nuxt-security-module 4.3.3 → 4.4.0

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -1,18 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
-import { definePlugin } from "nitro";
-// src/runtime/nitro/plugins/subresourceIntegrity.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
-const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("render:html", (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.sri) return;
-		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
-	});
-});
-export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const allowedMethodsRestricter: Middleware;
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -1,14 +0,0 @@
-import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-// src/runtime/server/middleware/allowedMethodsRestricter.ts
-const allowedMethodsRestricter = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
-	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
-		status: 405,
-		statusText: "Method not allowed"
-	});
-});
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const basicAuthMiddleware: Middleware;
-export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -1,22 +0,0 @@
-import "../../constants.js";
-import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
-import { checkIsChallenged } from "../../services/checkIsChallenged.js";
-import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
-import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-import { useRuntimeConfig } from "nuxt/server";
-// src/runtime/server/middleware/basicAuth.ts
-const basicAuthMiddleware = defineMiddleware((event) => {
-	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
-	if (!basicAuth) return;
-	const { pathname } = event.url;
-	if (!checkIsChallenged(pathname, basicAuth)) return;
-	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
-	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
-	throw new HTTPError({
-		status: 401,
-		statusText: "Access denied"
-	});
-});
-export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const corsHandler: Middleware;
-export { corsHandler as default };

package/dist/runtime/server/middleware/corsHandler.js

@@ -1,19 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { handleCors } from "nitro/h3";
-// src/runtime/server/middleware/corsHandler.ts
-const corsHandler = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.corsHandler) return;
-	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
-	handleCors(event, {
-		allowHeaders,
-		credentials,
-		exposeHeaders,
-		maxAge,
-		methods,
-		origin: [origin].flat(),
-		preflight
-	});
-});
-export { corsHandler as default };

package/dist/runtime/server/middleware/csrf.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const csrf: Middleware;
-export { csrf as default };

package/dist/runtime/server/middleware/csrf.js

@@ -1,27 +0,0 @@
-import { CSRF_UNSAFE_METHODS } from "../../constants.js";
-import { checkIsCsrfTokenValid } from "../../services/checkIsCsrfTokenValid.js";
-import { generateRandomToken } from "../../services/generateRandomToken.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError, getCookie, setCookie } from "nitro/h3";
-// src/runtime/server/middleware/csrf.ts
-const csrf = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.csrf) return;
-	const { cookieName, headerName } = rules.csrf;
-	const cookieToken = getCookie(event, cookieName);
-	if (!CSRF_UNSAFE_METHODS.includes(event.req.method)) {
-		if (cookieToken === void 0) setCookie(event, cookieName, generateRandomToken(32), {
-			httpOnly: false,
-			path: "/",
-			sameSite: "strict",
-			secure: event.url.protocol === "https:"
-		});
-		return;
-	}
-	if (!checkIsCsrfTokenValid(cookieToken, event.req.headers.get(headerName))) throw new HTTPError({
-		status: 403,
-		statusText: "Forbidden"
-	});
-});
-export { csrf as default };

package/dist/runtime/server/middleware/rateLimiter.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const rateLimiter: Middleware;
-export { rateLimiter as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -1,21 +0,0 @@
-import { MAX_RATE_LIMIT_ENTRIES } from "../../constants.js";
-import { createInMemoryRateLimiterStore } from "../../services/createInMemoryRateLimiterStore.js";
-import { getRetryAfterSeconds } from "../../services/getRetryAfterSeconds.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError, getRequestIP } from "nitro/h3";
-// src/runtime/server/middleware/rateLimiter.ts
-const rateLimiterStore = createInMemoryRateLimiterStore(MAX_RATE_LIMIT_ENTRIES);
-const rateLimiter = defineMiddleware(async (event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.rateLimiter) return;
-	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
-	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
-	if (retryAfterSeconds === void 0) return;
-	event.res.headers.set("Retry-After", String(retryAfterSeconds));
-	throw new HTTPError({
-		status: 429,
-		statusText: "Too Many Requests"
-	});
-});
-export { rateLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.d.ts

@@ -1,3 +0,0 @@
-import { Middleware } from "nitro/h3";
-declare const requestSizeLimiter: Middleware;
-export { requestSizeLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -1,16 +0,0 @@
-import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-// src/runtime/server/middleware/requestSizeLimiter.ts
-const requestSizeLimiter = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.requestSizeLimiter) return;
-	const contentLength = event.req.headers.get("content-length");
-	const contentType = event.req.headers.get("content-type");
-	if (checkIsRequestTooLarge(event.req.method, contentLength, contentType, rules.requestSizeLimiter)) throw new HTTPError({
-		status: 413,
-		statusText: "Payload Too Large"
-	});
-});
-export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBasicAuthorized.d.ts

@@ -1,2 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-export declare const checkIsBasicAuthorized: (authorization: null | string, { name, pass }: BasicAuthOptions) => boolean;

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -1,11 +0,0 @@
-import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
-import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
-// src/runtime/services/checkIsBasicAuthorized.ts
-const checkIsBasicAuthorized = (authorization, { name, pass }) => {
-	const credentials = getBasicAuthCredentials(authorization);
-	if (!credentials) return false;
-	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);
-	const isPassEqual = checkIsEqualInConstantTime(credentials.pass, pass);
-	return isNameEqual && isPassEqual;
-};
-export { checkIsBasicAuthorized };

package/dist/runtime/services/checkIsChallenged.d.ts

@@ -1,2 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-export declare const checkIsChallenged: (path: string, { exclude, include }: BasicAuthOptions) => boolean;

package/dist/runtime/services/checkIsChallenged.js

@@ -1,7 +0,0 @@
-// src/runtime/services/checkIsChallenged.ts
-const checkIsChallenged = (path, { exclude = [], include = [] }) => {
-	const isIncluded = include.some((prefix) => path.startsWith(prefix));
-	const isExcluded = exclude.some((prefix) => path.startsWith(prefix));
-	return isIncluded || !isExcluded;
-};
-export { checkIsChallenged };

package/dist/runtime/services/checkIsCsrfTokenValid.d.ts

@@ -1 +0,0 @@
-export declare const checkIsCsrfTokenValid: (cookieToken: string | undefined, headerToken: null | string) => boolean;

package/dist/runtime/services/checkIsCsrfTokenValid.js

@@ -1,7 +0,0 @@
-import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
-// src/runtime/services/checkIsCsrfTokenValid.ts
-const checkIsCsrfTokenValid = (cookieToken, headerToken) => {
-	if (!cookieToken || !headerToken) return false;
-	return checkIsEqualInConstantTime(cookieToken, headerToken);
-};
-export { checkIsCsrfTokenValid };

package/dist/runtime/services/checkIsEqualInConstantTime.d.ts

@@ -1 +0,0 @@
-export declare const checkIsEqualInConstantTime: (first: string, second: string) => boolean;

package/dist/runtime/services/checkIsEqualInConstantTime.js

@@ -1,10 +0,0 @@
-// src/runtime/services/checkIsEqualInConstantTime.ts
-const checkIsEqualInConstantTime = (first, second) => {
-	const firstBytes = new TextEncoder().encode(first);
-	const secondBytes = new TextEncoder().encode(second);
-	if (firstBytes.length !== secondBytes.length) return false;
-	let difference = 0;
-	for (const [index, byte] of firstBytes.entries()) difference |= byte ^ (secondBytes[index] ?? 0);
-	return difference === 0;
-};
-export { checkIsEqualInConstantTime };

package/dist/runtime/services/checkIsMethodAllowed.d.ts

@@ -1 +0,0 @@
-export declare const checkIsMethodAllowed: (method: string, methods: string[]) => boolean;

package/dist/runtime/services/checkIsMethodAllowed.js

@@ -1,3 +0,0 @@
-// src/runtime/services/checkIsMethodAllowed.ts
-const checkIsMethodAllowed = (method, methods) => methods.includes(method);
-export { checkIsMethodAllowed };

package/dist/runtime/services/checkIsRecord.d.ts

@@ -1 +0,0 @@
-export declare const checkIsRecord: (value: unknown) => value is Record<string, unknown>;

package/dist/runtime/services/checkIsRecord.js

@@ -1,3 +0,0 @@
-// src/runtime/services/checkIsRecord.ts
-const checkIsRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-export { checkIsRecord };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -1,2 +0,0 @@
-import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
-export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -1,8 +0,0 @@
-import { SIZE_LIMITED_METHODS } from "../constants.js";
-// src/runtime/services/checkIsRequestTooLarge.ts
-const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
-	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
-	const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
-	return Math.trunc(Number(contentLength)) >= limit;
-};
-export { checkIsRequestTooLarge };

package/dist/runtime/services/collectSsgHashes.d.ts

@@ -1,3 +0,0 @@
-import { SsgOptions } from "../../models/SsgOptions.js";
-import { SecurityState } from "./getSecurityState.js";
-export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;

package/dist/runtime/services/collectSsgHashes.js

@@ -1,40 +0,0 @@
-import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
-import { generateHash } from "./generateHash.js";
-import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
-// src/runtime/services/collectSsgHashes.ts
-const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
-	"audioworklet",
-	"paintworklet",
-	"script",
-	"xslt"
-]);
-const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
-	const integrity = readHtmlTagAttribute(attributes, "integrity");
-	if (name === "script" && hashScripts) {
-		const source = readHtmlTagAttribute(attributes, "src");
-		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
-		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-		return;
-	}
-	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-	if (name !== "link" || integrity === void 0) return void 0;
-	const rel = readHtmlTagAttribute(attributes, "rel");
-	const as = readHtmlTagAttribute(attributes, "as") ?? "";
-	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
-	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
-};
-const collectSsgHashes = async (html, options) => {
-	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
-		(elementName ?? tagName ?? "").toLowerCase(),
-		elementAttributes ?? tagAttributes ?? "",
-		body
-	]);
-	const hashSources = await Promise.all(elements.map((element) => getSsgHashSource(element, options)));
-	const hashes = {
-		script: [],
-		style: []
-	};
-	for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
-	return hashes;
-};
-export { collectSsgHashes };

package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts

@@ -1,2 +0,0 @@
-import { RateLimiterStore } from "../../models/RateLimiterStore.js";
-export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;

package/dist/runtime/services/createInMemoryRateLimiterStore.js

@@ -1,21 +0,0 @@
-// src/runtime/services/createInMemoryRateLimiterStore.ts
-const createInMemoryRateLimiterStore = (maxEntries) => {
-	const windows = /* @__PURE__ */ new Map();
-	return { increment: (key, intervalInMilliseconds) => {
-		const now = Date.now();
-		const current = windows.get(key);
-		const window = current && current.resetAt > now ? {
-			count: current.count + 1,
-			resetAt: current.resetAt
-		} : {
-			count: 1,
-			resetAt: now + intervalInMilliseconds
-		};
-		windows.delete(key);
-		windows.set(key, window);
-		const [oldestKey] = windows.keys();
-		if (windows.size > maxEntries && oldestKey !== void 0) windows.delete(oldestKey);
-		return Promise.resolve(window);
-	} };
-};
-export { createInMemoryRateLimiterStore };

package/dist/runtime/services/generateHash.d.ts

@@ -1 +0,0 @@
-export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;

package/dist/runtime/services/generateHash.js

@@ -1,8 +0,0 @@
-// src/runtime/services/generateHash.ts
-const generateHash = async (content, hashAlgorithm) => {
-	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
-	const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
-	const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
-	return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
-};
-export { generateHash };

package/dist/runtime/services/generateNonce.d.ts

@@ -1 +0,0 @@
-export declare const generateNonce: () => string;

package/dist/runtime/services/generateNonce.js

@@ -1,5 +0,0 @@
-import "../constants.js";
-import { generateRandomToken } from "./generateRandomToken.js";
-// src/runtime/services/generateNonce.ts
-const generateNonce = () => generateRandomToken(18);
-export { generateNonce };

package/dist/runtime/services/generateRandomToken.d.ts

@@ -1 +0,0 @@
-export declare const generateRandomToken: (byteLength: number) => string;

package/dist/runtime/services/generateRandomToken.js

@@ -1,7 +0,0 @@
-// src/runtime/services/generateRandomToken.ts
-const generateRandomToken = (byteLength) => {
-	const bytes = new Uint8Array(byteLength);
-	globalThis.crypto.getRandomValues(bytes);
-	return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
-};
-export { generateRandomToken };

package/dist/runtime/services/getBasicAuthCredentials.d.ts

@@ -1,4 +0,0 @@
-export declare const getBasicAuthCredentials: (authorization: null | string) => undefined | {
-  name: string;
-  pass: string;
-};

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -1,18 +0,0 @@
-import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
-// src/runtime/services/getBasicAuthCredentials.ts
-const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
-const BASE64_QUANTUM_LENGTH = 4;
-const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
-const getBasicAuthCredentials = (authorization) => {
-	if (!authorization?.startsWith(`Basic `)) return void 0;
-	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();
-	if (!checkIsBase64(encoded)) return void 0;
-	const decoded = new TextDecoder().decode(Uint8Array.fromBase64(encoded));
-	const separatorIndex = decoded.indexOf(":");
-	if (separatorIndex === -1) return void 0;
-	return {
-		name: decoded.slice(0, separatorIndex),
-		pass: decoded.slice(separatorIndex + 1)
-	};
-};
-export { getBasicAuthCredentials };

package/dist/runtime/services/getBasicAuthOptions.d.ts

@@ -1,2 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;

package/dist/runtime/services/getBasicAuthOptions.js

@@ -1,16 +0,0 @@
-import { checkIsRecord } from "./checkIsRecord.js";
-// src/runtime/services/getBasicAuthOptions.ts
-const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
-const getBasicAuthOptions = (privateRuntimeConfig) => {
-	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
-	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;
-	if (typeof name !== "string" || typeof pass !== "string") return void 0;
-	return {
-		...checkIsStringList(exclude) && { exclude },
-		...checkIsStringList(include) && { include },
-		...typeof message === "string" && { message },
-		name,
-		pass
-	};
-};
-export { getBasicAuthOptions };

package/dist/runtime/services/getRetryAfterSeconds.d.ts

@@ -1,3 +0,0 @@
-import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
-import { RateLimiterStore } from "../../models/RateLimiterStore.js";
-export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;

package/dist/runtime/services/getRetryAfterSeconds.js

@@ -1,8 +0,0 @@
-// src/runtime/services/getRetryAfterSeconds.ts
-const MILLISECONDS_PER_SECOND = 1e3;
-const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
-	const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
-	if (count <= tokensPerInterval) return void 0;
-	return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
-};
-export { getRetryAfterSeconds };

package/dist/runtime/services/getSecurityRules.d.ts

@@ -1,3 +0,0 @@
-import { SecurityRules } from "../../models/SecurityRules.js";
-import { H3Event } from "nitro/h3";
-export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;

package/dist/runtime/services/getSecurityRules.js

@@ -1,14 +0,0 @@
-import { mergeSecurityRules } from "./mergeSecurityRules.js";
-import { findSecurityRules } from "./securityRouteMatcher.js";
-// src/runtime/services/getSecurityRules.ts
-const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
-const getSecurityRules = (event) => {
-	const cachedRules = securityRulesByEvent.get(event);
-	if (cachedRules) return cachedRules;
-	const matchedRules = findSecurityRules(event.url.pathname);
-	if (!matchedRules) return void 0;
-	const rules = mergeSecurityRules(...matchedRules.toReversed());
-	securityRulesByEvent.set(event, rules);
-	return rules;
-};
-export { getSecurityRules };

package/dist/runtime/services/getSecurityState.d.ts

@@ -1,9 +0,0 @@
-import { H3Event } from "nitro/h3";
-export interface SecurityState {
-  hashes: {
-    script: string[];
-    style: string[];
-  };
-  nonce?: string;
-}
-export declare const getSecurityState: (event: H3Event) => SecurityState;

package/dist/runtime/services/getSecurityState.js

@@ -1,13 +0,0 @@
-// src/runtime/services/getSecurityState.ts
-const securityStateByEvent = /* @__PURE__ */ new WeakMap();
-const getSecurityState = (event) => {
-	const cachedState = securityStateByEvent.get(event);
-	if (cachedState) return cachedState;
-	const state = { hashes: {
-		script: [],
-		style: []
-	} };
-	securityStateByEvent.set(event, state);
-	return state;
-};
-export { getSecurityState };

package/dist/runtime/services/injectNonce.d.ts

@@ -1 +0,0 @@
-export declare const injectNonce: (html: string, nonce: string) => string;

package/dist/runtime/services/injectNonce.js

@@ -1,6 +0,0 @@
-import { NONCE_TAG_NAMES } from "../constants.js";
-import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
-import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
-// src/runtime/services/injectNonce.ts
-const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
-export { injectNonce };

package/dist/runtime/services/injectSubresourceIntegrity.d.ts

@@ -1 +0,0 @@
-export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;

package/dist/runtime/services/injectSubresourceIntegrity.js

@@ -1,21 +0,0 @@
-import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
-import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
-// src/runtime/services/injectSubresourceIntegrity.ts
-const RESOURCE_ATTRIBUTE_NAMES = {
-	link: "href",
-	script: "src"
-};
-const INTEGRITY_LINK_RELS = /* @__PURE__ */ new Set([
-	"modulepreload",
-	"preload",
-	"stylesheet"
-]);
-const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagName, attributes) => {
-	const resourceAttributeName = RESOURCE_ATTRIBUTE_NAMES[tagName.toLowerCase()];
-	if (!resourceAttributeName || readHtmlTagAttribute(attributes, "integrity") !== void 0) return void 0;
-	const resource = readHtmlTagAttribute(attributes, resourceAttributeName);
-	if (resource === void 0 || hashes[resource] === void 0) return void 0;
-	if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
-	return ` integrity="${hashes[resource]}"${attributes}`;
-});
-export { injectSubresourceIntegrity };

package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts

@@ -1,2 +0,0 @@
-import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
-export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;

package/dist/runtime/services/insertContentSecurityPolicyMeta.js

@@ -1,16 +0,0 @@
-import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
-// src/runtime/services/insertContentSecurityPolicyMeta.ts
-const META_CONTENT_SECURITY_POLICY_REGEX = /<meta\s+http-equiv=["']Content-Security-Policy["'][^>]*>/iu;
-const HEAD_CHARSET_REGEX = /<meta\s+charset=["'][^"']*["'][^>]*>/iu;
-const HEAD_OPEN_REGEX = /<head\b[^>]*>/iu;
-const insertContentSecurityPolicyMeta = (html, policy) => {
-	const metaTag = `<meta http-equiv="Content-Security-Policy" content="${serializeContentSecurityPolicy({
-		...policy,
-		"frame-ancestors": false
-	})}">`;
-	if (META_CONTENT_SECURITY_POLICY_REGEX.test(html)) return html.replace(META_CONTENT_SECURITY_POLICY_REGEX, metaTag);
-	const insertion = HEAD_CHARSET_REGEX.exec(html) ?? HEAD_OPEN_REGEX.exec(html);
-	const insertAt = insertion ? insertion.index + insertion[0].length : 0;
-	return html.slice(0, insertAt) + metaTag + html.slice(insertAt);
-};
-export { insertContentSecurityPolicyMeta };

package/dist/runtime/services/mergeSecurityRules.d.ts

@@ -1,2 +0,0 @@
-import { SecurityRules } from "../../models/SecurityRules.js";
-export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;

package/dist/runtime/services/mergeSecurityRules.js

@@ -1,10 +0,0 @@
-import { createDefu } from "defu";
-// src/runtime/services/mergeSecurityRules.ts
-const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
-	if (Array.isArray(object[key]) || Array.isArray(value)) {
-		object[key] = value;
-		return true;
-	}
-});
-const mergeSecurityRules = (...rules) => mergeRulesWithReplacedArrays({}, ...rules);
-export { mergeSecurityRules };

package/dist/runtime/services/readHtmlTagAttribute.d.ts

@@ -1 +0,0 @@
-export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;

package/dist/runtime/services/readHtmlTagAttribute.js

@@ -1,7 +0,0 @@
-import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
-// src/runtime/services/readHtmlTagAttribute.ts
-const readHtmlTagAttribute = (attributes, attributeName) => {
-	for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
-};
-const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
-export { readHtmlTagAttribute };

package/dist/runtime/services/rewriteHtmlTags.d.ts

@@ -1 +0,0 @@
-export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;

package/dist/runtime/services/rewriteHtmlTags.js

@@ -1,8 +0,0 @@
-import { HTML_TAG_REGEX } from "../constants.js";
-// src/runtime/services/rewriteHtmlTags.ts
-const rewriteHtmlTags = (html, rewriteAttributes) => html.replace(HTML_TAG_REGEX, (match, elementName, elementAttributes, elementTrailer, body, tagName, tagAttributes, tagTrailer) => {
-	if (elementName) return `<${elementName}${rewriteAttributes(elementName, elementAttributes ?? "") ?? elementAttributes}${elementTrailer}>${body}</${elementName}>`;
-	const attributes = rewriteAttributes(tagName ?? "", tagAttributes ?? "");
-	return attributes === void 0 ? match : `<${tagName}${attributes}${tagTrailer}>`;
-});
-export { rewriteHtmlTags };

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -1,3 +0,0 @@
-import { SecurityRules } from "../../models/SecurityRules.js";
-export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
-export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;

package/dist/runtime/services/securityRouteMatcher.js

@@ -1,10 +0,0 @@
-import { addRoute, createRouter, findAllRoutes } from "rou3";
-// src/runtime/services/securityRouteMatcher.ts
-let securityRouter;
-const setSecurityRouteMatcher = (routes) => {
-	const router = createRouter();
-	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
-	securityRouter = router;
-};
-const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
-export { findSecurityRules, setSecurityRouteMatcher };

package/dist/runtime/services/serializeBasicAuthChallenge.d.ts

@@ -1 +0,0 @@
-export declare const serializeBasicAuthChallenge: (realm: string) => string;

package/dist/runtime/services/serializeBasicAuthChallenge.js

@@ -1,3 +0,0 @@
-// src/runtime/services/serializeBasicAuthChallenge.ts
-const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
-export { serializeBasicAuthChallenge };