vite-plugin-sri4 3.0.0 → 4.0.0

package/dist/index.cjs

@@ -2,33 +2,13 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var crypto = require('crypto');
-var path = require('path');
+var node_crypto = require('node:crypto');
+var path = require('node:path');
 var fetch = require('cross-fetch');
 
-// Constants definition
-const VITE_INTERNAL_ANALYSIS_PLUGIN = 'vite:build-import-analysis';
-const DEFAULT_TIMEOUT = 5000;
-const DEFAULT_HASH_ALGORITHM = 'sha384';
-const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
-
-// Optimized regex patterns for better readability and efficiency
-const HTML_PATTERNS = {
-  script: {
-    regex: /<script\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*><\/script>/g,
-    endOffset: 10
-  },
-  stylesheet: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']stylesheet["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
-  },
-  modulepreload: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']modulepreload["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
-  }
-};
-
-// Extended caching mechanism with expiration time
+/**
+ * Extended caching mechanism with expiration time
+ */
 class ResourceCache {
   constructor(ttl = 3600000) { // Default cache for 1 hour
     this.cache = new Map();
@@ -64,11 +44,35 @@ class ResourceCache {
   }
 }
 
-const urlSupportCache = new ResourceCache();
-const resourceCache = new ResourceCache();
+/**
+ * Cache manager for plugin instances
+ */
+class CacheManager {
+  constructor() {
+    this.urlSupportCache = new ResourceCache();
+    this.resourceCache = new ResourceCache();
+  }
+
+  getUrlSupportCache() {
+    return this.urlSupportCache
+  }
+
+  getResourceCache() {
+    return this.resourceCache
+  }
+
+  clearAll() {
+    this.urlSupportCache.clear();
+    this.resourceCache.clear();
+  }
+}
+
+const DEFAULT_TIMEOUT = 5000;
 
-// Check if URL is from a bypass domain
-function isUrlFromBypassDomain(url, bypassDomains = []) {
+/**
+ * Check if URL is from a bypass domain
+ */
+function isUrlFromBypassDomain(url, bypassDomains = [], logger = null) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
 
   try {
@@ -77,13 +81,17 @@ function isUrlFromBypassDomain(url, bypassDomains = []) {
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
-    console.warn(`[${DEFAULT_PLUGIN_NAME}] Invalid URL: ${url}`, error);
+    if (logger) {
+      logger.warn(`Invalid URL: ${url}`, error);
+    }
     return false
   }
 }
 
-// Resource check with retry mechanism
-async function checkResourceSupport(url, retries = 2) {
+/**
+ * Resource check with retry mechanism
+ */
+async function checkResourceSupport(url, urlSupportCache, logger = null, retries = 2) {
   if (urlSupportCache.has(url)) {
     return urlSupportCache.get(url)
   }
@@ -108,7 +116,9 @@ async function checkResourceSupport(url, retries = 2) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        console.warn(`[${DEFAULT_PLUGIN_NAME}] Resource check timed out: ${url}`);
+        if (logger) {
+          logger.warn(`Resource check timed out: ${url}`);
+        }
         break // Don't retry timeouts
       }
 
@@ -119,13 +129,17 @@ async function checkResourceSupport(url, retries = 2) {
     }
   }
 
-  console.warn(`[${DEFAULT_PLUGIN_NAME}] Failed to check resource support: ${url}`, lastError);
+  if (logger) {
+    logger.warn(`Failed to check resource support: ${url}`, lastError);
+  }
   urlSupportCache.set(url, false);
   return false
 }
 
-// Optimized resource fetching function with retry mechanism and caching
-async function fetchResource(url, retries = 1) {
+/**
+ * Optimized resource fetching function with retry mechanism and caching
+ */
+async function fetchResource(url, resourceCache, logger = null, retries = 1) {
   // Check cache
   if (resourceCache.has(url)) {
     return resourceCache.get(url)
@@ -150,7 +164,9 @@ async function fetchResource(url, retries = 1) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        console.warn(`[${DEFAULT_PLUGIN_NAME}] Resource fetch timed out: ${url}`);
+        if (logger) {
+          logger.warn(`Resource fetch timed out: ${url}`);
+        }
         break // Don't retry timeouts
       }
 
@@ -160,144 +176,397 @@ async function fetchResource(url, retries = 1) {
     }
   }
 
-  console.warn(`[${DEFAULT_PLUGIN_NAME}] Failed to fetch external resource: ${url}`, lastError);
+  if (logger) {
+    logger.warn(`Failed to fetch external resource: ${url}`, lastError);
+  }
   return null
 }
 
-function createTransformer(options, config) {
-  const {
-    ignoreMissingAsset,
-    bypassDomains,
-    hashAlgorithm = DEFAULT_HASH_ALGORITHM
-  } = options;
-
-  // Improved method for getting bundle keys
-  const getBundleKey = (htmlPath, url) => {
-    // Handle absolute path URLs
-    if (url.startsWith('/')) {
-      // Remove leading slash to match keys in bundle
-      return url.substring(1)
-    }
-
-    // Handle relative paths (when config.base is relative)
-    if (config.base === './' || config.base === '') {
-      return path.posix.resolve(path.posix.dirname(htmlPath), url)
-    }
+/**
+ * Improved method for getting bundle keys
+ */
+function getBundleKey(htmlPath, url, config) {
+  // Handle absolute path URLs
+  if (url.startsWith('/')) {
+    // Remove leading slash to match keys in bundle
+    return url.substring(1)
+  }
 
-    // Handle other cases, remove base prefix from URL
-    return url.startsWith(config.base)
-      ? url.substring(config.base.length)
-      : url
-  };
+  // Handle relative paths (when config.base is relative)
+  if (config.base === './' || config.base === '') {
+    return path.posix.resolve(path.posix.dirname(htmlPath), url)
+  }
 
-  const calculateIntegrity = async (bundle, htmlPath, url) => {
-    // Skip specified domains
-    if (isUrlFromBypassDomain(url, bypassDomains)) {
-      return null
-    }
+  // Handle other cases, remove base prefix from URL
+  return url.startsWith(config.base)
+    ? url.substring(config.base.length)
+    : url
+}
 
-    let source;
-    if (url.startsWith('http')) {
-      const isSupported = await checkResourceSupport(url);
-      if (!isSupported) return null
-      source = await fetchResource(url);
-      if (!source) return null
-    } else {
-      const bundleKey = getBundleKey(htmlPath, url);
-      const bundleItem = bundle[bundleKey];
+/**
+ * Calculate SRI integrity hash for a given resource
+ */
+async function calculateIntegrity(
+  bundle, 
+  htmlPath, 
+  url, 
+  options, 
+  config, 
+  cacheManager,
+  logger = null
+) {
+  const { 
+    ignoreMissingAsset, 
+    bypassDomains, 
+    hashAlgorithm 
+  } = options;
 
-      if (!bundleItem) {
-        // Try to find a matching item with more flexible matching
-        const possibleMatch = Object.keys(bundle).find(key =>
-          key.endsWith(bundleKey) || bundleKey.endsWith(key)
-        );
+  // Skip specified domains
+  if (isUrlFromBypassDomain(url, bypassDomains, logger)) {
+    return null
+  }
 
-        if (possibleMatch) {
-          source = bundle[possibleMatch].type === 'chunk'
-            ? bundle[possibleMatch].code
-            : bundle[possibleMatch].source;
-        } else if (ignoreMissingAsset) {
-          console.warn(`[${DEFAULT_PLUGIN_NAME}] Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
-          return null
-        } else {
-          throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
+  let source;
+  if (url.startsWith('http')) {
+    const isSupported = await checkResourceSupport(url, cacheManager.getUrlSupportCache(), logger);
+    if (!isSupported) return null
+    source = await fetchResource(url, cacheManager.getResourceCache(), logger);
+    if (!source) return null
+  } else {
+    const bundleKey = getBundleKey(htmlPath, url, config);
+    const bundleItem = bundle[bundleKey];
+
+    if (!bundleItem) {
+      // Fall back to suffix match in either direction to absorb hashed
+      // filenames AND base-prefix mismatches (e.g. URL "/base/main.js" with
+      // bare bundle key "main.js"). A mismatch here just produces a wrong
+      // integrity hash, which the browser rejects — failure-closed.
+      const possibleMatch = Object.keys(bundle).find(key =>
+        key.endsWith(bundleKey) || bundleKey.endsWith(key)
+      );
+
+      if (possibleMatch) {
+        if (logger) {
+          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
+        }
+        source = bundle[possibleMatch].type === 'chunk'
+          ? bundle[possibleMatch].code
+          : bundle[possibleMatch].source;
+      } else if (ignoreMissingAsset) {
+        if (logger) {
+          logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
         }
+        return null
       } else {
-        source = bundleItem.type === 'chunk' ? bundleItem.code : bundleItem.source;
+        throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
       }
+    } else {
+      source = bundleItem.type === 'chunk' ? bundleItem.code : bundleItem.source;
     }
+  }
 
-    // Ensure source is a Uint8Array or string
-    if (!source) return null
+  // Ensure source is a Uint8Array or string
+  if (!source) return null
+
+  if (typeof source === 'string') {
+    return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
+  }
+
+  return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
+}
+
+// Optimized regex patterns for better readability and efficiency
+const HTML_PATTERNS = {
+  script: {
+    regex: /<script\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*><\/script>/g,
+    endOffset: 10
+  },
+  stylesheet: {
+    regex: /<link\b[^>]*?\brel\s*=\s*["']stylesheet["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
+    endOffset: 1
+  },
+  modulepreload: {
+    regex: /<link\b[^>]*?\brel\s*=\s*["']modulepreload["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
+    endOffset: 1
+  }
+};
+
+/**
+ * Validate HTML input
+ */
+function validateHtmlInput(html, htmlPath, logger) {
+  if (!html || typeof html !== 'string') {
+    logger.warn(`Invalid HTML content for ${htmlPath}`);
+    return false
+  }
+  return true
+}
 
-    if (typeof source === 'string') {
-      return `${hashAlgorithm}-${crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
+/**
+ * Process a single match to create an integrity change object
+ */
+async function processMatch(
+  match, 
+  endOffset, 
+  bundle, 
+  htmlPath, 
+  options, 
+  config, 
+  cacheManager,
+  logger
+) {
+  const [, url] = match;
+  if (!url) return null
+
+  const end = match.index + match[0].length;
+  const integrity = await calculateIntegrity(
+    bundle, 
+    htmlPath, 
+    url, 
+    options, 
+    config, 
+    cacheManager,
+    logger
+  );
+
+  if (integrity) {
+    return {
+      integrity,
+      position: end - endOffset,
+      tagStart: match.index,
+      url // For logging
     }
+  }
+  return null
+}
+
+/**
+ * Process matches for a specific HTML pattern
+ */
+async function processPatternMatches(
+  html, 
+  pattern, 
+  bundle, 
+  htmlPath, 
+  options, 
+  config, 
+  cacheManager,
+  logger
+) {
+  const { regex, endOffset } = pattern;
+  const matches = [...html.matchAll(regex)];
+
+  // Process each match in parallel
+  const matchResults = await Promise.all(
+    matches.map(match => 
+      processMatch(match, endOffset, bundle, htmlPath, options, config, cacheManager, logger)
+    )
+  );
+
+  // Filter out null results
+  return matchResults.filter(Boolean)
+}
+
+/**
+ * Collect all integrity changes from HTML patterns
+ */
+async function collectIntegrityChanges(
+  html, 
+  bundle, 
+  htmlPath, 
+  options, 
+  config, 
+  cacheManager,
+  logger
+) {
+  const changes = [];
+
+  // Collect changes from all patterns in parallel
+  await Promise.all(
+    Object.values(HTML_PATTERNS).map(async pattern => {
+      const patternChanges = await processPatternMatches(
+        html, 
+        pattern, 
+        bundle, 
+        htmlPath, 
+        options, 
+        config, 
+        cacheManager,
+        logger
+      );
+      changes.push(...patternChanges);
+    })
+  );
+
+  return changes
+}
+
+const CROSSORIGIN_ATTR_RE = /\bcrossorigin\s*=/i;
+const INTEGRITY_ATTR_RE = /\bintegrity\s*=/i;
+
+/**
+ * Check if integrity attribute already exists in the same tag
+ */
+function hasExistingIntegrity(html, tagStart, position) {
+  return INTEGRITY_ATTR_RE.test(html.slice(tagStart, position))
+}
 
-    return `${hashAlgorithm}-${crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
-  };
+/**
+ * Check if crossorigin attribute already exists in the same tag
+ */
+function hasExistingCrossorigin(html, tagStart, position) {
+  return CROSSORIGIN_ATTR_RE.test(html.slice(tagStart, position))
+}
 
-  const transformHTML = async (bundle, htmlPath, html) => {
-    if (!html || typeof html !== 'string') {
-      console.warn(`[${DEFAULT_PLUGIN_NAME}] Invalid HTML content for ${htmlPath}`);
-      return html
+/**
+ * Apply integrity changes to HTML content
+ */
+function applyIntegrityChanges(html, changes, logger) {
+  // Sort by position in descending order to insert from back to front
+  changes.sort((a, b) => b.position - a.position);
+
+  for (const { integrity, position, tagStart, url } of changes) {
+    // Skip if integrity attribute already exists on this tag
+    if (hasExistingIntegrity(html, tagStart, position)) {
+      continue
     }
 
-    const changes = [];
+    let insertText = ` integrity="${integrity}"`;
+    if (!hasExistingCrossorigin(html, tagStart, position)) {
+      insertText += ' crossorigin="anonymous"';
+    }
+    html = html.slice(0, position) + insertText + html.slice(position);
+    logger.debug(`Added integrity for: ${url}`);
+  }
 
-    // Collect changes from all patterns in parallel
-    await Promise.all(
-      Object.values(HTML_PATTERNS).map(async ({ regex, endOffset }) => {
-        const matches = [...html.matchAll(regex)];
+  return html
+}
 
-        // Process each match in parallel
-        const matchResults = await Promise.all(
-          matches.map(async match => {
-            const [, url] = match;
-            if (!url) return null
+/**
+ * Transform HTML by adding SRI integrity attributes
+ */
+async function transformHTML(
+  bundle, 
+  htmlPath, 
+  html, 
+  options, 
+  config, 
+  cacheManager,
+  logger
+) {
+  if (!validateHtmlInput(html, htmlPath, logger)) {
+    return html
+  }
 
-            const end = match.index + match[0].length;
-            const integrity = await calculateIntegrity(bundle, htmlPath, url);
+  const changes = await collectIntegrityChanges(
+    html, 
+    bundle, 
+    htmlPath, 
+    options, 
+    config, 
+    cacheManager,
+    logger
+  );
+
+  return applyIntegrityChanges(html, changes, logger)
+}
 
-            if (integrity) {
-              return {
-                integrity,
-                position: end - endOffset,
-                url // For logging
-              }
-            }
-            return null
-          })
-        );
+/**
+ * Create HTML transformer with given options and config
+ */
+function createTransformer(options, config, cacheManager, logger) {
+  return {
+    transformHTML: (bundle, htmlPath, html) => 
+      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
+    calculateIntegrity: (bundle, htmlPath, url) => 
+      calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
+  }
+}
 
-        // Filter out null results
-        matchResults.filter(Boolean).forEach(result => changes.push(result));
-      })
-    );
+const DEFAULT_PLUGIN_NAME$1 = 'vite-plugin-sri4';
+
+/**
+ * Logger class to handle different log levels without hijacking global console
+ */
+class Logger {
+  constructor(logLevel = 'warn', pluginName = DEFAULT_PLUGIN_NAME$1) {
+    this.logLevel = logLevel;
+    this.pluginName = pluginName;
+    this.levels = {
+      silent: 0,
+      error: 1,
+      warn: 2,
+      info: 3,
+      debug: 4
+    };
+    this.currentLevel = this.levels[logLevel] || this.levels.warn;
+  }
 
-    // Sort by position in descending order to insert from back to front (won't affect insertion points ahead)
-    changes.sort((a, b) => b.position - a.position);
+  /**
+   * Format message with plugin name prefix
+   */
+  formatMessage(message, ...args) {
+    const prefix = `[${this.pluginName}]`;
+    if (typeof message === 'string') {
+      return [prefix + ' ' + message, ...args]
+    }
+    return [prefix, message, ...args]
+  }
 
-    // Check if identical integrity attributes already exist to avoid duplicates
-    for (const { integrity, position, url } of changes) {
-      const insertText = ` integrity="${integrity}"`;
+  /**
+   * Log error messages
+   */
+  error(message, ...args) {
+    if (this.currentLevel >= this.levels.error) {
+      console.error(...this.formatMessage(message, ...args));
+    }
+  }
 
-      // Check if integrity attribute already exists
-      const segment = html.slice(Math.max(0, position - 100), position + 100);
-      if (segment.includes(`integrity="${integrity}"`)) {
-        continue // Skip elements that already have the same integrity
-      }
+  /**
+   * Log warning messages
+   */
+  warn(message, ...args) {
+    if (this.currentLevel >= this.levels.warn) {
+      console.warn(...this.formatMessage(message, ...args));
+    }
+  }
 
-      html = html.slice(0, position) + insertText + html.slice(position);
-      console.debug(`[${DEFAULT_PLUGIN_NAME}] Added integrity for: ${url}`);
+  /**
+   * Log info messages
+   */
+  info(message, ...args) {
+    if (this.currentLevel >= this.levels.info) {
+      console.info(...this.formatMessage(message, ...args));
     }
+  }
 
-    return html
-  };
+  /**
+   * Log debug messages
+   */
+  debug(message, ...args) {
+    if (this.currentLevel >= this.levels.debug) {
+      console.debug(...this.formatMessage(message, ...args));
+    }
+  }
 
-  return { transformHTML, calculateIntegrity }
+  /**
+   * Create a child logger with the same configuration
+   */
+  child(name) {
+    return new Logger(this.logLevel, `${this.pluginName}:${name}`)
+  }
 }
 
+// Constants definition
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
+// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+const VITE_INTERNAL_ANALYSIS_PLUGINS = [
+  'vite:build-import-analysis',
+  'native:import-analysis-build'
+];
+const DEFAULT_HASH_ALGORITHM = 'sha384';
+const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
+
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
@@ -306,16 +575,9 @@ function sri(options = {}) {
     logLevel = 'warn'
   } = options;
 
-  // Adjust log level
-  const originalConsoleWarn = console.warn;
-  const originalConsoleDebug = console.debug;
-
-  if (logLevel === 'error') {
-    console.warn = () => {};
-    console.debug = () => {};
-  } else if (logLevel === 'warn') {
-    console.debug = () => {};
-  }
+  // Create cache manager and logger instances for this plugin instance
+  const cacheManager = new CacheManager();
+  const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
 
   return {
     name: DEFAULT_PLUGIN_NAME,
@@ -324,13 +586,8 @@ function sri(options = {}) {
 
     // Cleanup work
     buildEnd() {
-      // Restore console functions
-      console.warn = originalConsoleWarn;
-      console.debug = originalConsoleDebug;
-
       // Clear caches
-      urlSupportCache.clear();
-      resourceCache.clear();
+      cacheManager.clearAll();
     },
 
     configResolved(config) {
@@ -338,7 +595,7 @@ function sri(options = {}) {
         ignoreMissingAsset,
         bypassDomains,
         hashAlgorithm
-      }, config);
+      }, config, cacheManager, logger);
 
       const generateBundle = async function(_, bundle) {
         const htmlFiles = Object.entries(bundle).filter(
@@ -348,7 +605,7 @@ function sri(options = {}) {
         );
 
         if (htmlFiles.length === 0) {
-          console.debug(`[${DEFAULT_PLUGIN_NAME}] No HTML files found in bundle`);
+          logger.debug('No HTML files found in bundle');
           return
         }
 
@@ -360,33 +617,41 @@ function sri(options = {}) {
               chunk.source = await transformer.transformHTML(bundle, name, originalContent);
 
               if (originalContent !== chunk.source) {
-                console.debug(`[${DEFAULT_PLUGIN_NAME}] SRI attributes added to ${name}`);
+                logger.debug(`SRI attributes added to ${name}`);
               }
             } catch (error) {
-              console.warn(`[${DEFAULT_PLUGIN_NAME}] Error processing ${name}:`, error);
+              logger.warn(`Error processing ${name}:`, error);
               // Keep original content on error
             }
           })
         );
       };
 
-      const plugin = config.plugins.find(p => p.name === VITE_INTERNAL_ANALYSIS_PLUGIN);
-      if (!plugin) {
-        throw new Error(`[${DEFAULT_PLUGIN_NAME}] requires Vite 2.0.0 or higher`)
+      const targets = config.plugins.filter(
+        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
+      );
+      if (targets.length === 0) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
+          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
+          `Requires Vite 6.0.0 or higher.`
+        )
       }
 
-      if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-        const originalHandler = plugin.generateBundle.handler;
-        plugin.generateBundle.handler = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
-      } else if (typeof plugin.generateBundle === 'function') {
-        const originalHandler = plugin.generateBundle;
-        plugin.generateBundle = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
+      for (const plugin of targets) {
+        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
+          const originalHandler = plugin.generateBundle.handler;
+          plugin.generateBundle.handler = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        } else if (typeof plugin.generateBundle === 'function') {
+          const originalHandler = plugin.generateBundle;
+          plugin.generateBundle = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        }
       }
     }
   }