ -1,5 +1,5 @@
1
1
  import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
2
- //#region src/services/getTypeTemplate.ts
2
+ // src/services/getTypeTemplate.ts
3
3
  const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
4
4
  import type { ModuleOptions } from '${MODULE_NAME}'
5
5
 
@@ -21,5 +21,4 @@ declare module 'nitro/types' {
21
21
 
22
22
  export {}
23
23
  `;
24
- //#endregion
25
24
  export { getTypeTemplate };
@@ -1,4 +1,4 @@
1
- //#region src/services/mergeModuleOptions.ts
1
+ // src/services/mergeModuleOptions.ts
2
2
  const mergeModuleOptions = (defaults, overrides) => ({
3
3
  ...defaults,
4
4
  ...overrides,
@@ -35,5 +35,4 @@ const mergeFeatures = (defaults, overrides) => {
35
35
  else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
36
36
  return merged;
37
37
  };
38
- //#endregion
39
38
  export { mergeModuleOptions };
@@ -1,10 +1,9 @@
1
1
  import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
2
2
  import { formatZodIssues } from "./formatZodIssues.js";
3
- //#region src/services/parseModuleOptions.ts
3
+ // src/services/parseModuleOptions.ts
4
4
  const parseModuleOptions = (options) => {
5
5
  const result = moduleOptionsSchema.safeParse(options);
6
6
  if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
7
7
  return result.data;
8
8
  };
9
- //#endregion
10
9
  export { parseModuleOptions };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "nuxt-security-module",
3
- "version": "4.3.1",
3
+ "version": "4.3.3",
4
4
  "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Jimmy Chen",
@@ -50,8 +50,8 @@
50
50
  "zod": "^4.6.7"
51
51
  },
52
52
  "devDependencies": {
53
- "@esposter/configuration": "4.3.1",
54
- "@esposter/shared-node": "4.3.1",
53
+ "@esposter/configuration": "4.3.3",
54
+ "@esposter/shared-node": "4.3.3",
55
55
  "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
56
56
  "@types/node": "^26.6.5",
57
57
  "h3": "^2.0.7",
@@ -61,5 +61,5 @@
61
61
  "nitro": "npm:nitro-nightly@3.0.1-20261018-005730-bb9894fe",
62
62
  "nuxt": "npm:nuxt-nightly@5x"
63
63
  },
64
- "gitHead": "777a39636b789c13af33ed13370246ccf6dbaf31"
64
+ "gitHead": "955bbc130ad9b28877fd4ae8efc73a045141ce01"
65
65
  }