tlc-claude-code 1.4.8 → 1.4.9

package/server/lib/network/security-headers.js

@@ -0,0 +1,251 @@
+/**
+ * Security Headers Manager
+ * Generates and validates security headers for HTTP responses
+ */
+
+export const HEADER_PRESETS = {
+  STRICT: {
+    csp: {
+      strict: true,
+    },
+    hsts: {
+      maxAge: 31536000,
+      includeSubDomains: true,
+      preload: true,
+    },
+    xFrameOptions: 'DENY',
+    referrerPolicy: 'strict-origin-when-cross-origin',
+    permissionsPolicy: {
+      strict: true,
+    },
+  },
+  RELAXED: {
+    csp: {
+      strict: false,
+    },
+    hsts: {
+      maxAge: 31536000,
+      includeSubDomains: false,
+    },
+    xFrameOptions: 'SAMEORIGIN',
+    referrerPolicy: 'strict-origin-when-cross-origin',
+  },
+};
+
+/**
+ * Generate Content Security Policy header value
+ */
+export function generateCsp(options) {
+  const { strict, scriptSrc, styleSrc, reportUri, frameAncestors, upgradeInsecureRequests } =
+    options;
+
+  const directives = [];
+
+  // Default source
+  directives.push("default-src 'self'");
+
+  // Script source
+  if (scriptSrc) {
+    directives.push(`script-src ${scriptSrc.join(' ')}`);
+  } else if (strict) {
+    directives.push("script-src 'self'");
+  }
+
+  // Style source
+  if (styleSrc) {
+    directives.push(`style-src ${styleSrc.join(' ')}`);
+  } else if (strict) {
+    directives.push("style-src 'self'");
+  }
+
+  // Frame ancestors
+  if (frameAncestors) {
+    directives.push(`frame-ancestors ${frameAncestors.join(' ')}`);
+  }
+
+  // Upgrade insecure requests
+  if (upgradeInsecureRequests) {
+    directives.push('upgrade-insecure-requests');
+  }
+
+  // Report URI
+  if (reportUri) {
+    directives.push(`report-uri ${reportUri}`);
+  }
+
+  return directives.join('; ');
+}
+
+/**
+ * Generate HSTS header value
+ */
+export function generateHsts(options) {
+  const { maxAge = 31536000, includeSubDomains, preload } = options;
+
+  let value = `max-age=${maxAge}`;
+
+  if (includeSubDomains) {
+    value += '; includeSubDomains';
+  }
+
+  if (preload) {
+    value += '; preload';
+  }
+
+  return value;
+}
+
+/**
+ * Generate Permissions-Policy header value
+ */
+export function generatePermissionsPolicy(options) {
+  const { strict, camera, microphone, geolocation, payment } = options;
+
+  const policies = [];
+
+  // Helper to format policy value
+  const formatValue = (value) => {
+    if (!value || value.length === 0) {
+      return '()';
+    }
+    const formatted = value
+      .map((v) => {
+        if (v === 'self') return 'self';
+        return `"${v}"`;
+      })
+      .join(' ');
+    return `(${formatted})`;
+  };
+
+  if (strict) {
+    policies.push('camera=()');
+    policies.push('microphone=()');
+    policies.push('geolocation=()');
+    policies.push('payment=()');
+    policies.push('usb=()');
+    policies.push('magnetometer=()');
+    policies.push('gyroscope=()');
+    policies.push('accelerometer=()');
+  } else {
+    if (camera !== undefined) {
+      policies.push(`camera=${formatValue(camera)}`);
+    }
+    if (microphone !== undefined) {
+      policies.push(`microphone=${formatValue(microphone)}`);
+    }
+    if (geolocation !== undefined) {
+      policies.push(`geolocation=${formatValue(geolocation)}`);
+    }
+    if (payment !== undefined) {
+      policies.push(`payment=${formatValue(payment)}`);
+    }
+  }
+
+  return policies.join(', ');
+}
+
+/**
+ * Generate Cross-Origin headers (COOP, COEP, CORP)
+ */
+export function generateCrossOriginHeaders(options) {
+  const { coopPolicy, coepPolicy, corpPolicy } = options;
+
+  const headers = {};
+
+  if (coopPolicy) {
+    headers['Cross-Origin-Opener-Policy'] = coopPolicy;
+  }
+
+  if (coepPolicy) {
+    headers['Cross-Origin-Embedder-Policy'] = coepPolicy;
+  }
+
+  if (corpPolicy) {
+    headers['Cross-Origin-Resource-Policy'] = corpPolicy;
+  }
+
+  return headers;
+}
+
+/**
+ * Generate all security headers
+ */
+export function generateSecurityHeaders(options) {
+  const { preset, referrerPolicy } = options;
+
+  const presetConfig = preset ? HEADER_PRESETS[preset.toUpperCase()] : null;
+
+  const headers = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': presetConfig?.xFrameOptions || 'DENY',
+    'Referrer-Policy': referrerPolicy || presetConfig?.referrerPolicy || 'strict-origin-when-cross-origin',
+  };
+
+  if (preset === 'strict' || presetConfig) {
+    headers['Content-Security-Policy'] = generateCsp(presetConfig?.csp || { strict: true });
+    headers['Strict-Transport-Security'] = generateHsts(presetConfig?.hsts || {});
+    headers['Permissions-Policy'] = generatePermissionsPolicy(
+      presetConfig?.permissionsPolicy || { strict: true }
+    );
+  }
+
+  return headers;
+}
+
+/**
+ * Validate security headers
+ */
+export function validateHeaders(headers, options = {}) {
+  const { required = [], strict = false } = options;
+
+  const result = {
+    valid: true,
+    missing: [],
+    warnings: [],
+  };
+
+  // Check required headers
+  for (const header of required) {
+    if (!headers[header]) {
+      result.missing.push(header);
+      result.valid = false;
+    }
+  }
+
+  // Check for unsafe CSP directives in strict mode
+  if (strict === true && headers['Content-Security-Policy']) {
+    const cspValue = headers['Content-Security-Policy'];
+    // Check for unsafe-inline
+    if (cspValue.includes('unsafe-inline')) {
+      result.warnings.push('unsafe-inline detected in CSP - this weakens security');
+    }
+    // Check for unsafe-eval
+    if (cspValue.includes('unsafe-eval')) {
+      result.warnings.push('unsafe-eval detected in CSP - this weakens security');
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Create a security headers manager with default options
+ */
+export function createSecurityHeadersManager(config = {}) {
+  const { preset } = config;
+
+  return {
+    generate(options) {
+      return generateSecurityHeaders({ preset, ...options });
+    },
+    validate(headers, options) {
+      return validateHeaders(headers, options);
+    },
+    getCsp(options) {
+      return generateCsp(options);
+    },
+    getHsts(options) {
+      return generateHsts(options);
+    },
+  };
+}

package/server/lib/network/security-headers.test.js

@@ -0,0 +1,283 @@
+/**
+ * Security Headers Manager Tests
+ */
+import { describe, it, expect } from 'vitest';
+import {
+  generateSecurityHeaders,
+  generateCsp,
+  generateHsts,
+  generatePermissionsPolicy,
+  generateCrossOriginHeaders,
+  validateHeaders,
+  HEADER_PRESETS,
+  createSecurityHeadersManager,
+} from './security-headers.js';
+
+describe('security-headers', () => {
+  describe('HEADER_PRESETS', () => {
+    it('defines strict preset', () => {
+      expect(HEADER_PRESETS.STRICT).toBeDefined();
+      expect(HEADER_PRESETS.STRICT.csp).toBeDefined();
+    });
+
+    it('defines relaxed preset', () => {
+      expect(HEADER_PRESETS.RELAXED).toBeDefined();
+    });
+  });
+
+  describe('generateCsp', () => {
+    it('generates strict CSP without unsafe-inline', () => {
+      const csp = generateCsp({ strict: true });
+
+      expect(csp).not.toContain("'unsafe-inline'");
+      expect(csp).not.toContain("'unsafe-eval'");
+    });
+
+    it('includes default-src directive', () => {
+      const csp = generateCsp({});
+
+      expect(csp).toContain("default-src 'self'");
+    });
+
+    it('configures script-src', () => {
+      const csp = generateCsp({
+        scriptSrc: ["'self'", 'https://cdn.example.com'],
+      });
+
+      expect(csp).toContain('script-src');
+      expect(csp).toContain('https://cdn.example.com');
+    });
+
+    it('configures style-src', () => {
+      const csp = generateCsp({
+        styleSrc: ["'self'"],
+      });
+
+      expect(csp).toContain('style-src');
+    });
+
+    it('adds report-uri when specified', () => {
+      const csp = generateCsp({
+        reportUri: 'https://example.com/csp-report',
+      });
+
+      expect(csp).toContain('report-uri https://example.com/csp-report');
+    });
+
+    it('supports frame-ancestors', () => {
+      const csp = generateCsp({
+        frameAncestors: ["'none'"],
+      });
+
+      expect(csp).toContain("frame-ancestors 'none'");
+    });
+
+    it('supports upgrade-insecure-requests', () => {
+      const csp = generateCsp({
+        upgradeInsecureRequests: true,
+      });
+
+      expect(csp).toContain('upgrade-insecure-requests');
+    });
+  });
+
+  describe('generateHsts', () => {
+    it('sets max-age', () => {
+      const hsts = generateHsts({ maxAge: 31536000 });
+
+      expect(hsts).toContain('max-age=31536000');
+    });
+
+    it('includes includeSubDomains', () => {
+      const hsts = generateHsts({
+        maxAge: 31536000,
+        includeSubDomains: true,
+      });
+
+      expect(hsts).toContain('includeSubDomains');
+    });
+
+    it('includes preload directive', () => {
+      const hsts = generateHsts({
+        maxAge: 31536000,
+        includeSubDomains: true,
+        preload: true,
+      });
+
+      expect(hsts).toContain('preload');
+    });
+
+    it('defaults to one year max-age', () => {
+      const hsts = generateHsts({});
+
+      expect(hsts).toContain('max-age=31536000');
+    });
+  });
+
+  describe('generatePermissionsPolicy', () => {
+    it('disables camera by default', () => {
+      const policy = generatePermissionsPolicy({ strict: true });
+
+      expect(policy).toContain('camera=()');
+    });
+
+    it('disables microphone by default', () => {
+      const policy = generatePermissionsPolicy({ strict: true });
+
+      expect(policy).toContain('microphone=()');
+    });
+
+    it('disables geolocation by default', () => {
+      const policy = generatePermissionsPolicy({ strict: true });
+
+      expect(policy).toContain('geolocation=()');
+    });
+
+    it('allows specific features when configured', () => {
+      const policy = generatePermissionsPolicy({
+        camera: ['self'],
+        geolocation: ['self', 'https://maps.example.com'],
+      });
+
+      expect(policy).toContain('camera=(self)');
+      expect(policy).toContain('geolocation=(self "https://maps.example.com")');
+    });
+
+    it('handles payment feature', () => {
+      const policy = generatePermissionsPolicy({
+        payment: ['self'],
+      });
+
+      expect(policy).toContain('payment=(self)');
+    });
+  });
+
+  describe('generateCrossOriginHeaders', () => {
+    it('generates COOP header', () => {
+      const headers = generateCrossOriginHeaders({
+        coopPolicy: 'same-origin',
+      });
+
+      expect(headers['Cross-Origin-Opener-Policy']).toBe('same-origin');
+    });
+
+    it('generates COEP header', () => {
+      const headers = generateCrossOriginHeaders({
+        coepPolicy: 'require-corp',
+      });
+
+      expect(headers['Cross-Origin-Embedder-Policy']).toBe('require-corp');
+    });
+
+    it('generates CORP header', () => {
+      const headers = generateCrossOriginHeaders({
+        corpPolicy: 'same-origin',
+      });
+
+      expect(headers['Cross-Origin-Resource-Policy']).toBe('same-origin');
+    });
+
+    it('supports cross-origin-isolated', () => {
+      const headers = generateCrossOriginHeaders({
+        coopPolicy: 'same-origin',
+        coepPolicy: 'require-corp',
+      });
+
+      expect(headers['Cross-Origin-Opener-Policy']).toBe('same-origin');
+      expect(headers['Cross-Origin-Embedder-Policy']).toBe('require-corp');
+    });
+  });
+
+  describe('generateSecurityHeaders', () => {
+    it('includes X-Content-Type-Options', () => {
+      const headers = generateSecurityHeaders({});
+
+      expect(headers['X-Content-Type-Options']).toBe('nosniff');
+    });
+
+    it('includes X-Frame-Options', () => {
+      const headers = generateSecurityHeaders({});
+
+      expect(headers['X-Frame-Options']).toBe('DENY');
+    });
+
+    it('includes Referrer-Policy', () => {
+      const headers = generateSecurityHeaders({});
+
+      expect(headers['Referrer-Policy']).toBe('strict-origin-when-cross-origin');
+    });
+
+    it('includes all headers for strict preset', () => {
+      const headers = generateSecurityHeaders({ preset: 'strict' });
+
+      expect(headers['Content-Security-Policy']).toBeDefined();
+      expect(headers['Strict-Transport-Security']).toBeDefined();
+      expect(headers['X-Content-Type-Options']).toBeDefined();
+      expect(headers['X-Frame-Options']).toBeDefined();
+      expect(headers['Referrer-Policy']).toBeDefined();
+      expect(headers['Permissions-Policy']).toBeDefined();
+    });
+
+    it('allows custom Referrer-Policy', () => {
+      const headers = generateSecurityHeaders({
+        referrerPolicy: 'no-referrer',
+      });
+
+      expect(headers['Referrer-Policy']).toBe('no-referrer');
+    });
+  });
+
+  describe('validateHeaders', () => {
+    it('validates correct headers', () => {
+      const headers = {
+        'Content-Security-Policy': "default-src 'self'",
+        'Strict-Transport-Security': 'max-age=31536000',
+        'X-Content-Type-Options': 'nosniff',
+      };
+
+      const result = validateHeaders(headers);
+      expect(result.valid).toBe(true);
+    });
+
+    it('detects missing required headers', () => {
+      const headers = {
+        'X-Content-Type-Options': 'nosniff',
+      };
+
+      const result = validateHeaders(headers, { required: ['Content-Security-Policy'] });
+      expect(result.valid).toBe(false);
+      expect(result.missing).toContain('Content-Security-Policy');
+    });
+
+    it('detects unsafe CSP directives', () => {
+      const headers = {
+        'Content-Security-Policy': "script-src 'unsafe-inline'",
+      };
+
+      const result = validateHeaders(headers, { strict: true });
+      expect(result.warnings).toEqual(
+        expect.arrayContaining([expect.stringContaining('unsafe-inline')])
+      );
+    });
+  });
+
+  describe('createSecurityHeadersManager', () => {
+    it('creates manager with methods', () => {
+      const manager = createSecurityHeadersManager();
+
+      expect(manager.generate).toBeDefined();
+      expect(manager.validate).toBeDefined();
+      expect(manager.getCsp).toBeDefined();
+      expect(manager.getHsts).toBeDefined();
+    });
+
+    it('applies default preset', () => {
+      const manager = createSecurityHeadersManager({
+        preset: 'strict',
+      });
+
+      const headers = manager.generate({});
+      expect(headers['X-Frame-Options']).toBe('DENY');
+    });
+  });
+});