Add robots.txt, security.txt, and add more security headers

Author: davidje13

scripts/build.sh

@@ -52,8 +52,7 @@ echo 'Combining output...';
 rm -rf "$BUILDDIR" || true;
 cp -R "$BASEDIR/src/backend/build" "$BUILDDIR";
 rm -rf "$BUILDDIR/static" || true;
-mkdir -p "$BUILDDIR/static";
-cp -R "$BASEDIR/src/frontend/build/"* "$BUILDDIR/static";
+cp -R "$BASEDIR/src/frontend/build" "$BUILDDIR/static";
 chmod +x "$BUILDDIR/index.js";
 
 echo 'Compressing static resources...';

src/backend/src/app.ts

@@ -51,6 +51,20 @@ const CSP = [
   "frame-ancestors 'none'",
 ].join('; ');
 
+const PERMISSIONS_POLICY = [
+  'accelerometer=()',
+  'autoplay=()',
+  'camera=()',
+  'geolocation=()',
+  'gyroscope=()',
+  'interest-cohort=()',
+  'magnetometer=()',
+  'microphone=()',
+  'payment=()',
+  'sync-xhr=()',
+  'usb=()',
+].join(', ');
+
 function getHost(req: { hostname: string }): string {
   const raw: string = req.hostname;
   if (raw.includes(':')) {
@@ -109,8 +123,10 @@ export default async (config: ConfigT): Promise<App> => {
     res.header('x-content-type-options', 'nosniff');
     res.header('content-security-policy', CSP
       .replace(CSP_DOMAIN_PLACEHOLDER, getHost(req)));
+    res.header('permissions-policy', PERMISSIONS_POLICY);
     res.header('referrer-policy', 'no-referrer');
     res.header('cross-origin-opener-policy', 'same-origin');
+    res.header('cross-origin-resource-policy', 'same-origin');
     res.header('cross-origin-embedder-policy', 'require-corp');
     next();
   });
@@ -120,6 +136,8 @@ export default async (config: ConfigT): Promise<App> => {
     res.header('expires', '0');
     res.header('pragma', 'no-cache');
     res.removeHeader('content-security-policy');
+    res.removeHeader('permissions-policy');
+    res.removeHeader('referrer-policy');
     res.removeHeader('cross-origin-opener-policy');
     res.removeHeader('cross-origin-embedder-policy');
     next();

src/frontend/.neutrinorc.js

@@ -52,9 +52,9 @@ module.exports = {
     })),
     copy({
       patterns: [{
-        context: 'resources/assets',
-        from: '**/*',
-        to: 'assets',
+        context: 'resources/static',
+        from: '{.*/**/*,*}',
+        to: '.',
       }],
     }),
     jest({

src/frontend/package-lock.json

@@ -0,0 +1,4 @@
+Contact: https://github.com/davidje13/Refacto/issues
+Preferred-Languages: en
+Expires: 3000-01-01T00:00:00Z
+Policy: https://github.com/davidje13/Refacto/security/policy

src/frontend/resources/static/.well-known/security.txt

@@ -0,0 +1,3 @@
+User-agent: *
+Disallow: /retros/
+Disallow: /api/