workers/csp.mjs

Functions

Imports

It imports app/lib/enhance-loader.mjs, app/lib/podcast/feed.mjs, app/lib/speculation.mjs. Imported by workers/app.ts.

Source

1// Separate from app.ts so the gate can call it on both branches and assert the strings it returns.
2
3import { ENHANCE_LOADER } from "../app/lib/enhance-loader.mjs";
4import { PODCAST_AUDIO_HOSTS } from "../app/lib/podcast/feed.mjs";
5import { buildSpeculationRules } from "../app/lib/speculation.mjs";
6import { CLOUDFLARE_WEB_ANALYTICS, buildContentSecurityPolicy, buildPolicy, scriptHash } from "@dustinedwards/site-runtime/csp";
7
8export const CSP_REPORT_PATH = "/api/csp-report";
9
10export const CSP_ENDPOINT_NAME = "csp-endpoint";
11
12/**
13 * Exact-or-slash, not a bare prefix, so a future `/administrator` route cannot pick up the admin
14 * policy. Keyed on the path because this layer knows nothing of the session; an anonymous 302 or
15 * `.data` response that gets the admin nonce is bodiless or JSON, and `private, no-store`.
16 *
17 * @param {string} pathname
18 * @returns {boolean}
19 */
20function isAdminPath(pathname) {
21  return pathname === "/admin" || pathname.startsWith("/admin/");
22}
23
24/**
25 * The /lab workspace (docs/KNOWLEDGE-BASE.md step 5): lab members signed in through their own Access application.
26 * Exact-or-slash like the admin plane, so the public `/research/lab` and a future `/laboratory` stay public.
27 *
28 * @param {string} pathname
29 * @returns {boolean}
30 */
31function isLabPath(pathname) {
32  return pathname === "/lab" || pathname.startsWith("/lab/");
33}
34
35/**
36 * The signed-in planes, /admin and /lab: every response there is `private, no-store`, so each render gets its own
37 * nonce and is never edge-cached or themed into a shared key.
38 *
39 * @param {string} pathname
40 * @returns {boolean}
41 */
42export function isPrivatePath(pathname) {
43  return isAdminPath(pathname) || isLabPath(pathname);
44}
45
46/**
47 * The media route is exact-or-slash for the same reason as the admin plane: a future `/mediakit`
48 * page must keep the document policy.
49 *
50 * @param {string} pathname
51 * @returns {boolean}
52 */
53function isMediaPath(pathname) {
54  return pathname === "/media" || pathname.startsWith("/media/");
55}
56
57/**
58 * Every /media response, whatever its type: stored bytes are never a page of this site, so they get
59 * no script, no connection and a sandbox, which gives an opened file an opaque origin. That is what
60 * stops an SVG or an HTML body (a hand-put object, a legacy upload, a wrong content type) from
61 * running as the site. `img-src 'self' data:` and `style-src 'unsafe-inline'` are what the browser's
62 * own image viewer needs when a reader opens an image directly.
63 *
64 * TRAP: `sandbox` breaks Chrome's built-in PDF viewer, which refuses to load in a sandboxed
65 * document. No PDF is served from /media today; one must be served elsewhere, never through here.
66 */
67export const MEDIA_CSP = buildPolicy([
68  "default-src 'none'",
69  "img-src 'self' data:",
70  "style-src 'unsafe-inline'",
71  "sandbox",
72]);
73
74/**
75 * THE ONLY THIRD-PARTY SCRIPTS THE SITE RUNS, each an exact file URL and not a host, so nothing else
76 * on that host is trusted. A script that makes the site better can be added here deliberately:
77 * name the file, say what it is for and what it sends, and the gate (check:headers) and the privacy
78 * page change in the same commit. Dustin approves the line; a session does not add one on its own.
79 *
80 * Injected by Cloudflare's edge, not rendered by this code, so it carries no nonce and no hash, and
81 * its `integrity` value changes whenever Cloudflare ships a new beacon, so pinning that hash here would
82 * silently block it within weeks. That is why the policy names the file instead. It reports to this
83 * site's own /cdn-cgi/rum, which `connect-src 'self'` already allows.
84 */
85// Cloudflare Web Analytics, automatic setup, written once in the shared package (CLOUDFLARE_WEB_ANALYTICS): the file URL and
86// its versioned path prefix. The policy below asks the package for it by name.
87export const APPROVED_SCRIPTS = CLOUDFLARE_WEB_ANALYTICS.script;
88
89// Isolate-wide: the hash of a constant script, the same for every request.
90/** @type {Promise<string> | undefined} */
91let loaderHash;
92
93/**
94 * The hash source for the one inline script every page runs, derived from the constant the page
95 * renders, so the two cannot drift. Computed on first use, once per isolate.
96 *
97 * @returns {Promise<string>}
98 */
99export function enhanceLoaderHash() {
100  loaderHash ??= scriptHash(ENHANCE_LOADER);
101  return loaderHash;
102}
103
104/**
105 * The hash source for the page's speculationrules block. Its rules exclude the page itself, so
106 * they vary by pathname, and are hashed per response from the same builder SiteSpeculation renders
107 * with. Deterministic in the pathname, which is in the cache key, so a cached copy stays correct.
108 * 'inline-speculation-rules' does not stand in for this: Chrome and WebKit refuse the block under
109 * this policy without a hash.
110 *
111 * @param {string} pathname the request URL's pathname, which is what `useLocation()` reports
112 * @returns {Promise<string>}
113 */
114export function speculationRulesHash(pathname) {
115  return scriptHash(buildSpeculationRules({ pathname }));
116}
117
118/**
119 * Public pages get no nonce: header and body are edge-cached together, so a nonce there would be
120 * one value shared by every reader for the cache lifetime. They are trusted by the loader's hash
121 * instead, and the bundles it inserts by 'self'. The admin plane is `private, no-store`,
122 * so its per-request nonce is sound, and it keeps it for <Scripts>, the sidebar script and
123 * CodeMirror's inline <style>. The hash is on both, because the loader renders on every page.
124 * A /media path gets MEDIA_CSP instead, chosen here so the Renderer keeps one place that sets the
125 * header.
126 *
127 * @param {string} pathname the request URL's pathname, for the speculation rules' hash
128 * @param {string | undefined} adminNonce this render's nonce on a private path (/admin, /lab), else undefined
129 * @returns {Promise<string>}
130 */
131export async function contentSecurityPolicy(pathname, adminNonce) {
132  if (isMediaPath(pathname)) return MEDIA_CSP;
133  const loader = await enhanceLoaderHash();
134  const rules = await speculationRulesHash(pathname);
135  // What this site loads, the one list the package builds the policy from. No 'strict-dynamic': browsers ignore every host
136  // source while it is present, so an approved file could never run; 'self' covers the bundles the loader inserts. The
137  // admin plane's nonce also covers CodeMirror's inline <style>, which cannot be turned off. Nonces do not apply to style
138  // attributes, and Shiki emits about 117 inline style="" per post, so those are allowed as attributes only.
139  return buildContentSecurityPolicy({
140    sources: { img: ["data:"], media: PODCAST_AUDIO_HOSTS.map((host) => `https://${host}`) },
141    scriptHashes: [loader, rules],
142    nonce: adminNonce || undefined,
143    styleAttributesInline: true,
144    cloudflareWebAnalytics: true,
145    reportUri: CSP_REPORT_PATH,
146    reportTo: CSP_ENDPOINT_NAME,
147  }).value;
148}