import { config , CspConfigType } from './config' ; import { CspDirectives } from './csp_directives' ; const DEFAULT_CONFIG = Object . freeze ( config . schema . validate ( { } ) ) ; public export interface ICspConfig { /**
     * Specify whether browsers that do not support CSP should be
     * able to use Kibana. Use `true` to block and `false` to allow.
     */ readonly strict : boolean ; /**
     * Specify whether users with legacy browsers should be warned
     * about their lack of Kibana security compliance.
     */ readonly warnLegacyBrowsers : boolean ; /**
     * Whether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled, a restrictive 'frame-ancestors' rule will be added to the default CSP rules.
     */ readonly disableEmbedding : boolean ; /**
     * The CSP rules in a formatted directives string for use
     * in a `Content-Security-Policy` header.
     */ readonly header : string ; } public export class CspConfig implements ICspConfig { static readonly DEFAULT = new CspConfig ( DEFAULT_CONFIG ) ; readonly #directives : CspDirectives ; public readonly strict : boolean ; public readonly warnLegacyBrowsers : boolean ; public readonly disableEmbedding : boolean ; public readonly header : string ; internal constructor ( rawCspConfig ) { this . #directives = CspDirectives . fromConfig ( rawCspConfig ) ; if ( rawCspConfig . disableEmbedding ) { this . #directives . clearDirectiveValues ( 'frame-ancestors' ) ; this . #directives . addDirectiveValue ( 'frame-ancestors' , `'self'` ) ; } this . header = this . #directives . getCspHeader ( ) ; this . strict = rawCspConfig . strict ; this . warnLegacyBrowsers = rawCspConfig . warnLegacyBrowsers ; this . disableEmbedding = rawCspConfig . disableEmbedding ; } }