webspresso 0.0.40 → 0.0.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "bin": {

package/plugins/admin-panel/index.js

@@ -58,6 +58,12 @@ function adminPanelPlugin(options = {}) {
     name: 'admin-panel',
     version: '2.0.0',
     description: 'Modular admin panel for Webspresso with extensions support',
+    
+    // CSP requirements for Quill.js rich text editor
+    csp: {
+      styleSrc: ['https://cdn.quilljs.com'],
+      scriptSrc: ['https://cdn.quilljs.com'],
+    },
     enabled,
     registry, // Expose registry for external configuration
 

package/src/plugin-manager.js

@@ -122,6 +122,7 @@ class PluginManager {
     this.registeredFilters = new Map(); // name -> filter function
     this.routes = [];                   // Collected route metadata
     this.customRoutes = [];             // Routes added by plugins
+    this.cspDirectives = new Map();     // directive -> Set of sources (from plugins)
     this.app = null;
     this.nunjucksEnv = null;
   }
@@ -263,6 +264,11 @@ class PluginManager {
       this.pluginAPIs.set(plugin.name, boundAPI);
     }
 
+    // Collect CSP requirements from plugin
+    if (plugin.csp) {
+      this._collectCspDirectives(plugin.csp);
+    }
+
     // Call register hook
     if (typeof plugin.register === 'function') {
       await plugin.register(ctx);
@@ -295,6 +301,11 @@ class PluginManager {
       this.pluginAPIs.set(plugin.name, boundAPI);
     }
 
+    // Collect CSP requirements from plugin
+    if (plugin.csp) {
+      this._collectCspDirectives(plugin.csp);
+    }
+
     // Call register hook (sync - if plugin has async register, it won't wait)
     if (typeof plugin.register === 'function') {
       plugin.register(ctx);
@@ -436,6 +447,35 @@ class PluginManager {
     }
   }
 
+  /**
+   * Collect CSP directives from a plugin
+   * @param {Object} csp - CSP directives object { styleSrc: [...], scriptSrc: [...], ... }
+   */
+  _collectCspDirectives(csp) {
+    for (const [directive, sources] of Object.entries(csp)) {
+      if (!this.cspDirectives.has(directive)) {
+        this.cspDirectives.set(directive, new Set());
+      }
+      const directiveSet = this.cspDirectives.get(directive);
+      const sourceArray = Array.isArray(sources) ? sources : [sources];
+      for (const source of sourceArray) {
+        directiveSet.add(source);
+      }
+    }
+  }
+
+  /**
+   * Get merged CSP directives from all plugins
+   * @returns {Object} CSP directives object to merge with helmet config
+   */
+  getCspDirectives() {
+    const directives = {};
+    for (const [directive, sources] of this.cspDirectives) {
+      directives[directive] = Array.from(sources);
+    }
+    return directives;
+  }
+
   /**
    * Get all registered helpers (to be merged with fsy)
    */

package/src/server.js

@@ -203,10 +203,45 @@ function createApp(options = {}) {
   // Security headers with Helmet
   if (helmetConfig !== false) {
     const defaultConfig = getDefaultHelmetConfig(isDev);
-    const finalConfig = helmetConfig === undefined || helmetConfig === true
+    let finalConfig = helmetConfig === undefined || helmetConfig === true
       ? defaultConfig
       : { ...defaultConfig, ...helmetConfig };
     
+    // Collect CSP requirements from plugins (before they're fully registered)
+    if (plugins && Array.isArray(plugins) && finalConfig.contentSecurityPolicy) {
+      const pluginCspSources = {
+        styleSrc: new Set(),
+        scriptSrc: new Set(),
+        imgSrc: new Set(),
+        fontSrc: new Set(),
+        connectSrc: new Set(),
+        frameSrc: new Set(),
+      };
+      
+      for (const plugin of plugins) {
+        if (plugin && plugin.csp) {
+          for (const [directive, sources] of Object.entries(plugin.csp)) {
+            if (pluginCspSources[directive]) {
+              const sourceArray = Array.isArray(sources) ? sources : [sources];
+              for (const source of sourceArray) {
+                pluginCspSources[directive].add(source);
+              }
+            }
+          }
+        }
+      }
+      
+      // Merge plugin CSP sources with default config
+      if (finalConfig.contentSecurityPolicy && finalConfig.contentSecurityPolicy.directives) {
+        const directives = finalConfig.contentSecurityPolicy.directives;
+        for (const [directive, sources] of Object.entries(pluginCspSources)) {
+          if (sources.size > 0 && directives[directive]) {
+            directives[directive] = [...directives[directive], ...Array.from(sources)];
+          }
+        }
+      }
+    }
+    
     app.use(helmet(finalConfig));
   }