125 lines
3.4 KiB
JavaScript
125 lines
3.4 KiB
JavaScript
import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
|
|
|
|
const cachePolicy = JSON.parse(
|
|
await readFile("config/hosting/cache-policy.json", "utf8"),
|
|
);
|
|
const securityPolicy = JSON.parse(
|
|
await readFile("config/hosting/security-headers.json", "utf8"),
|
|
);
|
|
const baseUrl = process.env.HOSTING_BASE_URL;
|
|
|
|
/** @type {Record<string, Record<string, string>>} */
|
|
let responses;
|
|
let mode;
|
|
|
|
if (baseUrl) {
|
|
mode = "live";
|
|
const assets = await readdir("dist/assets");
|
|
const hashedJavaScript = assets.find((file) => file.endsWith(".js"));
|
|
if (!hashedJavaScript) throw new Error("No built hashed JavaScript found.");
|
|
const paths = {
|
|
index: "/",
|
|
runtimeConfig: "/config.json",
|
|
releaseManifest: "/release-manifest.json",
|
|
hashedAsset: `/assets/${hashedJavaScript}`,
|
|
};
|
|
responses = {};
|
|
for (const [surface, pathname] of Object.entries(paths)) {
|
|
const response = await fetch(new URL(pathname, baseUrl));
|
|
responses[surface] = Object.fromEntries(
|
|
[...response.headers.entries()].map(([name, value]) => [
|
|
name.toLowerCase(),
|
|
value,
|
|
]),
|
|
);
|
|
}
|
|
} else {
|
|
mode = "fixture";
|
|
responses = JSON.parse(
|
|
await readFile("config/hosting/response-headers.fixture.json", "utf8"),
|
|
).responses;
|
|
}
|
|
|
|
const results = [];
|
|
for (const [surface, policy] of Object.entries(cachePolicy.surfaces)) {
|
|
if (!("cacheControl" in policy)) continue;
|
|
const observed = responses[surface]?.["cache-control"];
|
|
results.push({
|
|
surface,
|
|
header: "cache-control",
|
|
expected: policy.cacheControl,
|
|
observed,
|
|
passed: observed === policy.cacheControl,
|
|
});
|
|
const observedContentType = responses[surface]?.["content-type"];
|
|
const observedMime = observedContentType
|
|
?.split(";", 1)[0]
|
|
.trim()
|
|
.toLowerCase();
|
|
results.push({
|
|
surface,
|
|
header: "content-type",
|
|
expected: policy.contentTypes,
|
|
observed: observedContentType,
|
|
passed: policy.contentTypes.includes(observedMime),
|
|
});
|
|
if (policy.securityHeaders) {
|
|
for (const [header, expected] of Object.entries(securityPolicy.headers)) {
|
|
const observedSecurity = responses[surface]?.[header.toLowerCase()];
|
|
results.push({
|
|
surface,
|
|
header: header.toLowerCase(),
|
|
expected,
|
|
observed: observedSecurity,
|
|
passed: observedSecurity === expected,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
results.push({
|
|
surface: "sourceMap",
|
|
header: "public",
|
|
expected: false,
|
|
observed: cachePolicy.surfaces.sourceMap.public,
|
|
passed: cachePolicy.surfaces.sourceMap.public === false,
|
|
});
|
|
results.push({
|
|
surface: "serviceWorker",
|
|
header: "enabled",
|
|
expected: false,
|
|
observed: cachePolicy.surfaces.serviceWorker.enabled,
|
|
passed: cachePolicy.surfaces.serviceWorker.enabled === false,
|
|
});
|
|
|
|
const passed = results.every((result) => result.passed);
|
|
await mkdir("artifacts/release", { recursive: true });
|
|
await writeFile(
|
|
"artifacts/release/hosting-headers.json",
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
generatedAt: new Date().toISOString(),
|
|
mode,
|
|
baseUrl: baseUrl ?? null,
|
|
providerVerificationRequired: mode !== "live",
|
|
results,
|
|
passed,
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
|
|
if (!passed) {
|
|
process.stderr.write(
|
|
"Hosting cache/content-type/security header verification failed.\n",
|
|
);
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write(
|
|
`Hosting header contract: PASS (${mode}; live verification ${
|
|
mode === "live" ? "complete" : "required before promotion"
|
|
})\n`,
|
|
);
|