@adonis-agora/telescope 0.10.0 → 0.12.0

package/dist/src/ui/login_page.js

@@ -1,27 +1,26 @@
+import { escapeHtml } from './access_denied_page.js';
+import { sanitizeReturnTo } from './auth.js';
 /**
- * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
- * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
- * dashboard shell doesn't require rebuilding or extending the bundled Vite app.
- *
- * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
- * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
- * controlled config value, not user input — and the page body is otherwise a static template.
- * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
- * to get wrong.
- *
- * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
- * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
- * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
- * markup keeps its own `<script>`.
- *
- * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
- * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
- * email-only host (gate on username, ignore password) works with the same page as a host with real
- * passwords.
+ * JSON for embedding INSIDE an inline `<script>`: `JSON.stringify` alone leaves `</script>` (and
+ * `<!--`) untouched, and the HTML parser ends the script element on the first `</script>` it sees
+ * regardless of JavaScript string boundaries — so a `returnTo` of `/x</script><script>…` would run.
+ * Escaping the angle brackets (and `&`, plus the two line terminators JSON allows but JS doesn't)
+ * as `\uXXXX` keeps the value byte-identical once parsed and inert to the HTML parser.
  */
-export function renderLoginPage(basePath) {
+function jsonForScript(value) {
+    return JSON.stringify(value)
+        .replaceAll('<', '\\u003c')
+        .replaceAll('>', '\\u003e')
+        .replaceAll('&', '\\u0026')
+        .replaceAll('\u2028', '\\u2028')
+        .replaceAll('\u2029', '\\u2029');
+}
+export function renderLoginPage(basePath, options = {}) {
     const loginAction = `${basePath}/login`;
     const defaultReturnTo = basePath === '' ? '/' : basePath;
+    const returnTo = sanitizeReturnTo(options.returnTo, defaultReturnTo);
+    const nonceAttr = options.nonce !== undefined ? ` nonce="${escapeHtml(options.nonce)}"` : '';
+    const errorStyle = options.error ? ' style="display:block"' : '';
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -29,7 +28,7 @@ export function renderLoginPage(basePath) {
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex, nofollow" />
 <title>Sign in — Telescope</title>
-<style>
+<style${nonceAttr}>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
   body {
@@ -104,7 +103,8 @@ export function renderLoginPage(basePath) {
 <body>
   <div class="card">
     <p class="brand">Telescope</p>
-    <form id="login-form" autocomplete="on">
+    <form id="login-form" method="post" action="${escapeHtml(loginAction)}" autocomplete="on">
+      <input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}" />
       <label>
         <span class="field-label">Username</span>
         <input id="username" name="username" type="text" autocomplete="username" required autofocus />
@@ -113,41 +113,29 @@ export function renderLoginPage(basePath) {
         <span class="field-label">Password</span>
         <input id="password" name="password" type="password" autocomplete="current-password" />
       </label>
-      <p id="error" role="alert">Invalid username or password.</p>
+      <p id="error" role="alert"${errorStyle}>Invalid username or password.</p>
       <button id="submit" type="submit">Sign in</button>
     </form>
   </div>
-<script>
+<script${nonceAttr}>
 (function () {
-  var LOGIN_ACTION = ${JSON.stringify(loginAction)};
-  var DEFAULT_RETURN_TO = ${JSON.stringify(defaultReturnTo)};
-  var params = new URLSearchParams(window.location.search);
+  var LOGIN_ACTION = ${jsonForScript(loginAction)};
+  var RETURN_TO = ${jsonForScript(returnTo)};
   var errorBox = document.getElementById('error');
-  if (params.get('error')) errorBox.style.display = 'block';
-
-  function sameOriginReturnTo(value) {
-    if (typeof value !== 'string' || value === '') return DEFAULT_RETURN_TO;
-    if (value.charAt(0) !== '/' || value.charAt(1) === '/' || value.indexOf('://') !== -1) {
-      return DEFAULT_RETURN_TO;
-    }
-    return value;
-  }
-
   var form = document.getElementById('login-form');
   var submitButton = document.getElementById('submit');
   form.addEventListener('submit', function (event) {
     event.preventDefault();
     submitButton.disabled = true;
     errorBox.style.display = 'none';
-    var returnTo = sameOriginReturnTo(params.get('returnTo'));
     fetch(LOGIN_ACTION, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
       credentials: 'same-origin',
       body: JSON.stringify({
         username: document.getElementById('username').value,
         password: document.getElementById('password').value,
-        returnTo: returnTo,
+        returnTo: RETURN_TO,
       }),
     })
       .then(function (response) {
@@ -155,7 +143,7 @@ export function renderLoginPage(basePath) {
         return response.json();
       })
       .then(function (data) {
-        window.location.href = data.redirectTo || DEFAULT_RETURN_TO;
+        window.location.href = data.redirectTo || RETURN_TO;
       })
       .catch(function () {
         errorBox.style.display = 'block';

package/dist/src/ui/login_page.js.map

@@ -1 +1 @@
-{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/ui/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAiGc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6CnD,CAAC;AACT,CAAC"}
+{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/ui/login_page.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAqC7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;SAC/B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAO,GAAqB,EAAE;IAC9E,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO;;;;;;;QAOD,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2EiC,UAAU,CAAC,WAAW,CAAC;oDACrB,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;kCAStC,UAAU;;;;SAInC,SAAS;;uBAEK,aAAa,CAAC,WAAW,CAAC;oBAC7B,aAAa,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCnC,CAAC;AACT,CAAC"}

package/dist/src/watchers/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.10.0";
+export declare const VERSION = "0.12.0";
 export type { CacheEntryContent, CacheEventLike, CacheOperation } from './cache_watcher.js';
 export { buildCacheEntry, CACHE_EVENTS, CacheWatcher } from './cache_watcher.js';
 export { nextCronRunMs } from './cron_next_run.js';

package/dist/src/watchers/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.10.0';
+export const VERSION = '0.12.0';
 // — cache watcher —
 export { buildCacheEntry, CACHE_EVENTS, CacheWatcher } from './cache_watcher.js';
 export { nextCronRunMs } from './cron_next_run.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/telescope",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Laravel Telescope-style headless observability for AdonisJS — records HTTP requests and every Agora diagnostics event as queryable entries, plus opt-in subpaths for per-technology watchers, a web dashboard, AI exception diagnosis, and alerting.",
   "license": "MIT",
   "repository": {