fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore(work): finish 06-security-headers-core-module

Browse Source
This commit is contained in:
Danijel Martinek
2026-05-20 11:35:46 +02:00
parent dd2af0c902
commit 6575a4857e
3 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/work/_system/_state.json
View File

@@ -1,5 +1,5 @@
{ {
"updated_at": "2026-05-20T09:34:30.461Z", "updated_at": "2026-05-20T09:35:47.087Z",
"epics": { "epics": {
"binder-wrap-helper": { "binder-wrap-helper": {
"status": "done", "status": "done",
@@ -624,10 +624,10 @@
"blocks": [] "blocks": []
}, },
"06-security-headers-core-module": { "06-security-headers-core-module": {
"status": "todo", "status": "done",
"title": "Security headers core module", "title": "Security headers core module",
"ac_total": 1, "ac_total": 1,
"ac_completed": 0, "ac_completed": 1,
"depends_on": [], "depends_on": [],
"blocks": [ "blocks": [
"07-security-header-adapters" "07-security-header-adapters"
@@ -688,8 +688,8 @@
"ready": [ "ready": [
{ {
"epic": "security-headers-rate-limit-sbom", "epic": "security-headers-rate-limit-sbom",
"story": "06-security-headers-core-module", "story": "07-security-header-adapters",
"title": "Security headers core module" "title": "Per-framework security header adapters"
}, },
{ {
"epic": "security-headers-rate-limit-sbom", "epic": "security-headers-rate-limit-sbom",
@@ -703,14 +703,6 @@
} }
], ],
"blocked": [ "blocked": [
{
"epic": "security-headers-rate-limit-sbom",
"story": "07-security-header-adapters",
"title": "Per-framework security header adapters",
"waiting_on": [
"security-headers-rate-limit-sbom/06-security-headers-core-module"
]
},
{ {
"epic": "security-headers-rate-limit-sbom", "epic": "security-headers-rate-limit-sbom",
"story": "08-app-wiring-web-next", "story": "08-app-wiring-web-next",

6
docs/work/epics/security-headers-rate-limit-sbom/06-security-headers-core-module/_story.md
View File

@@ -3,12 +3,12 @@ id: 06-security-headers-core-module
epic: security-headers-rate-limit-sbom epic: security-headers-rate-limit-sbom
title: Security headers core module title: Security headers core module
type: technical-story type: technical-story
status: todo status: done
feature: core-shared feature: core-shared
depends-on: [] depends-on: []
blocks: [07-security-header-adapters] blocks: [07-security-header-adapters]
created: 2026-05-20T00:00:00Z created: 2026-05-20T00:00:00Z
updated: 2026-05-20T08:14:55.907Z updated: 2026-05-20T09:35:46.924Z
--- ---
## Goal ## Goal
@@ -45,4 +45,4 @@ The per-framework adapters (Story 07) and app-wiring stories (08, 09) all depend
## Tasks ## Tasks
- [ ] Create `packages/core-shared/src/security/security-types.ts` with `SecurityHeadersConfig` + `CspMode` types; implement `packages/core-shared/src/security/nonce.ts` with `generateNonce()` using `crypto.randomBytes`; implement `packages/core-shared/src/security/build-security-headers.ts` emitting all six headers with prod/dev CSP mode, nonce threading into `script-src`, `allowedConnectOrigins` / `allowedImgOrigins` / `allowedFontOrigins` applied to CSP, URL validation throwing `InvalidSecurityHeadersConfig` on malformed origins; unit tests covering header set, CSP variants, nonce threading, allowlist CSP directives, URL validation error, nonce randomness; export from `core-shared` barrel; all gates pass. - [x] Create `packages/core-shared/src/security/security-types.ts` with `SecurityHeadersConfig` + `CspMode` types; implement `packages/core-shared/src/security/nonce.ts` with `generateNonce()` using `crypto.randomBytes`; implement `packages/core-shared/src/security/build-security-headers.ts` emitting all six headers with prod/dev CSP mode, nonce threading into `script-src`, `allowedConnectOrigins` / `allowedImgOrigins` / `allowedFontOrigins` applied to CSP, URL validation throwing `InvalidSecurityHeadersConfig` on malformed origins; unit tests covering header set, CSP variants, nonce threading, allowlist CSP directives, URL validation error, nonce randomness; export from `core-shared` barrel; all gates pass.

4
docs/work/epics/security-headers-rate-limit-sbom/_epic.md
View File

@@ -7,7 +7,7 @@ status: in-progress
features: features:
[core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms] [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
created: 2026-05-20T00:00:00Z created: 2026-05-20T00:00:00Z
updated: 2026-05-20T09:27:20.152Z updated: 2026-05-20T09:35:46.924Z
--- ---
## Goal ## Goal
@@ -25,7 +25,7 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
- [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md) - [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md)
- [x] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md) - [x] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md)
- [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md) - [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
- [ ] [06 — Security headers core module](06-security-headers-core-module/_story.md) - [x] [06 — Security headers core module](06-security-headers-core-module/_story.md)
- [ ] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md) - [ ] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md)
- [ ] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md) - [ ] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
- [ ] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md) - [ ] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)