Merge pull request #3 from AegisJSProject/feature/csp-config

Add customizable CSP module and update usage

Author: shgysk8zer0

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v1.0.1] - 22025-11-21
+
+### Added
+- Add methods and module to customize CSP
+
 ## [v1.0.0] - 2025-11-21
 
 Initial Release

csp.js

@@ -0,0 +1,52 @@
+import { readFile } from 'node:fs/promises';
+import { imports } from '@shgysk8zer0/importmap';
+
+const pkg = JSON.parse(await readFile(process.cwd() + '/package.json', { encoding: 'utf8' }));
+
+export const importmap = JSON.stringify({
+	imports: {
+		...imports,
+		[pkg.name]: pkg.exports['.'].import,
+		[`${pkg.name}/`]: './',
+	}
+});
+
+const sri = async (input) => await Promise.resolve(input)
+	.then(json => new TextEncoder().encode(json))
+	.then(bytes => crypto.subtle.digest('SHA-384', bytes))
+	.then(hash => 'sha384-' + new Uint8Array(hash).toBase64());
+
+export const integrity = await sri(importmap);
+
+const DEFAULT_SRC = ['\'self\''];
+const SCRIPT_SRC = ['\'self\'', 'https://unpkg.com/@shgysk8zer0/', 'https://unpkg.com/@kernvalley/', 'https://unpkg.com/@aegisjsproject/', `'${integrity}'`];
+const STYLE_SRC = ['\'self\'', 'https://unpkg.com/@agisjsproject/', 'blob:'];
+const IMAGE_SRC = ['\'self\'', 'https://i.imgur.com/', 'https://secure.gravatar.com/avatar/', 'blob:', 'data:'];
+const MEDIA_SRC = ['\'self\'', 'blob:'];
+const CONNECT_SRC = ['\'self\''];
+const FONT_SRC = ['\'self\''];
+const FRAME_SRC = ['\'self\'', 'https://www.youtube-nocookie.com'];
+const TRUSTED_TYPES = ['aegis-sanitizer#html'];
+
+export const addDefaultSrc = (...srcs) => DEFAULT_SRC.push(...srcs);
+export const addScriptSrc = (...srcs) => SCRIPT_SRC.push(...srcs);
+export const addStyleSrc = (...srcs) => STYLE_SRC.push(...srcs);
+export const addImageSrc = (...srcs) => IMAGE_SRC.push(...srcs);
+export const addMediaSrc = (...srcs) => MEDIA_SRC.push(...srcs);
+export const addConnectSrc = (...srcs) => CONNECT_SRC.push(...srcs);
+export const addFontSrc = (...srcs) => FONT_SRC.push(...srcs);
+export const addFrameSrc = (...srcs) => FRAME_SRC.push(...srcs);
+export const addTrustedType = (...policies) => TRUSTED_TYPES.push(...policies);
+
+export const getCSP = () => [
+	'default-src ' + DEFAULT_SRC.join(' '),
+	'script-src ' + SCRIPT_SRC.join(' '),
+	'style-src ' + STYLE_SRC.join(' '),
+	'image-src ' + IMAGE_SRC.join(' '),
+	'media-src ' + MEDIA_SRC.join(' '),
+	'font-src ' + FONT_SRC.join(' '),
+	'frame-src ' + FRAME_SRC.join(' '),
+	'connect-src ' + CONNECT_SRC.join(' '),
+	'tusted-types ' + TRUSTED_TYPES.join(' '),
+	'require-trusted-types-for \'script\'',
+].join('; ');

home.js

@@ -1,24 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { imports } from '@shgysk8zer0/importmap';
-
-const pkg = JSON.parse(await readFile(process.cwd() + '/package.json', { encoding: 'utf8' }));
-
-const importmap = JSON.stringify({
-	imports: {
-		...imports,
-		[pkg.name]: pkg.exports['.'].import,
-		[`${pkg.name}/`]: './',
-	}
-});
-
-const sri = async (input) => await Promise.resolve(input)
-	.then(json => new TextEncoder().encode(json))
-	.then(bytes => crypto.subtle.digest('SHA-384', bytes))
-	.then(hash => 'sha384-' + new Uint8Array(hash).toBase64());
-
-const integrity = await sri(importmap);
-
-const CSP = `default-src 'self'; style-src 'self' https://unpkg.com/@agisjsproject/ blob:; script-src 'self' https://unpkg.com/@shgysk8zer0/ https://unpkg.com/@kernvalley/ https://unpkg.com/@aegisjsproject/ '${integrity}'; image-src 'self' https://i.imgur.com/ https://secure.gravatar.com/avatar/ blob: data:; media-src 'self' blob:; frame-src https://www.youtube-nocookie.com; trusted-types aegis-sanitizer#html aegis-router#html; require-trusted-types-for 'script';`;
+import { getCSP, importmap, integrity } from './csp.js';
 
 export default async (req) => {
 	const doc = await readFile(process.cwd() + '/index.html', { encoding: 'utf8' });
@@ -42,7 +24,7 @@ export default async (req) => {
 		{
 			headers: {
 				'Content-Type': 'text/html',
-				'Content-Security-Policy': CSP,
+				'Content-Security-Policy': getCSP(),
 			}
 		}
 	);

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@aegisjsproject/dev-server",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Dev server setup for `@shgysk8zer0/http-server`",
   "keywords": [
     "dev-server",