nuxt-security-module 4.3.1 → 4.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +0 -2
- package/dist/index.js +1 -2
- package/dist/models/AllowedMethodsRestricterOptions.d.ts +1 -3
- package/dist/models/BasicAuthOptions.d.ts +1 -3
- package/dist/models/ContentSecurityPolicy.d.ts +1 -3
- package/dist/models/CorsHandlerOptions.d.ts +1 -3
- package/dist/models/CrossOriginEmbedderPolicy.d.ts +1 -3
- package/dist/models/CrossOriginEmbedderPolicy.js +1 -2
- package/dist/models/CsrfOptions.d.ts +1 -3
- package/dist/models/ModuleOptions.d.ts +1 -3
- package/dist/models/PermissionsPolicy.d.ts +1 -3
- package/dist/models/RateLimitWindow.d.ts +1 -3
- package/dist/models/RateLimiterOptions.d.ts +1 -3
- package/dist/models/RateLimiterStore.d.ts +1 -3
- package/dist/models/RequestSizeLimiterOptions.d.ts +1 -3
- package/dist/models/SecurityHeaders.d.ts +1 -3
- package/dist/models/SecurityRouteRules.d.ts +1 -3
- package/dist/models/SecurityRules.d.ts +1 -3
- package/dist/models/SsgOptions.d.ts +1 -3
- package/dist/models/StrictTransportSecurity.d.ts +1 -3
- package/dist/models/XFrameOptions.d.ts +1 -3
- package/dist/models/XFrameOptions.js +1 -2
- package/dist/runtime/constants.d.ts +1 -3
- package/dist/runtime/constants.js +1 -2
- package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts +0 -2
- package/dist/runtime/nitro/plugins/hidePoweredBy.js +1 -2
- package/dist/runtime/nitro/plugins/nonce.d.ts +0 -2
- package/dist/runtime/nitro/plugins/nonce.js +1 -2
- package/dist/runtime/nitro/plugins/routeRules.d.ts +1 -3
- package/dist/runtime/nitro/plugins/routeRules.js +1 -2
- package/dist/runtime/nitro/plugins/securityHeaders.d.ts +0 -2
- package/dist/runtime/nitro/plugins/securityHeaders.js +1 -2
- package/dist/runtime/nitro/plugins/ssgHashes.d.ts +0 -2
- package/dist/runtime/nitro/plugins/ssgHashes.js +1 -2
- package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts +1 -3
- package/dist/runtime/nitro/plugins/subresourceIntegrity.js +1 -2
- package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts +0 -2
- package/dist/runtime/server/middleware/allowedMethodsRestricter.js +1 -2
- package/dist/runtime/server/middleware/basicAuth.d.ts +0 -2
- package/dist/runtime/server/middleware/basicAuth.js +1 -2
- package/dist/runtime/server/middleware/corsHandler.d.ts +0 -2
- package/dist/runtime/server/middleware/corsHandler.js +1 -2
- package/dist/runtime/server/middleware/csrf.d.ts +0 -2
- package/dist/runtime/server/middleware/csrf.js +1 -2
- package/dist/runtime/server/middleware/rateLimiter.d.ts +0 -2
- package/dist/runtime/server/middleware/rateLimiter.js +1 -2
- package/dist/runtime/server/middleware/requestSizeLimiter.d.ts +0 -2
- package/dist/runtime/server/middleware/requestSizeLimiter.js +1 -2
- package/dist/runtime/services/checkIsBasicAuthorized.d.ts +1 -3
- package/dist/runtime/services/checkIsBasicAuthorized.js +1 -2
- package/dist/runtime/services/checkIsChallenged.d.ts +1 -3
- package/dist/runtime/services/checkIsChallenged.js +1 -2
- package/dist/runtime/services/checkIsCsrfTokenValid.d.ts +1 -3
- package/dist/runtime/services/checkIsCsrfTokenValid.js +1 -2
- package/dist/runtime/services/checkIsEqualInConstantTime.d.ts +1 -3
- package/dist/runtime/services/checkIsEqualInConstantTime.js +1 -2
- package/dist/runtime/services/checkIsMethodAllowed.d.ts +1 -3
- package/dist/runtime/services/checkIsMethodAllowed.js +1 -2
- package/dist/runtime/services/checkIsRecord.d.ts +1 -3
- package/dist/runtime/services/checkIsRecord.js +1 -2
- package/dist/runtime/services/checkIsRequestTooLarge.d.ts +1 -3
- package/dist/runtime/services/checkIsRequestTooLarge.js +1 -2
- package/dist/runtime/services/collectSsgHashes.d.ts +1 -3
- package/dist/runtime/services/collectSsgHashes.js +1 -2
- package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts +1 -3
- package/dist/runtime/services/createInMemoryRateLimiterStore.js +1 -2
- package/dist/runtime/services/generateHash.d.ts +1 -3
- package/dist/runtime/services/generateHash.js +1 -2
- package/dist/runtime/services/generateNonce.d.ts +1 -3
- package/dist/runtime/services/generateNonce.js +1 -2
- package/dist/runtime/services/generateRandomToken.d.ts +1 -3
- package/dist/runtime/services/generateRandomToken.js +1 -2
- package/dist/runtime/services/getBasicAuthCredentials.d.ts +1 -3
- package/dist/runtime/services/getBasicAuthCredentials.js +1 -2
- package/dist/runtime/services/getBasicAuthOptions.d.ts +1 -3
- package/dist/runtime/services/getBasicAuthOptions.js +1 -2
- package/dist/runtime/services/getRetryAfterSeconds.d.ts +1 -3
- package/dist/runtime/services/getRetryAfterSeconds.js +1 -2
- package/dist/runtime/services/getSecurityRules.d.ts +1 -3
- package/dist/runtime/services/getSecurityRules.js +1 -2
- package/dist/runtime/services/getSecurityState.d.ts +1 -3
- package/dist/runtime/services/getSecurityState.js +1 -2
- package/dist/runtime/services/injectNonce.d.ts +1 -3
- package/dist/runtime/services/injectNonce.js +1 -2
- package/dist/runtime/services/injectSubresourceIntegrity.d.ts +1 -3
- package/dist/runtime/services/injectSubresourceIntegrity.js +1 -2
- package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts +1 -3
- package/dist/runtime/services/insertContentSecurityPolicyMeta.js +1 -2
- package/dist/runtime/services/mergeSecurityRules.d.ts +1 -3
- package/dist/runtime/services/mergeSecurityRules.js +1 -2
- package/dist/runtime/services/readHtmlTagAttribute.d.ts +1 -3
- package/dist/runtime/services/readHtmlTagAttribute.js +1 -2
- package/dist/runtime/services/rewriteHtmlTags.d.ts +1 -3
- package/dist/runtime/services/rewriteHtmlTags.js +1 -2
- package/dist/runtime/services/securityRouteMatcher.d.ts +1 -3
- package/dist/runtime/services/securityRouteMatcher.js +1 -2
- package/dist/runtime/services/serializeBasicAuthChallenge.d.ts +1 -3
- package/dist/runtime/services/serializeBasicAuthChallenge.js +1 -2
- package/dist/runtime/services/serializeContentSecurityPolicy.d.ts +1 -3
- package/dist/runtime/services/serializeContentSecurityPolicy.js +1 -2
- package/dist/runtime/services/serializePermissionsPolicy.d.ts +1 -3
- package/dist/runtime/services/serializePermissionsPolicy.js +1 -2
- package/dist/runtime/services/serializeSecurityHeaders.d.ts +1 -3
- package/dist/runtime/services/serializeSecurityHeaders.js +1 -2
- package/dist/runtime/services/serializeStrictTransportSecurity.d.ts +1 -3
- package/dist/runtime/services/serializeStrictTransportSecurity.js +1 -2
- package/dist/runtime/services/stripHtmlTagAttribute.d.ts +1 -3
- package/dist/runtime/services/stripHtmlTagAttribute.js +1 -2
- package/dist/runtime/services/updateContentSecurityPolicy.d.ts +1 -3
- package/dist/runtime/services/updateContentSecurityPolicy.js +1 -2
- package/dist/schemas/allowedMethodsRestricterOptionsSchema.js +1 -2
- package/dist/schemas/basicAuthOptionsSchema.js +1 -2
- package/dist/schemas/contentSecurityPolicySchema.js +1 -2
- package/dist/schemas/corsHandlerOptionsSchema.js +1 -2
- package/dist/schemas/csrfOptionsSchema.js +1 -2
- package/dist/schemas/moduleOptionsSchema.js +1 -2
- package/dist/schemas/permissionsPolicySchema.js +1 -2
- package/dist/schemas/rateLimiterOptionsSchema.js +1 -2
- package/dist/schemas/requestSizeLimiterOptionsSchema.js +1 -2
- package/dist/schemas/securityHeadersSchema.js +1 -2
- package/dist/schemas/ssgOptionsSchema.js +1 -2
- package/dist/schemas/strictTransportSecurityOptionsSchema.js +1 -2
- package/dist/services/computeSubresourceIntegrityHashes.js +1 -2
- package/dist/services/formatZodIssues.js +1 -2
- package/dist/services/getDefaultModuleOptions.js +1 -2
- package/dist/services/getDefaultSecurityHeaders.js +1 -2
- package/dist/services/getPluginTemplate.js +1 -2
- package/dist/services/getRemoveLoggersViteConfig.js +1 -2
- package/dist/services/getRouteRulesTemplate.js +1 -2
- package/dist/services/getRouteSecurityRules.js +1 -2
- package/dist/services/getStaticResourceHeaders.js +1 -2
- package/dist/services/getTypeTemplate.js +1 -2
- package/dist/services/mergeModuleOptions.js +1 -2
- package/dist/services/parseModuleOptions.js +1 -2
- package/package.json +4 -4
|
@@ -4,7 +4,7 @@ import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
|
|
|
4
4
|
import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
|
|
5
5
|
import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
|
|
6
6
|
import { z } from "zod";
|
|
7
|
-
|
|
7
|
+
// src/schemas/securityHeadersSchema.ts
|
|
8
8
|
const headerValueSchema = z.string().min(1);
|
|
9
9
|
const securityHeadersSchema = z.strictObject({
|
|
10
10
|
contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
|
|
@@ -21,5 +21,4 @@ const securityHeadersSchema = z.strictObject({
|
|
|
21
21
|
xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
|
|
22
22
|
xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
|
|
23
23
|
});
|
|
24
|
-
//#endregion
|
|
25
24
|
export { securityHeadersSchema };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/ssgOptionsSchema.ts
|
|
3
3
|
const ssgOptionsSchema = z.strictObject({
|
|
4
4
|
exportToPresets: z.boolean(),
|
|
5
5
|
hashScripts: z.boolean(),
|
|
@@ -7,5 +7,4 @@ const ssgOptionsSchema = z.strictObject({
|
|
|
7
7
|
meta: z.boolean(),
|
|
8
8
|
nitroHeaders: z.boolean()
|
|
9
9
|
});
|
|
10
|
-
//#endregion
|
|
11
10
|
export { ssgOptionsSchema };
|
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/strictTransportSecurityOptionsSchema.ts
|
|
3
3
|
const strictTransportSecurityOptionsSchema = z.strictObject({
|
|
4
4
|
includeSubdomains: z.boolean(),
|
|
5
5
|
maxAge: z.int().nonnegative(),
|
|
6
6
|
preload: z.boolean()
|
|
7
7
|
});
|
|
8
|
-
//#endregion
|
|
9
8
|
export { strictTransportSecurityOptionsSchema };
|
|
@@ -3,7 +3,7 @@ import { generateHash } from "../runtime/services/generateHash.js";
|
|
|
3
3
|
import { existsSync } from "node:fs";
|
|
4
4
|
import { readFile, readdir } from "node:fs/promises";
|
|
5
5
|
import { join, posix, relative, sep } from "node:path";
|
|
6
|
-
|
|
6
|
+
// src/services/computeSubresourceIntegrityHashes.ts
|
|
7
7
|
const computeSubresourceIntegrityHashes = async (nitro) => {
|
|
8
8
|
const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
|
|
9
9
|
const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
|
|
@@ -25,5 +25,4 @@ const computeSubresourceIntegrityHashes = async (nitro) => {
|
|
|
25
25
|
}));
|
|
26
26
|
return Object.fromEntries(hashEntries);
|
|
27
27
|
};
|
|
28
|
-
//#endregion
|
|
29
28
|
export { computeSubresourceIntegrityHashes };
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
|
|
1
|
+
// src/services/formatZodIssues.ts
|
|
2
2
|
const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
|
|
3
3
|
const getLeafIssues = (issue, parentPath) => {
|
|
4
4
|
const path = [...parentPath, ...issue.path];
|
|
@@ -12,5 +12,4 @@ const formatLeafIssue = ({ issue, path }) => {
|
|
|
12
12
|
return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
|
|
13
13
|
};
|
|
14
14
|
const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
|
|
15
|
-
//#endregion
|
|
16
15
|
export { formatZodIssues };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
|
|
2
|
-
|
|
2
|
+
// src/services/getDefaultModuleOptions.ts
|
|
3
3
|
const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
|
|
4
4
|
allowedMethodsRestricter: false,
|
|
5
5
|
basicAuth: false,
|
|
@@ -37,5 +37,4 @@ const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
|
|
|
37
37
|
},
|
|
38
38
|
strict: isStrict
|
|
39
39
|
});
|
|
40
|
-
//#endregion
|
|
41
40
|
export { getDefaultModuleOptions };
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
|
|
2
2
|
import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
|
|
3
3
|
import { XFrameOptions } from "../models/XFrameOptions.js";
|
|
4
|
-
|
|
4
|
+
// src/services/getDefaultSecurityHeaders.ts
|
|
5
5
|
const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
|
|
6
6
|
contentSecurityPolicy: {
|
|
7
7
|
"base-uri": ["'none'"],
|
|
@@ -81,5 +81,4 @@ const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
|
|
|
81
81
|
xFrameOptions: XFrameOptions.SameOrigin,
|
|
82
82
|
xPermittedCrossDomainPolicies: "none"
|
|
83
83
|
});
|
|
84
|
-
//#endregion
|
|
85
84
|
export { getDefaultSecurityHeaders };
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
|
|
1
|
+
// src/services/getPluginTemplate.ts
|
|
2
2
|
const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
|
|
3
3
|
`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
|
|
4
4
|
`import data from ${JSON.stringify(dataPath)};`,
|
|
@@ -6,5 +6,4 @@ const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
|
|
|
6
6
|
`export default ${factoryName}(data);`,
|
|
7
7
|
""
|
|
8
8
|
].join("\n");
|
|
9
|
-
//#endregion
|
|
10
9
|
export { getPluginTemplate };
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
|
|
1
|
+
// src/services/getRemoveLoggersViteConfig.ts
|
|
2
2
|
const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
|
|
3
|
-
//#endregion
|
|
4
3
|
export { getRemoveLoggersViteConfig };
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
|
|
2
2
|
import { formatZodIssues } from "./formatZodIssues.js";
|
|
3
3
|
import { mergeModuleOptions } from "./mergeModuleOptions.js";
|
|
4
|
-
|
|
4
|
+
// src/services/getRouteSecurityRules.ts
|
|
5
5
|
const getRouteSecurityRules = (routeRules, options) => {
|
|
6
6
|
const routeSecurityRules = {};
|
|
7
7
|
for (const [route, { security }] of Object.entries(routeRules)) {
|
|
@@ -13,5 +13,4 @@ const getRouteSecurityRules = (routeRules, options) => {
|
|
|
13
13
|
}
|
|
14
14
|
return routeSecurityRules;
|
|
15
15
|
};
|
|
16
|
-
//#endregion
|
|
17
16
|
export { getRouteSecurityRules };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
|
|
2
|
-
|
|
2
|
+
// src/services/getStaticResourceHeaders.ts
|
|
3
3
|
const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
|
|
4
4
|
referrerPolicy: headers.referrerPolicy,
|
|
5
5
|
strictTransportSecurity: headers.strictTransportSecurity,
|
|
@@ -8,5 +8,4 @@ const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
|
|
|
8
8
|
xFrameOptions: headers.xFrameOptions,
|
|
9
9
|
xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
|
|
10
10
|
});
|
|
11
|
-
//#endregion
|
|
12
11
|
export { getStaticResourceHeaders };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
|
|
2
|
-
|
|
2
|
+
// src/services/getTypeTemplate.ts
|
|
3
3
|
const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
|
|
4
4
|
import type { ModuleOptions } from '${MODULE_NAME}'
|
|
5
5
|
|
|
@@ -21,5 +21,4 @@ declare module 'nitro/types' {
|
|
|
21
21
|
|
|
22
22
|
export {}
|
|
23
23
|
`;
|
|
24
|
-
//#endregion
|
|
25
24
|
export { getTypeTemplate };
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
|
|
1
|
+
// src/services/mergeModuleOptions.ts
|
|
2
2
|
const mergeModuleOptions = (defaults, overrides) => ({
|
|
3
3
|
...defaults,
|
|
4
4
|
...overrides,
|
|
@@ -35,5 +35,4 @@ const mergeFeatures = (defaults, overrides) => {
|
|
|
35
35
|
else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
|
|
36
36
|
return merged;
|
|
37
37
|
};
|
|
38
|
-
//#endregion
|
|
39
38
|
export { mergeModuleOptions };
|
|
@@ -1,10 +1,9 @@
|
|
|
1
1
|
import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
|
|
2
2
|
import { formatZodIssues } from "./formatZodIssues.js";
|
|
3
|
-
|
|
3
|
+
// src/services/parseModuleOptions.ts
|
|
4
4
|
const parseModuleOptions = (options) => {
|
|
5
5
|
const result = moduleOptionsSchema.safeParse(options);
|
|
6
6
|
if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
|
|
7
7
|
return result.data;
|
|
8
8
|
};
|
|
9
|
-
//#endregion
|
|
10
9
|
export { parseModuleOptions };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nuxt-security-module",
|
|
3
|
-
"version": "4.3.
|
|
3
|
+
"version": "4.3.3",
|
|
4
4
|
"description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Jimmy Chen",
|
|
@@ -50,8 +50,8 @@
|
|
|
50
50
|
"zod": "^4.6.7"
|
|
51
51
|
},
|
|
52
52
|
"devDependencies": {
|
|
53
|
-
"@esposter/configuration": "4.3.
|
|
54
|
-
"@esposter/shared-node": "4.3.
|
|
53
|
+
"@esposter/configuration": "4.3.3",
|
|
54
|
+
"@esposter/shared-node": "4.3.3",
|
|
55
55
|
"@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
|
|
56
56
|
"@types/node": "^26.6.5",
|
|
57
57
|
"h3": "^2.0.7",
|
|
@@ -61,5 +61,5 @@
|
|
|
61
61
|
"nitro": "npm:nitro-nightly@3.0.1-20261018-005730-bb9894fe",
|
|
62
62
|
"nuxt": "npm:nuxt-nightly@5x"
|
|
63
63
|
},
|
|
64
|
-
"gitHead": "
|
|
64
|
+
"gitHead": "955bbc130ad9b28877fd4ae8efc73a045141ce01"
|
|
65
65
|
}
|