sveltekit-auth-example 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 1.0.4
+* [Fix] If you login with a Google account, you cannot Update the Profile (UI is looking for password and confirm password which don't make sense in this context)
+* Added Content Security Policy
+
 # 1.0.3
 * [Fix] user created or updated when password mismatches (@lxy-yz)
 * Updated project dependencies
@@ -5,18 +9,15 @@
 * Added declarations for Session and Locals for type safety
 
 # 1.0.2
-
 * [Fix] Updated endpoints and hooks to conform to SvelteKit's API changes.
 * Updated project dependencies
 
 # 1.0.1
-
 * Switched to dotenv vs. VITE_ env values for better security
 * Load Sign in with Google via code instead of static template
 * Fix logout (didn't work if session expired)
 * Fix login button rendering if that's the starting page
 
 # Backlog
-
 * [Low] Add password complexity check
 * [Low] Add Google reCaptcha 3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sveltekit-auth-example",
   "description": "SvelteKit Authentication Example",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "private": false,
   "author": "Nate Stuyvesant",
   "license": "https://github.com/nstuyvesant/sveltekit-auth-example/blob/master/LICENSE",
@@ -12,6 +12,15 @@
   "bugs": {
     "url": "https://github.com/nstuyvesant/sveltekit-auth-example/issues"
   },
+  "keywords": [
+    "svelte",
+    "sveltekit",
+    "authentication",
+    "example",
+    "google",
+    "postgresql",
+    "example"
+  ],
   "scripts": {
     "dev": "svelte-kit dev",
     "serve": "npm run dev -- --open",

package/src/routes/profile.svelte

@@ -32,7 +32,7 @@
     message = ''
     const form = document.forms['profile']
 
-    if (!passwordMatch()) {
+    if (!user.email.includes('gmail.com') && !passwordMatch()) {
       confirmPassword.classList.add('is-invalid')
       return
     }

package/svelte.config.js

@@ -1,6 +1,19 @@
 import adapter from '@sveltejs/adapter-node'
 import preprocess from 'svelte-preprocess'
 
+const production = process.env.NODE_ENV === 'production'
+
+const baseCsp = [
+	'self',
+	// 'strict-dynamic', // issues with datepicker on classes, add to calendar scripts
+	'https://www.gstatic.com/recaptcha/', // recaptcha
+	'https://accounts.google.com/gsi/', // sign-in w/google
+	'https://www.google.com/recaptcha/', // recapatcha
+	'https://fonts.gstatic.com/' // recaptcha fonts
+]
+
+if (!production) baseCsp.push('ws://localhost:3000')
+
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	preprocess: preprocess(),
@@ -8,7 +21,24 @@ const config = {
 	kit: {
 		adapter: adapter({
 			out: 'build'
-		})
+		}),
+		csp: {
+			mode: 'auto',
+			directives: {
+				'default-src': [...baseCsp],
+				'script-src': ['unsafe-inline', ...baseCsp],
+				'img-src': ['data:', 'blob:', ...baseCsp],
+				'style-src': ['unsafe-inline', ...baseCsp],
+				'object-src': ['none'],
+				'base-uri': ['self'],
+				// 'require-trusted-types-for': ["'script'"] // will require effort to get this working
+			}
+		},
+		vite: {
+			serviceWorker: {
+				files: (filepath) => !/\.DS_Store/.test(filepath)
+			}
+		}
 	}
 }