tina4-nodejs 3.13.121 → 3.13.122

package/packages/orm/dist/index.js

@@ -6657,6 +6657,9 @@ var init_middleware = __esm({
             `max-age=${hsts}; includeSubDomains`
           );
         }
+        if (process.env.TINA4_CSP === void 0) {
+          _SecurityHeadersMiddleware.warnCspDefaultOnce();
+        }
         res.header(
           "Content-Security-Policy",
           process.env.TINA4_CSP ?? "default-src 'self'"
@@ -6672,6 +6675,30 @@ var init_middleware = __esm({
         );
         return [req2, res];
       }
+      /** Warn-once ledger for the default-CSP heads-up (per process). */
+      static cspDefaultWarned = false;
+      /**
+       * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+       *
+       * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+       * default is invisible: it blocks runtime-injected inline styles, cross-origin
+       * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+       * API or LiveKit host) — and the failure surfaces only in the browser at
+       * runtime, long after a deploy has gone green. So the framework says so once,
+       * naming the escape hatch. It NEVER fails the boot or a request — logging a
+       * heads-up must not be the reason the server or a request dies. Fires only when
+       * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+       */
+      static warnCspDefaultOnce() {
+        if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
+        _SecurityHeadersMiddleware.cspDefaultWarned = true;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        try {
+          Log.warning(message);
+        } catch {
+          console.warn(message);
+        }
+      }
       /**
        * True when the client request is HTTPS. Proxy-aware and byte-parity with
        * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby

package/types/core/src/middleware.d.ts

@@ -303,6 +303,21 @@ export declare class RequestLogger {
  */
 export declare class SecurityHeadersMiddleware {
     static beforeSecurity(req: Tina4Request, res: Tina4Response): [Tina4Request, Tina4Response];
+    /** Warn-once ledger for the default-CSP heads-up (per process). */
+    private static cspDefaultWarned;
+    /**
+     * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+     *
+     * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+     * default is invisible: it blocks runtime-injected inline styles, cross-origin
+     * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+     * API or LiveKit host) — and the failure surfaces only in the browser at
+     * runtime, long after a deploy has gone green. So the framework says so once,
+     * naming the escape hatch. It NEVER fails the boot or a request — logging a
+     * heads-up must not be the reason the server or a request dies. Fires only when
+     * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+     */
+    private static warnCspDefaultOnce;
     /**
      * True when the client request is HTTPS. Proxy-aware and byte-parity with
      * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby