nuxt-security-module 4.4.0 → 4.5.0

package/dist/runtime/server/middleware/csrf.js

@@ -0,0 +1,27 @@
+import { CSRF_UNSAFE_METHODS } from "../../constants.js";
+import { checkIsCsrfTokenValid } from "../../services/checkIsCsrfTokenValid.js";
+import { generateRandomToken } from "../../services/generateRandomToken.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getCookie, setCookie } from "nitro/h3";
+// src/runtime/server/middleware/csrf.ts
+const csrf = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.csrf) return;
+	const { cookieName, headerName } = rules.csrf;
+	const cookieToken = getCookie(event, cookieName);
+	if (!CSRF_UNSAFE_METHODS.includes(event.req.method)) {
+		if (cookieToken === void 0) setCookie(event, cookieName, generateRandomToken(32), {
+			httpOnly: false,
+			path: "/",
+			sameSite: "strict",
+			secure: event.url.protocol === "https:"
+		});
+		return;
+	}
+	if (!checkIsCsrfTokenValid(cookieToken, event.req.headers.get(headerName))) throw new HTTPError({
+		status: 403,
+		statusText: "Forbidden"
+	});
+});
+export { csrf as default };

package/dist/runtime/server/middleware/rateLimiter.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const rateLimiter: Middleware;
+export { rateLimiter as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -0,0 +1,21 @@
+import { MAX_RATE_LIMIT_ENTRIES } from "../../constants.js";
+import { createInMemoryRateLimiterStore } from "../../services/createInMemoryRateLimiterStore.js";
+import { getRetryAfterSeconds } from "../../services/getRetryAfterSeconds.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getRequestIP } from "nitro/h3";
+// src/runtime/server/middleware/rateLimiter.ts
+const rateLimiterStore = createInMemoryRateLimiterStore(MAX_RATE_LIMIT_ENTRIES);
+const rateLimiter = defineMiddleware(async (event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.rateLimiter) return;
+	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
+	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
+	if (retryAfterSeconds === void 0) return;
+	throw new HTTPError({
+		headers: { "Retry-After": String(retryAfterSeconds) },
+		status: 429,
+		statusText: "Too Many Requests"
+	});
+});
+export { rateLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const requestSizeLimiter: Middleware;
+export { requestSizeLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -0,0 +1,18 @@
+import { checkIsBodyCounted } from "../../services/checkIsBodyCounted.js";
+import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, assertBodySize } from "nitro/h3";
+// src/runtime/server/middleware/requestSizeLimiter.ts
+const requestSizeLimiter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.requestSizeLimiter) return;
+	const { method } = event.req;
+	const contentLength = event.req.headers.get("content-length");
+	if (checkIsRequestTooLarge(method, contentLength, rules.requestSizeLimiter)) throw new HTTPError({
+		status: 413,
+		statusText: "Payload Too Large"
+	});
+	if (checkIsBodyCounted(method, contentLength)) assertBodySize(event, rules.requestSizeLimiter.maxRequestSizeInBytes);
+});
+export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBase64.d.ts

@@ -0,0 +1 @@
+export declare const checkIsBase64: (value: string) => boolean;

package/dist/runtime/services/checkIsBase64.js

@@ -0,0 +1,5 @@
+// src/runtime/services/checkIsBase64.ts
+const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
+const BASE64_QUANTUM_LENGTH = 4;
+const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
+export { checkIsBase64 };

package/dist/runtime/services/checkIsBasicAuthorized.d.ts

@@ -0,0 +1,2 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+export declare const checkIsBasicAuthorized: (authorization: null | string, { name, pass }: BasicAuthOptions) => boolean;

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -0,0 +1,12 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
+// src/runtime/services/checkIsBasicAuthorized.ts
+const checkIsBasicAuthorized = (authorization, { name, pass }) => {
+	if (!name || !pass) return false;
+	const credentials = getBasicAuthCredentials(authorization);
+	if (!credentials) return false;
+	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);
+	const isPassEqual = checkIsEqualInConstantTime(credentials.pass, pass);
+	return isNameEqual && isPassEqual;
+};
+export { checkIsBasicAuthorized };

package/dist/runtime/services/checkIsBodyCounted.d.ts

@@ -0,0 +1 @@
+export declare const checkIsBodyCounted: (method: string, contentLength: null | string) => boolean;

package/dist/runtime/services/checkIsBodyCounted.js

@@ -0,0 +1,4 @@
+import { SIZE_LIMITED_METHODS } from "../constants.js";
+// src/runtime/services/checkIsBodyCounted.ts
+const checkIsBodyCounted = (method, contentLength) => contentLength === null && SIZE_LIMITED_METHODS.includes(method);
+export { checkIsBodyCounted };

package/dist/runtime/services/checkIsChallenged.d.ts

@@ -0,0 +1,2 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+export declare const checkIsChallenged: (path: string, { exclude, include }: BasicAuthOptions) => boolean;

package/dist/runtime/services/checkIsChallenged.js

@@ -0,0 +1,7 @@
+// src/runtime/services/checkIsChallenged.ts
+const checkIsChallenged = (path, { exclude = [], include = [] }) => {
+	const isIncluded = include.some((prefix) => path.startsWith(prefix));
+	const isExcluded = exclude.some((prefix) => path.startsWith(prefix));
+	return isIncluded || !isExcluded;
+};
+export { checkIsChallenged };

package/dist/runtime/services/checkIsCsrfTokenValid.d.ts

@@ -0,0 +1 @@
+export declare const checkIsCsrfTokenValid: (cookieToken: string | undefined, headerToken: null | string) => boolean;

package/dist/runtime/services/checkIsCsrfTokenValid.js

@@ -0,0 +1,7 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+// src/runtime/services/checkIsCsrfTokenValid.ts
+const checkIsCsrfTokenValid = (cookieToken, headerToken) => {
+	if (!cookieToken || !headerToken) return false;
+	return checkIsEqualInConstantTime(cookieToken, headerToken);
+};
+export { checkIsCsrfTokenValid };

package/dist/runtime/services/checkIsEqualInConstantTime.d.ts

@@ -0,0 +1 @@
+export declare const checkIsEqualInConstantTime: (first: string, second: string) => boolean;

package/dist/runtime/services/checkIsEqualInConstantTime.js

@@ -0,0 +1,10 @@
+// src/runtime/services/checkIsEqualInConstantTime.ts
+const checkIsEqualInConstantTime = (first, second) => {
+	const firstBytes = new TextEncoder().encode(first);
+	const secondBytes = new TextEncoder().encode(second);
+	if (firstBytes.length !== secondBytes.length) return false;
+	let difference = 0;
+	for (const [index, byte] of firstBytes.entries()) difference |= byte ^ (secondBytes[index] ?? 0);
+	return difference === 0;
+};
+export { checkIsEqualInConstantTime };

package/dist/runtime/services/checkIsMethodAllowed.d.ts

@@ -0,0 +1 @@
+export declare const checkIsMethodAllowed: (method: string, methods: string[]) => boolean;

package/dist/runtime/services/checkIsMethodAllowed.js

@@ -0,0 +1,3 @@
+// src/runtime/services/checkIsMethodAllowed.ts
+const checkIsMethodAllowed = (method, methods) => methods.includes(method);
+export { checkIsMethodAllowed };

package/dist/runtime/services/checkIsRecord.d.ts

@@ -0,0 +1 @@
+export declare const checkIsRecord: (value: unknown) => value is Record<string, unknown>;

package/dist/runtime/services/checkIsRecord.js

@@ -0,0 +1,3 @@
+// src/runtime/services/checkIsRecord.ts
+const checkIsRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+export { checkIsRecord };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -0,0 +1,2 @@
+import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
+export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, { maxRequestSizeInBytes }: RequestSizeLimiterOptions) => boolean;

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -0,0 +1,7 @@
+import { SIZE_LIMITED_METHODS } from "../constants.js";
+// src/runtime/services/checkIsRequestTooLarge.ts
+const checkIsRequestTooLarge = (method, contentLength, { maxRequestSizeInBytes }) => {
+	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
+	return Math.trunc(Number(contentLength)) > maxRequestSizeInBytes;
+};
+export { checkIsRequestTooLarge };

package/dist/runtime/services/checkIsSecurityHeaderKey.d.ts

@@ -0,0 +1,2 @@
+import { SecurityHeaders } from "../../models/SecurityHeaders.js";
+export declare const checkIsSecurityHeaderKey: (key: string) => key is keyof SecurityHeaders;

package/dist/runtime/services/checkIsSecurityHeaderKey.js

@@ -0,0 +1,4 @@
+import { SECURITY_HEADER_NAMES } from "../constants.js";
+// src/runtime/services/checkIsSecurityHeaderKey.ts
+const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
+export { checkIsSecurityHeaderKey };

package/dist/runtime/services/checkIsStaticNonce.d.ts

@@ -0,0 +1 @@
+export declare const checkIsStaticNonce: (source: string) => boolean;

package/dist/runtime/services/checkIsStaticNonce.js

@@ -0,0 +1,4 @@
+import "../constants.js";
+// src/runtime/services/checkIsStaticNonce.ts
+const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
+export { checkIsStaticNonce };

package/dist/runtime/services/checkIsStringList.d.ts

@@ -0,0 +1 @@
+export declare const checkIsStringList: (value: unknown) => value is string[];

package/dist/runtime/services/checkIsStringList.js

@@ -0,0 +1,3 @@
+// src/runtime/services/checkIsStringList.ts
+const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+export { checkIsStringList };

package/dist/runtime/services/collectSsgHashes.d.ts

@@ -0,0 +1,3 @@
+import { SsgOptions } from "../../models/SsgOptions.js";
+import { SecurityState } from "./getSecurityState.js";
+export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;

package/dist/runtime/services/collectSsgHashes.js

@@ -0,0 +1,18 @@
+import { HTML_TAG_REGEX } from "../constants.js";
+import { getSsgHashSource } from "./getSsgHashSource.js";
+// src/runtime/services/collectSsgHashes.ts
+const collectSsgHashes = async (html, options) => {
+	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
+		(elementName ?? tagName ?? "").toLowerCase(),
+		elementAttributes ?? tagAttributes ?? "",
+		body
+	]);
+	const hashSources = await Promise.all(elements.map((element) => getSsgHashSource(element, options)));
+	const hashes = {
+		script: [],
+		style: []
+	};
+	for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
+	return hashes;
+};
+export { collectSsgHashes };

package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts

@@ -0,0 +1,2 @@
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;

package/dist/runtime/services/createInMemoryRateLimiterStore.js

@@ -0,0 +1,21 @@
+// src/runtime/services/createInMemoryRateLimiterStore.ts
+const createInMemoryRateLimiterStore = (maxEntries) => {
+	const windows = /* @__PURE__ */ new Map();
+	return { increment: (key, intervalInMilliseconds) => {
+		const now = Date.now();
+		const current = windows.get(key);
+		const window = current && current.resetAt > now ? {
+			count: current.count + 1,
+			resetAt: current.resetAt
+		} : {
+			count: 1,
+			resetAt: now + intervalInMilliseconds
+		};
+		windows.delete(key);
+		windows.set(key, window);
+		const [oldestKey] = windows.keys();
+		if (windows.size > maxEntries && oldestKey !== void 0) windows.delete(oldestKey);
+		return Promise.resolve(window);
+	} };
+};
+export { createInMemoryRateLimiterStore };

package/dist/runtime/services/generateHash.d.ts

@@ -0,0 +1 @@
+export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;

package/dist/runtime/services/generateHash.js

@@ -0,0 +1,8 @@
+// src/runtime/services/generateHash.ts
+const generateHash = async (content, hashAlgorithm) => {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
+	const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
+	const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
+	return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
+};
+export { generateHash };

package/dist/runtime/services/generateNonce.d.ts

@@ -0,0 +1 @@
+export declare const generateNonce: () => string;

package/dist/runtime/services/generateNonce.js

@@ -0,0 +1,5 @@
+import "../constants.js";
+import { generateRandomToken } from "./generateRandomToken.js";
+// src/runtime/services/generateNonce.ts
+const generateNonce = () => generateRandomToken(18);
+export { generateNonce };

package/dist/runtime/services/generateRandomToken.d.ts

@@ -0,0 +1 @@
+export declare const generateRandomToken: (byteLength: number) => string;

package/dist/runtime/services/generateRandomToken.js

@@ -0,0 +1,7 @@
+// src/runtime/services/generateRandomToken.ts
+const generateRandomToken = (byteLength) => {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
+};
+export { generateRandomToken };

package/dist/runtime/services/getBasicAuthCredentials.d.ts

@@ -0,0 +1,4 @@
+export declare const getBasicAuthCredentials: (authorization: null | string) => undefined | {
+  name: string;
+  pass: string;
+};

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -0,0 +1,16 @@
+import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
+import { checkIsBase64 } from "./checkIsBase64.js";
+// src/runtime/services/getBasicAuthCredentials.ts
+const getBasicAuthCredentials = (authorization) => {
+	if (!authorization?.startsWith(`Basic `)) return void 0;
+	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();
+	if (!checkIsBase64(encoded)) return void 0;
+	const decoded = new TextDecoder().decode(Uint8Array.fromBase64(encoded));
+	const separatorIndex = decoded.indexOf(":");
+	if (separatorIndex === -1) return void 0;
+	return {
+		name: decoded.slice(0, separatorIndex),
+		pass: decoded.slice(separatorIndex + 1)
+	};
+};
+export { getBasicAuthCredentials };

package/dist/runtime/services/getBasicAuthOptions.d.ts

@@ -0,0 +1,2 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;

package/dist/runtime/services/getBasicAuthOptions.js

@@ -0,0 +1,16 @@
+import { checkIsRecord } from "./checkIsRecord.js";
+import { checkIsStringList } from "./checkIsStringList.js";
+// src/runtime/services/getBasicAuthOptions.ts
+const getBasicAuthOptions = (privateRuntimeConfig) => {
+	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
+	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;
+	if (typeof name !== "string" || typeof pass !== "string") return void 0;
+	return {
+		...checkIsStringList(exclude) && { exclude },
+		...checkIsStringList(include) && { include },
+		...typeof message === "string" && { message },
+		name,
+		pass
+	};
+};
+export { getBasicAuthOptions };

package/dist/runtime/services/getRetryAfterSeconds.d.ts

@@ -0,0 +1,3 @@
+import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;

package/dist/runtime/services/getRetryAfterSeconds.js

@@ -0,0 +1,8 @@
+// src/runtime/services/getRetryAfterSeconds.ts
+const MILLISECONDS_PER_SECOND = 1e3;
+const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
+	const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
+	if (count <= tokensPerInterval) return void 0;
+	return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
+};
+export { getRetryAfterSeconds };

package/dist/runtime/services/getSecurityRules.d.ts

@@ -0,0 +1,3 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+import { H3Event } from "nitro/h3";
+export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;

package/dist/runtime/services/getSecurityRules.js

@@ -0,0 +1,14 @@
+import { mergeSecurityRules } from "./mergeSecurityRules.js";
+import { findSecurityRules } from "./securityRouteMatcher.js";
+// src/runtime/services/getSecurityRules.ts
+const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityRules = (event) => {
+	const cachedRules = securityRulesByEvent.get(event);
+	if (cachedRules) return cachedRules;
+	const matchedRules = findSecurityRules(event.url.pathname);
+	if (!matchedRules) return void 0;
+	const rules = mergeSecurityRules(...matchedRules.toReversed());
+	securityRulesByEvent.set(event, rules);
+	return rules;
+};
+export { getSecurityRules };

package/dist/runtime/services/getSecurityState.d.ts

@@ -0,0 +1,9 @@
+import { H3Event } from "nitro/h3";
+export interface SecurityState {
+  hashes: {
+    script: string[];
+    style: string[];
+  };
+  nonce?: string;
+}
+export declare const getSecurityState: (event: H3Event) => SecurityState;

package/dist/runtime/services/getSecurityState.js

@@ -0,0 +1,13 @@
+// src/runtime/services/getSecurityState.ts
+const securityStateByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityState = (event) => {
+	const cachedState = securityStateByEvent.get(event);
+	if (cachedState) return cachedState;
+	const state = { hashes: {
+		script: [],
+		style: []
+	} };
+	securityStateByEvent.set(event, state);
+	return state;
+};
+export { getSecurityState };

package/dist/runtime/services/getSsgHashSource.d.ts

@@ -0,0 +1,4 @@
+import { SsgElement } from "../../models/SsgElement.js";
+import { SsgHashSource } from "../../models/SsgHashSource.js";
+import { SsgOptions } from "../../models/SsgOptions.js";
+export declare const getSsgHashSource: ([name, attributes, body]: SsgElement, { hashScripts, hashStyles }: SsgOptions) => Promise<SsgHashSource | undefined>;

package/dist/runtime/services/getSsgHashSource.js

@@ -0,0 +1,26 @@
+import { CSP_HASH_ALGORITHM } from "../constants.js";
+import { generateHash } from "./generateHash.js";
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+// src/runtime/services/getSsgHashSource.ts
+const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
+	"audioworklet",
+	"paintworklet",
+	"script",
+	"xslt"
+]);
+const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
+	const integrity = readHtmlTagAttribute(attributes, "integrity");
+	if (name === "script" && hashScripts) {
+		const source = readHtmlTagAttribute(attributes, "src");
+		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
+		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+		return;
+	}
+	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+	if (name !== "link" || integrity === void 0) return void 0;
+	const rel = readHtmlTagAttribute(attributes, "rel");
+	const as = readHtmlTagAttribute(attributes, "as") ?? "";
+	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
+	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
+};
+export { getSsgHashSource };

package/dist/runtime/services/injectNonce.d.ts

@@ -0,0 +1 @@
+export declare const injectNonce: (html: string, nonce: string) => string;

package/dist/runtime/services/injectNonce.js

@@ -0,0 +1,6 @@
+import { NONCE_TAG_NAMES } from "../constants.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
+// src/runtime/services/injectNonce.ts
+const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
+export { injectNonce };

package/dist/runtime/services/injectSubresourceIntegrity.d.ts

@@ -0,0 +1 @@
+export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;

package/dist/runtime/services/injectSubresourceIntegrity.js

@@ -0,0 +1,21 @@
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+// src/runtime/services/injectSubresourceIntegrity.ts
+const RESOURCE_ATTRIBUTE_NAMES = {
+	link: "href",
+	script: "src"
+};
+const INTEGRITY_LINK_RELS = /* @__PURE__ */ new Set([
+	"modulepreload",
+	"preload",
+	"stylesheet"
+]);
+const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagName, attributes) => {
+	const resourceAttributeName = RESOURCE_ATTRIBUTE_NAMES[tagName.toLowerCase()];
+	if (!resourceAttributeName || readHtmlTagAttribute(attributes, "integrity") !== void 0) return void 0;
+	const resource = readHtmlTagAttribute(attributes, resourceAttributeName);
+	if (resource === void 0 || !Object.hasOwn(hashes, resource)) return void 0;
+	if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
+	return ` integrity="${hashes[resource]}"${attributes}`;
+});
+export { injectSubresourceIntegrity };

package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts

@@ -0,0 +1,2 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;

package/dist/runtime/services/insertContentSecurityPolicyMeta.js

@@ -0,0 +1,16 @@
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+// src/runtime/services/insertContentSecurityPolicyMeta.ts
+const META_CONTENT_SECURITY_POLICY_REGEX = /<meta\s+http-equiv=["']Content-Security-Policy["'][^>]*>/iu;
+const HEAD_CHARSET_REGEX = /<meta\s+charset=["'][^"']*["'][^>]*>/iu;
+const HEAD_OPEN_REGEX = /<head\b[^>]*>/iu;
+const insertContentSecurityPolicyMeta = (html, policy) => {
+	const metaTag = `<meta http-equiv="Content-Security-Policy" content="${serializeContentSecurityPolicy({
+		...policy,
+		"frame-ancestors": false
+	})}">`;
+	if (META_CONTENT_SECURITY_POLICY_REGEX.test(html)) return html.replace(META_CONTENT_SECURITY_POLICY_REGEX, metaTag);
+	const insertion = HEAD_CHARSET_REGEX.exec(html) ?? HEAD_OPEN_REGEX.exec(html);
+	const insertAt = insertion ? insertion.index + insertion[0].length : 0;
+	return html.slice(0, insertAt) + metaTag + html.slice(insertAt);
+};
+export { insertContentSecurityPolicyMeta };

package/dist/runtime/services/mergeSecurityRules.d.ts

@@ -0,0 +1,2 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;

package/dist/runtime/services/mergeSecurityRules.js

@@ -0,0 +1,10 @@
+import { createDefu } from "defu";
+// src/runtime/services/mergeSecurityRules.ts
+const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
+	if (Array.isArray(object[key]) || Array.isArray(value)) {
+		object[key] = value;
+		return true;
+	}
+});
+const mergeSecurityRules = (...rules) => mergeRulesWithReplacedArrays({}, ...rules);
+export { mergeSecurityRules };

package/dist/runtime/services/readHtmlTagAttribute.d.ts

@@ -0,0 +1 @@
+export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;

package/dist/runtime/services/readHtmlTagAttribute.js

@@ -0,0 +1,7 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+import { unquote } from "./unquote.js";
+// src/runtime/services/readHtmlTagAttribute.ts
+const readHtmlTagAttribute = (attributes, attributeName) => {
+	for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
+};
+export { readHtmlTagAttribute };

package/dist/runtime/services/rewriteHtmlTags.d.ts

@@ -0,0 +1 @@
+export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;

package/dist/runtime/services/rewriteHtmlTags.js

@@ -0,0 +1,8 @@
+import { HTML_TAG_REGEX } from "../constants.js";
+// src/runtime/services/rewriteHtmlTags.ts
+const rewriteHtmlTags = (html, rewriteAttributes) => html.replace(HTML_TAG_REGEX, (match, elementName, elementAttributes, elementTrailer, body, tagName, tagAttributes, tagTrailer) => {
+	if (elementName) return `<${elementName}${rewriteAttributes(elementName, elementAttributes ?? "") ?? elementAttributes}${elementTrailer}>${body}</${elementName}>`;
+	const attributes = rewriteAttributes(tagName ?? "", tagAttributes ?? "");
+	return attributes === void 0 ? match : `<${tagName}${attributes}${tagTrailer}>`;
+});
+export { rewriteHtmlTags };

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -0,0 +1,4 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
+export declare const setSecurityRouteMatcherFailure: (cause: unknown) => void;
+export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;

package/dist/runtime/services/securityRouteMatcher.js

@@ -0,0 +1,17 @@
+import { addRoute, createRouter, findAllRoutes } from "rou3";
+// src/runtime/services/securityRouteMatcher.ts
+let securityRouter;
+let securityRouteFailure;
+const setSecurityRouteMatcher = (routes) => {
+	const router = createRouter();
+	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
+	securityRouter = router;
+};
+const setSecurityRouteMatcherFailure = (cause) => {
+	securityRouteFailure = new TypeError("nuxt-security-module: the security route rules did not resolve", { cause });
+};
+const findSecurityRules = (pathname) => {
+	if (securityRouteFailure) throw securityRouteFailure;
+	return securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
+};
+export { findSecurityRules, setSecurityRouteMatcher, setSecurityRouteMatcherFailure };

package/dist/runtime/services/serializeBasicAuthChallenge.d.ts

@@ -0,0 +1 @@
+export declare const serializeBasicAuthChallenge: (realm: string) => string;

package/dist/runtime/services/serializeBasicAuthChallenge.js

@@ -0,0 +1,3 @@
+// src/runtime/services/serializeBasicAuthChallenge.ts
+const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
+export { serializeBasicAuthChallenge };

package/dist/runtime/services/serializeContentSecurityPolicy.d.ts

@@ -0,0 +1,2 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;

package/dist/runtime/services/serializeContentSecurityPolicy.js

@@ -0,0 +1,6 @@
+// src/runtime/services/serializeContentSecurityPolicy.ts
+const serializeContentSecurityPolicy = (policy) => Object.entries(policy).filter(([, value]) => value !== false).map(([directive, value]) => {
+	if (directive === "upgrade-insecure-requests") return "upgrade-insecure-requests;";
+	return `${directive} ${Array.isArray(value) ? value.map((source) => source.trim()).join(" ") : ""};`;
+}).join(" ");
+export { serializeContentSecurityPolicy };

package/dist/runtime/services/serializePermissionsPolicy.d.ts

@@ -0,0 +1,2 @@
+import { PermissionsPolicy } from "../../models/PermissionsPolicy.js";
+export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;

package/dist/runtime/services/serializePermissionsPolicy.js

@@ -0,0 +1,3 @@
+// src/runtime/services/serializePermissionsPolicy.ts
+const serializePermissionsPolicy = (policy) => Object.entries(policy).flatMap(([feature, sources]) => sources === false ? [] : [`${feature}=(${(sources ?? []).join(" ")})`]).join(", ");
+export { serializePermissionsPolicy };

package/dist/runtime/services/serializeSecurityHeaders.d.ts

@@ -0,0 +1,2 @@
+import { SecurityHeaders } from "../../models/SecurityHeaders.js";
+export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;