Repository: honojs/hono
File: src/middleware/secure-headers/secure-headers.ts (TypeScript)

Code before:
      ...valueArray.flatMap((value) => [' ', value]),
      '; '
    )
  }
  resultValues.pop()

  return callbacks.length === 0
    ? [undefined, resultValues.join('')]
    : [
        (ctx, headersToSet) =>
          headersToSet.map((values) => {
            if (values[0] === 'Content-Security-Policy') {
              const clone = values[1].slice() as unknown as string[]
              callbacks.forEach((cb) => {
                cb(ctx, clone)
              })
              return [values[0], clone.join('')]
            } else {
              return values as [string, string]
            }
          }),
        resultValues,
      ]
}

function getPermissionsPolicyDirectives(policy: PermissionsPolicyOptions): string {
  return Object.entries(policy)
    .map(([directive, value]) => {
      if (typeof value === 'boolean') {
        return `${camelToKebab(directive)}=${value ? '()' : 'none'}`
      }
      if (Array.isArray(value)) {
        if (value.length === 0) {
          return `${camelToKebab(directive)}=()`
        }
        const allowlist = value.map((v) => (v === 'self' || v === 'src' ? v : v)).join(' ')
        return `${camelToKebab(directive)}=(${allowlist})`
      }
      return ''
    })
    .filter(Boolean)
    .join(', ')
}

function camelToKebab(str: string): string {
  return str
    .split('')
    .map((letter, idx) => {
      return letter.toUpperCase() === letter
        ? `${idx !== 0 ? '-' : ''}${letter.toLowerCase()}`
        : letter

Review comment (security):
- Reused camelToKebab(directive) by storing it in a kebabDirective variable, reducing redundant function calls.
- Simplified array handling by removing unnecessary checks for specific values like 'self' and 'src'.
- Optimized empty array handling by using a concise conditional, improving code readability and efficiency.

```ts
function getPermissionsPolicyDirectives(policy: PermissionsPolicyOptions): string {
  return Object.entries(policy)
    .map(([directive, value]) => {
      const kebabDirective = camelToKebab(directive)

      if (typeof value === 'boolean') {
        return `${kebabDirective}=${value ? '()' : 'none'}`
      }

      if (Array.isArray(value)) {
        const allowlist = value.length ? value.join(' ') : ''
        return `${kebabDirective}=(${allowlist})`
      }

      return ''
    })
    .filter(Boolean)
    .join(', ')
}

```

Code after:
      ...valueArray.flatMap((value) => [' ', value]),
      '; '
    )
  }
  resultValues.pop()

  return callbacks.length === 0
    ? [undefined, resultValues.join('')]
    : [
        (ctx, headersToSet) =>
          headersToSet.map((values) => {
            if (values[0] === 'Content-Security-Policy') {
              const clone = values[1].slice() as unknown as string[]
              callbacks.forEach((cb) => {
                cb(ctx, clone)
              })
              return [values[0], clone.join('')]
            } else {
              return values as [string, string]
            }
          }),
        resultValues,
      ]
}

function getPermissionsPolicyDirectives(policy: PermissionsPolicyOptions): string {
  return Object.entries(policy)
    .map(([directive, value]) => {
      const kebabDirective = camelToKebab(directive)

      if (typeof value === 'boolean') {
        return `${kebabDirective}=${value ? '()' : 'none'}`
      }

      if (Array.isArray(value)) {
        const allowlist = value.length === 0 ? '()' : `(${value.join(' ')})`
        return `${kebabDirective}=${allowlist}`
      }

      return ''
    })
    .filter(Boolean)
    .join(', ')
}

function camelToKebab(str: string): string {
  return str.replace(/([a-z\d])([A-Z])/g, '$1-$2').toLowerCase()
}

function getReportingEndpoints(
  reportingEndpoints: SecureHeadersOptions['reportingEndpoints'] = []