Release 0.6.0

src/hooks.server.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto';
 import { redirect } from '@sveltejs/kit';
 import type { Handle } from '@sveltejs/kit/hooks';
 import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
@@ -14,16 +15,32 @@ const publicPaths = new Set([
 
 export const handle: Handle = async ({ event, resolve }) => {
 	const presentationPath = event.url.pathname.startsWith('/heinzlive/');
+	const sharePath = event.url.pathname.startsWith('/freigabe/');
+	const shareMediaPath = /^\/freigabe\/[^/]+\/media\/[^/]+$/.test(event.url.pathname);
 	const presentationTestPath = /^\/fundus\/[^/]+\/praesentation(?:\/|$)/.test(event.url.pathname);
 	const token = event.cookies.get(SESSION_COOKIE);
 	event.locals.user = getSessionUser(token);
 	if (token && !event.locals.user) deleteSession(event.cookies);
 
-	if (!presentationPath && !publicPaths.has(event.url.pathname) && !event.locals.user) {
+	if (
+		!presentationPath &&
+		!sharePath &&
+		!publicPaths.has(event.url.pathname) &&
+		!event.locals.user
+	) {
 		redirect(303, hasUsers() ? '/login' : '/setup');
 	}
 
-	const response = await resolve(event);
+	const sharePageNonce = sharePath && !shareMediaPath ? randomBytes(16).toString('base64') : null;
+	const response = await resolve(
+		event,
+		sharePageNonce
+			? {
+					transformPageChunk: ({ html }) =>
+						html.replaceAll('<script', `<script nonce="${sharePageNonce}"`)
+				}
+			: undefined
+	);
 	response.headers.set('Referrer-Policy', 'same-origin');
 	response.headers.set('X-Content-Type-Options', 'nosniff');
 	response.headers.set('X-Frame-Options', 'DENY');
@@ -35,6 +52,16 @@ export const handle: Handle = async ({ event, resolve }) => {
 			"frame-src https://www.youtube-nocookie.com https://www.youtube.com https://www.tiktok.com; frame-ancestors 'none'"
 		);
 	}
+	if (sharePath) {
+		response.headers.set('Cache-Control', 'private, no-store');
+		response.headers.set('Referrer-Policy', 'same-origin');
+		if (!shareMediaPath) {
+			response.headers.set(
+				'Content-Security-Policy',
+				`default-src 'self'; script-src 'self' 'nonce-${sharePageNonce}'; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-ancestors 'none'`
+			);
+		}
+	}
 	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
 		response.headers.set('Cache-Control', 'no-store');
 	}