Initial commit.

2026-08-19 23:19:08 +02:00
commit 22e737d9c2
153 changed files with 11680 additions and 0 deletions
@@ -0,0 +1,12 @@
+import HTTPTypes
+
+public extension HTTPField.Name {
+    /// The `Permissions-Policy` field name (not provided as a standard `HTTPField.Name`).
+    static let permissionsPolicy = Self("Permissions-Policy")!
+    /// The `Referrer-Policy` field name (not provided as a standard `HTTPField.Name`).
+    static let referrerPolicy = Self("Referrer-Policy")!
+    /// The `X-Frame-Options` field name (not provided as a standard `HTTPField.Name`).
+    static let frameOptions = Self("X-Frame-Options")!
+    /// The `X-Forwarded-For` field name (not provided as a standard `HTTPField.Name`).
+    static let xForwardedFor = Self("X-Forwarded-For")!
+}
@@ -0,0 +1,9 @@
+extension Int {
+    /// A namespace for the rate limit's default configuration values.
+    public enum RateLimit {
+        /// The default number of requests admitted per client per window.
+        public static let limit = 5
+        /// The default window length, in seconds (1 minute).
+        public static let window = 60
+    }
+}
@@ -0,0 +1,32 @@
+import Hummingbird
+
+public extension RouterMethods {
+
+    // MARK: Methods
+    
+    /// Adds the routes of ``RouterController`` values to the router using the ``RouteCollectionBuilder`` result builder.
+    ///
+    /// Mirrors `addMiddleware`, letting controllers be listed declaratively:
+    ///
+    /// ```swift
+    /// router.addController {
+    ///     RootController<AppRequestContext>()
+    ///     HealthController<AppRequestContext>()
+    /// }
+    /// ```
+    ///
+    /// Each controller's route collection is added at the router's root, exactly as a sequence of `addRoutes(_:)` calls would.
+    /// - Parameter build: the controller stack result builder.
+    /// - Returns: the router, so calls can be chained.
+    @discardableResult
+    func addController(
+        @RouteCollectionBuilder<Context> _ build: () -> [RouteCollection<Context>]
+    ) -> Self {
+        for collection in build() {
+            addRoutes(collection)
+        }
+
+        return self
+    }
+
+}
@@ -0,0 +1,22 @@
+extension String {
+    /// A namespace for the security headers' default configuration values.
+    ///
+    /// `Strict-Transport-Security` is intentionally absent: it is only safe over HTTPS and is "sticky" in browsers, so it stays off unless explicitly
+    /// configured in production.
+    public enum Security {
+        /// The default `Content-Security-Policy`.
+        ///
+        /// Restricts every resource to the site's own origin (`default-src 'self'`), blocks plugins (`object-src 'none'`), pins the document
+        /// base URL (`base-uri 'self'`), and forbids framing (`frame-ancestors 'none'`). No inline-style exception is included, so pages must
+        /// link external stylesheets.
+        public static let contentSecurityPolicy = "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+        /// The default `X-Content-Type-Options` (disables MIME sniffing).
+        public static let contentTypeOptions = "nosniff"
+        /// The default `X-Frame-Options` (forbids framing the page).
+        public static let frameOptions = "DENY"
+        /// The default `Referrer-Policy`.
+        public static let referrerPolicy = "strict-origin-when-cross-origin"
+        /// The default `Permissions-Policy` (denies access to powerful browser features a static site does not use).
+        public static let permissionsPolicy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
+    }
+}