mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-11 21:57:14 +03:00
Paul BakausandClaude Opus 4.7
05b0ac3e1f
Shape names renamed to describe the patch mechanism (what the agent does) rather than the origin (where the CSP lives). One template now covers multiple frameworks. ## Shape rename - shared-helper → append-arrays - inline-headers → append-string append-arrays applies wherever CSP is a structured directive array. append-string applies wherever CSP is a literal value string. ## New detection coverage - SvelteKit kit.csp.directives in svelte.config.js → append-arrays - Nuxt routeRules / nitro.routeRules CSP header → append-string - Nuxt-security module's contentSecurityPolicy → append-arrays ## New fixtures - sveltekit-csp/: SvelteKit config with kit.csp.directives. Includes expected-after-patch.js showing the array spread. - nuxt-csp/: Nuxt 3 config with routeRules CSP. Includes expected-after-patch.ts showing the string splice. ## Skill docs Single append-arrays template covers Next monorepo, SvelteKit, and Nuxt-security. Single append-string template covers inline Next headers() and Nuxt routeRules. Per-framework specifics listed as sub-bullets under each shape. 54 tests across 9 fixtures, all passing. Clean fixtures (plain vite, nextjs-app, astro, sveltekit, multipage-with-generator) still classify as shape: null. Astro and Vue (non-Nuxt) left unhandled by design: Astro has no first-party CSP mechanism; Vue without Nuxt is covered by the existing Vite fixture. Plain Svelte has no framework CSP primitive and inherits from its bundler (Vite/Rollup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
21 lines
647 B
TypeScript
21 lines
647 B
TypeScript
// Nuxt 3 config with CSP applied via routeRules headers.
|
|
// Representative of the "append-string" shape: CSP is a literal value string.
|
|
export default defineNuxtConfig({
|
|
compatibilityDate: '2025-01-01',
|
|
devtools: { enabled: true },
|
|
routeRules: {
|
|
'/**': {
|
|
headers: {
|
|
'Content-Security-Policy':
|
|
"default-src 'self'; " +
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
|
|
"style-src 'self' 'unsafe-inline'; " +
|
|
"img-src 'self' data: blob:; " +
|
|
"connect-src 'self'; " +
|
|
"frame-ancestors 'self';",
|
|
'X-Frame-Options': 'SAMEORIGIN',
|
|
},
|
|
},
|
|
},
|
|
});
|