From 6575a4857e28473e974a23124481432fe3f704fe Mon Sep 17 00:00:00 2001 From: Danijel Martinek Date: Wed, 20 May 2026 11:35:46 +0200 Subject: [PATCH] chore(work): finish 06-security-headers-core-module --- docs/work/_system/_state.json | 18 +++++------------- .../06-security-headers-core-module/_story.md | 6 +++--- .../security-headers-rate-limit-sbom/_epic.md | 4 ++-- 3 files changed, 10 insertions(+), 18 deletions(-) diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json index 17d6ae1..c1454ae 100644 --- a/docs/work/_system/_state.json +++ b/docs/work/_system/_state.json @@ -1,5 +1,5 @@ { - "updated_at": "2026-05-20T09:34:30.461Z", + "updated_at": "2026-05-20T09:35:47.087Z", "epics": { "binder-wrap-helper": { "status": "done", @@ -624,10 +624,10 @@ "blocks": [] }, "06-security-headers-core-module": { - "status": "todo", + "status": "done", "title": "Security headers core module", "ac_total": 1, - "ac_completed": 0, + "ac_completed": 1, "depends_on": [], "blocks": [ "07-security-header-adapters" @@ -688,8 +688,8 @@ "ready": [ { "epic": "security-headers-rate-limit-sbom", - "story": "06-security-headers-core-module", - "title": "Security headers core module" + "story": "07-security-header-adapters", + "title": "Per-framework security header adapters" }, { "epic": "security-headers-rate-limit-sbom", @@ -703,14 +703,6 @@ } ], "blocked": [ - { - "epic": "security-headers-rate-limit-sbom", - "story": "07-security-header-adapters", - "title": "Per-framework security header adapters", - "waiting_on": [ - "security-headers-rate-limit-sbom/06-security-headers-core-module" - ] - }, { "epic": "security-headers-rate-limit-sbom", "story": "08-app-wiring-web-next", diff --git a/docs/work/epics/security-headers-rate-limit-sbom/06-security-headers-core-module/_story.md b/docs/work/epics/security-headers-rate-limit-sbom/06-security-headers-core-module/_story.md index c739d47..ef81604 100644 --- a/docs/work/epics/security-headers-rate-limit-sbom/06-security-headers-core-module/_story.md +++ b/docs/work/epics/security-headers-rate-limit-sbom/06-security-headers-core-module/_story.md @@ -3,12 +3,12 @@ id: 06-security-headers-core-module epic: security-headers-rate-limit-sbom title: Security headers core module type: technical-story -status: todo +status: done feature: core-shared depends-on: [] blocks: [07-security-header-adapters] created: 2026-05-20T00:00:00Z -updated: 2026-05-20T08:14:55.907Z +updated: 2026-05-20T09:35:46.924Z --- ## Goal @@ -45,4 +45,4 @@ The per-framework adapters (Story 07) and app-wiring stories (08, 09) all depend ## Tasks -- [ ] Create `packages/core-shared/src/security/security-types.ts` with `SecurityHeadersConfig` + `CspMode` types; implement `packages/core-shared/src/security/nonce.ts` with `generateNonce()` using `crypto.randomBytes`; implement `packages/core-shared/src/security/build-security-headers.ts` emitting all six headers with prod/dev CSP mode, nonce threading into `script-src`, `allowedConnectOrigins` / `allowedImgOrigins` / `allowedFontOrigins` applied to CSP, URL validation throwing `InvalidSecurityHeadersConfig` on malformed origins; unit tests covering header set, CSP variants, nonce threading, allowlist CSP directives, URL validation error, nonce randomness; export from `core-shared` barrel; all gates pass. +- [x] Create `packages/core-shared/src/security/security-types.ts` with `SecurityHeadersConfig` + `CspMode` types; implement `packages/core-shared/src/security/nonce.ts` with `generateNonce()` using `crypto.randomBytes`; implement `packages/core-shared/src/security/build-security-headers.ts` emitting all six headers with prod/dev CSP mode, nonce threading into `script-src`, `allowedConnectOrigins` / `allowedImgOrigins` / `allowedFontOrigins` applied to CSP, URL validation throwing `InvalidSecurityHeadersConfig` on malformed origins; unit tests covering header set, CSP variants, nonce threading, allowlist CSP directives, URL validation error, nonce randomness; export from `core-shared` barrel; all gates pass. diff --git a/docs/work/epics/security-headers-rate-limit-sbom/_epic.md b/docs/work/epics/security-headers-rate-limit-sbom/_epic.md index 1ea8fc8..97431dd 100644 --- a/docs/work/epics/security-headers-rate-limit-sbom/_epic.md +++ b/docs/work/epics/security-headers-rate-limit-sbom/_epic.md @@ -7,7 +7,7 @@ status: in-progress features: [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms] created: 2026-05-20T00:00:00Z -updated: 2026-05-20T09:27:20.152Z +updated: 2026-05-20T09:35:46.924Z --- ## Goal @@ -25,7 +25,7 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti - [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md) - [x] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md) - [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md) -- [ ] [06 — Security headers core module](06-security-headers-core-module/_story.md) +- [x] [06 — Security headers core module](06-security-headers-core-module/_story.md) - [ ] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md) - [ ] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md) - [ ] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)