@adobe/spacecat-shared-data-access 3.68.0 → 3.70.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [@adobe/spacecat-shared-data-access-v3.70.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v3.69.0...@adobe/spacecat-shared-data-access-v3.70.0) (2026-05-22)
+
+### Features
+
+* **data-access:** extend DOMAIN_PATTERN to support subpath domains (LLMO-4187) ([#1593](https://github.com/adobe/spacecat-shared/issues/1593)) ([f6cd505](https://github.com/adobe/spacecat-shared/commit/f6cd505da6c61936538a39b26465c2bdc1c3863b))
+
+## [@adobe/spacecat-shared-data-access-v3.69.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v3.68.0...@adobe/spacecat-shared-data-access-v3.69.0) (2026-05-22)
+
+### Features
+
+* expose config.defaults via getDefaults() and include in toDynamoItem ([#1613](https://github.com/adobe/spacecat-shared/issues/1613)) ([782503d](https://github.com/adobe/spacecat-shared/commit/782503d8880054bcf0c65fdce987520e28950133))
+
 ## [@adobe/spacecat-shared-data-access-v3.68.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v3.67.0...@adobe/spacecat-shared-data-access-v3.68.0) (2026-05-21)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-data-access",
-  "version": "3.68.0",
+  "version": "3.70.0",
   "description": "Shared modules of the Spacecat Services - Data Access",
   "type": "module",
   "engines": {

package/src/models/plg-onboarding/plg-onboarding.model.js

@@ -24,7 +24,90 @@ class PlgOnboarding extends BaseModel {
 
   static IMS_ORG_ID_PATTERN = /^[a-z0-9]{24}@AdobeOrg$/i;
 
-  static DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+  static MAX_HOSTNAME_LENGTH = 253; // RFC 1035 DNS name limit
+
+  // Practical cap, chosen for storage and sort-key index depth rather than for any
+  // specific browser/URL-bar limit (the domain field is a stored identifier, not a URL).
+  static MAX_DOMAIN_LENGTH = 2048;
+
+  // **WARNING for external consumers: do NOT use DOMAIN_PATTERN directly.**
+  // This regex is incomplete on its own — it has no length cap, no control-character
+  // rejection, no all-numeric-hostname check, no trailing-dot/consecutive-dot path
+  // rejection, and no typeof guard. Always call `PlgOnboarding.isValidDomain(value)`
+  // which composes this regex with the rest of the validator. The regex is exported
+  // only for legacy callers and may become module-private in a future major release.
+  //
+  // Matches lowercase hostnames (at least one dot required) and an optional subpath
+  //   (e.g. nba.com, nba.com/kings, nba.com/us/kings).
+  // The final label (TLD) must be alphabetic (>= 2 chars) or punycode (xn--*). This
+  //   structurally rejects every IP-literal form: dotted-quad (127.0.0.1), short-form
+  //   (127.1), decimal (2130706433), hex (0x7f.0.0.1, 0xa9.254.169.254 → AWS IMDS),
+  //   and octal (0177.0.0.1) — and also blocks foo.1-style typos. WHATWG URL would
+  //   otherwise canonicalize hex/decimal IPs to their dotted-quad form, bypassing
+  //   denylist-based SSRF gates downstream.
+  // Rejects: uppercase letters (use normalizeDomain() first), schemes (https://),
+  //   ports (:8080), single-label hostnames (localhost, metadata), query strings,
+  //   fragments, empty/trailing path segments, and any path segment starting with
+  //   a dot (blocks ./, ../, .hidden, ..foo, etc.).
+  // Path-qualified domains (nba.com/kings) are distinct sort-key values from the bare
+  //   hostname; callers must call normalizeDomain() before findByImsOrgIdAndDomain.
+  // Labels must not start or end with a hyphen (RFC 1035).
+  // Raw Unicode / IDN must be punycode-encoded before validation (xn-- form is accepted).
+  // Percent-encoded path characters (%20 etc.) are not accepted; decode before validation.
+  // Underscore is allowed in path segments but not in hostname labels.
+  static DOMAIN_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.(?:[a-z]{2,}|xn--[a-z0-9-]+)(\/(?!\.)[a-z0-9._~-]+)*$/;
+
+  // Returns the canonical form of a domain value: lowercased.
+  // Note: non-string inputs (null/undefined/number/object) are returned unchanged.
+  // Callers MUST also run `isValidDomain(value)` before using the result — calling
+  // `normalizeDomain` alone does not guarantee the value is a string or safe to
+  // pass to `findByImsOrgIdAndDomain` (which would otherwise treat a non-string
+  // sort key as something it isn't).
+  static normalizeDomain(value) {
+    return typeof value === 'string' ? value.toLowerCase() : value;
+  }
+
+  // Complete domain validator used by the schema and intended for external consumers.
+  // Layers a typeof guard, case-canonical check, control-character rejection,
+  // all-numeric-hostname rejection (defense-in-depth; DOMAIN_PATTERN's alphabetic-TLD
+  // requirement already rejects dotted-quad, short-form, decimal, hex, and octal IPs),
+  // trailing-dot path-segment rejection, DOMAIN_PATTERN test, and length caps.
+  // Note: DOMAIN_PATTERN alone is not sufficient — always prefer this method.
+  // Lowercase-only (host AND path) is intentional canonicalization, not a bug. The
+  // domain field is part of the dedup sort key on findByImsOrgIdAndDomain; allowing
+  // mixed-case paths would let `nba.com/Kings` and `nba.com/kings` create distinct
+  // onboarding rows for the same site. Callers should call normalizeDomain() first.
+  // This is a syntactic / data-integrity validator, not an SSRF gate. Callers that
+  // make outbound fetches must layer their own private-IP and DNS-resolution checks.
+  static isValidDomain(value) {
+    if (typeof value !== 'string' || value !== value.toLowerCase()) {
+      return false;
+    }
+    // Length caps run BEFORE the regex test so a multi-MB pathological input is
+    // rejected in O(1) rather than driving a multi-MB regex scan. The regex itself
+    // is linear (no overlapping quantifiers) but external consumers may not bound
+    // input size upstream.
+    if (value.length > PlgOnboarding.MAX_DOMAIN_LENGTH) {
+      return false;
+    }
+    if (/[^\x21-\x7e]/.test(value)) {
+      return false;
+    }
+    const [hostname, ...pathParts] = value.split('/');
+    if (hostname.length > PlgOnboarding.MAX_HOSTNAME_LENGTH) {
+      return false;
+    }
+    if (/^[\d.]+$/.test(hostname)) {
+      return false;
+    }
+    // Reject path segments that are purely dots, end with a dot, or contain
+    // consecutive dots (foo., foo.., foo../bar, v1..0). DOMAIN_PATTERN's
+    // negative lookahead only blocks segments STARTING with a dot.
+    if (pathParts.some((seg) => /\.$/.test(seg) || seg.includes('..'))) {
+      return false;
+    }
+    return PlgOnboarding.DOMAIN_PATTERN.test(value);
+  }
 
   static STATUSES = {
     PRE_ONBOARDING: 'PRE_ONBOARDING',

package/src/models/plg-onboarding/plg-onboarding.schema.js

@@ -28,7 +28,7 @@ const schema = new SchemaBuilder(PlgOnboarding, PlgOnboardingCollection)
     type: 'string',
     required: true,
     readOnly: true,
-    validate: (value) => PlgOnboarding.DOMAIN_PATTERN.test(value) && value.length <= 253,
+    validate: (value) => PlgOnboarding.isValidDomain(value),
   })
   .addAttribute('baseURL', {
     type: 'string',

package/src/models/site/config.js

@@ -524,6 +524,7 @@ export const Config = (data = {}) => {
   self.getIncludedURLs = (type) => state?.handlers?.[type]?.includedURLs;
   self.getGroupedURLs = (type) => state?.handlers?.[type]?.groupedURLs;
   self.getLatestMetrics = (type) => state?.handlers?.[type]?.latestMetrics;
+  self.getDefaults = () => state?.defaults;
   self.getFetchConfig = () => state?.fetchConfig;
   self.getBrandConfig = () => state?.brandConfig;
   self.getBrandProfile = () => state?.brandProfile;
@@ -995,6 +996,7 @@ Config.fromDynamoItem = (dynamoItem) => Config(dynamoItem);
 Config.toDynamoItem = (config) => ({
   slack: config.getSlackConfig(),
   handlers: config.getHandlers(),
+  defaults: config.getDefaults?.(),
   contentAiConfig: config.getContentAiConfig(),
   imports: config.getImports(),
   fetchConfig: config.getFetchConfig(),