Linus Rath
76b21147e4
Plugin & Theme System: - Add plugin type definitions, permissions (30+), and validation constants - Add IndexedDB storage layer for plugin code, theme CSS, and previews - Add theme CSS sanitization, injection, and safety validation - Add HookBus event system with 130+ hooks across 20 domains - Add plugin ZIP extraction and manifest validation with JS security checks - Add sandboxed PluginAPI factory with scoped storage, logging, and permission gating - Add plugin loader with blob URL dynamic import and auto-disable circuit breaker - Add 3 built-in themes (Nord, Catppuccin, Solarized) - Add Zustand plugin store with install/uninstall/enable/disable lifecycle - Add PluginSlot, PluginSlotRenderer, and PluginErrorBoundary components - Add plugins and themes settings UI panels - Integrate plugin slots into email viewer, composer, navigation rail, sidebar, and context menu - Extend theme store with custom theme installation and activation Admin Dashboard: - Add admin authentication with scrypt password hashing and AES-256-GCM sessions - Add rate-limited login (5 attempts/15min per IP) - Add config manager with admin override > env var > default priority - Add settings policy system with feature gates and per-setting restrictions - Add audit logging with rotation - Add admin API routes (login, logout, config, policy, audit, password change) - Add admin UI pages (login, dashboard, config, policy, audit) - Add policy store for client-side feature gate enforcement - Wire admin password initialization into server instrumentation Tests: - Add 139 tests across 10 test files covering all plugin/theme modules
76 lines
2.4 KiB
TypeScript
76 lines
2.4 KiB
TypeScript
import { type NextRequest, NextResponse } from "next/server";
|
|
import createIntlMiddleware from "next-intl/middleware";
|
|
import { routing } from "./i18n/routing";
|
|
|
|
const intlMiddleware = createIntlMiddleware(routing);
|
|
|
|
export function proxy(request: NextRequest) {
|
|
const nonce = crypto.randomUUID();
|
|
const isDev = process.env.NODE_ENV === "development";
|
|
|
|
const scriptSrc = isDev
|
|
? `'self' 'nonce-${nonce}' 'unsafe-eval'`
|
|
: `'self' 'nonce-${nonce}'`;
|
|
|
|
const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;
|
|
|
|
const frameAncestors = process.env.ALLOWED_FRAME_ANCESTORS?.trim() || "'none'";
|
|
|
|
const csp = [
|
|
`default-src 'self'`,
|
|
`script-src ${scriptSrc}`,
|
|
`style-src 'self' 'unsafe-inline'`,
|
|
`img-src 'self' data: https:`,
|
|
`font-src 'self'`,
|
|
`connect-src ${connectSrc}`,
|
|
`frame-src 'none'`,
|
|
`object-src 'none'`,
|
|
`base-uri 'self'`,
|
|
`form-action 'self'`,
|
|
`frame-ancestors ${frameAncestors}`,
|
|
].join("; ");
|
|
|
|
// Skip intl middleware for /admin routes — they have their own layout
|
|
const pathname = request.nextUrl.pathname;
|
|
const isAdminRoute = pathname === '/admin' || pathname.startsWith('/admin/');
|
|
|
|
let intlResponse: ReturnType<typeof intlMiddleware> | null = null;
|
|
if (!isAdminRoute) {
|
|
try {
|
|
intlResponse = intlMiddleware(request);
|
|
} catch (error) {
|
|
console.error('Locale middleware error:', error);
|
|
}
|
|
}
|
|
const response = intlResponse ?? NextResponse.next();
|
|
|
|
const existing = response.headers.get("x-middleware-override-headers");
|
|
response.headers.set(
|
|
"x-middleware-override-headers",
|
|
existing ? `${existing},x-nonce` : "x-nonce"
|
|
);
|
|
response.headers.set("x-middleware-request-x-nonce", nonce);
|
|
|
|
response.headers.set("X-Content-Type-Options", "nosniff");
|
|
|
|
// X-Frame-Options only supports DENY/SAMEORIGIN. When frame-ancestors
|
|
// specifies explicit origins, we rely solely on the CSP header.
|
|
if (frameAncestors === "'none'") {
|
|
response.headers.set("X-Frame-Options", "DENY");
|
|
}
|
|
|
|
response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
|
|
response.headers.set("X-XSS-Protection", "0");
|
|
response.headers.set(
|
|
"Permissions-Policy",
|
|
"camera=(), microphone=(), geolocation=(), payment=()"
|
|
);
|
|
response.headers.set("Content-Security-Policy-Report-Only", csp);
|
|
|
|
return response;
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next|.*\\..*).*)"],
|
|
};
|