@alliance-droid/status-feedback-system 4.1.5 → 4.2.0

package/dist/components/board/state.svelte.d.ts

@@ -15,7 +15,8 @@ export interface CategoryConfig {
 }
 export interface FeedbackBoardOptions {
     apiUrl: string;
-    apiKey: string;
+    /** Omit when apiUrl points at a same-origin proxy. */
+    apiKey?: string;
     categoryConfig?: Record<string, CategoryConfig>;
     /** Authenticated user email. Required for submitting feedback and replies. */
     userEmail?: string;

package/dist/components/board/state.svelte.js

@@ -9,7 +9,7 @@
 import { FEEDBACK_CATEGORY_ICONS } from '../../types.js';
 import { createStatusClient, } from '../../api.js';
 export function createFeedbackBoard(options) {
-    const { apiUrl, apiKey, categoryConfig = {}, userEmail, getAuthToken, pageSize = 50 } = options;
+    const { apiUrl, apiKey = '', categoryConfig = {}, userEmail, getAuthToken, pageSize = 50 } = options;
     const client = createStatusClient({ apiUrl, apiKey });
     const resolvedEmail = userEmail?.trim() || null;
     // Reactive state

package/dist/components/board/utils.d.ts

@@ -3,5 +3,11 @@ export declare function timeAgo(timestamp: number): string;
 import type { PublicStatus } from '../../types.js';
 /** Human label for a public board status. */
 export declare function publicStatusLabel(status: PublicStatus): string;
+/**
+ * Human label for an item's internal status. Falls back to a title-cased
+ * version of an unknown status value (e.g. a status added to the backend after
+ * this package was built) so the badge always shows something readable.
+ */
+export declare function internalStatusLabel(status: string): string;
 /** Map a public board status to a badge variant. */
 export declare function getStatusBadgeVariant(status: PublicStatus): 'success' | 'neutral' | 'info' | 'warning';

package/dist/components/board/utils.js

@@ -30,6 +30,42 @@ const PUBLIC_STATUS_VARIANTS = {
 export function publicStatusLabel(status) {
     return PUBLIC_STATUS_LABELS[status] ?? status;
 }
+/**
+ * Display labels for the backend's internal statuses. Mirrors `STATUS_META`
+ * (display) in status-feedback-admin's `status.ts`. Privileged users (who can
+ * manage status) see these precise labels; the public sees the coarser
+ * `publicStatus` bucket instead. `internalStatusLabel` degrades gracefully for
+ * any status not in this map, so drift only loses polish — never breaks.
+ */
+const INTERNAL_STATUS_LABELS = {
+    open: 'Open',
+    considering: 'Considering',
+    accepted: 'Accepted',
+    investigating: 'Investigating',
+    waiting_on_reply: 'Waiting on reply',
+    ready_to_start: 'Ready to start',
+    in_progress: 'In progress',
+    technical_review: 'Technical review',
+    qa_uat: 'QA / UAT',
+    reopened: 'Reopened',
+    resolved: 'Resolved',
+    wont_do: "Won't do",
+    duplicate: 'Duplicate',
+    cannot_reproduce: "Can't reproduce"
+};
+/**
+ * Human label for an item's internal status. Falls back to a title-cased
+ * version of an unknown status value (e.g. a status added to the backend after
+ * this package was built) so the badge always shows something readable.
+ */
+export function internalStatusLabel(status) {
+    if (INTERNAL_STATUS_LABELS[status])
+        return INTERNAL_STATUS_LABELS[status];
+    if (!status)
+        return '';
+    const spaced = status.replace(/_/g, ' ');
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
 /** Map a public board status to a badge variant. */
 export function getStatusBadgeVariant(status) {
     return PUBLIC_STATUS_VARIANTS[status] ?? 'neutral';

package/dist/sveltekit/server.d.ts

@@ -0,0 +1,85 @@
+/**
+ * SvelteKit server adapter for hiding status-feedback-admin project API keys
+ * behind a same-origin proxy route.
+ *
+ * Recommended consumer route:
+ *
+ *   // src/routes/svc/feedback/[...path]/+server.ts
+ *   import { createSvelteKitFeedbackProxy } from '@alliance-droid/status-feedback-system/sveltekit/server';
+ *
+ *   export const { GET, POST, PATCH } = createSvelteKitFeedbackProxy({
+ *     apiUrl: env.SF_API_URL,
+ *     apiKey: env.SF_API_KEY,
+ *     resolveUser,
+ *   });
+ */
+type MaybePromise<T> = T | Promise<T>;
+type ConfigValue = string | null | undefined | (() => MaybePromise<string | null | undefined>);
+export type FeedbackProxySource = 'default' | 'devFeedback';
+export type FeedbackProxyOperation = 'status' | 'incidents' | 'uptime' | 'submitFeedback' | 'board' | 'vote' | 'responses' | 'submitResponse' | 'transitions' | 'updateStatus';
+export interface FeedbackProxyUser {
+    email?: string | null;
+    roles?: readonly string[];
+}
+export interface SvelteKitFeedbackProxyEvent {
+    request: Request;
+    url: URL;
+    params?: Record<string, string | undefined>;
+    fetch?: typeof globalThis.fetch;
+}
+export interface FeedbackProxyContext<User> {
+    event: SvelteKitFeedbackProxyEvent;
+    user: User | null;
+    operation: FeedbackProxyOperation;
+    source: FeedbackProxySource;
+}
+export interface FeedbackProxyRequireUserContext {
+    event: SvelteKitFeedbackProxyEvent;
+    operation: FeedbackProxyOperation;
+    source: FeedbackProxySource;
+}
+export interface SvelteKitFeedbackProxyOptions<User = FeedbackProxyUser> {
+    /** Base URL of the status-feedback-admin app. Keep this server-side. */
+    apiUrl: ConfigValue;
+    /** Project API key. Keep this server-side. */
+    apiKey: ConfigValue;
+    /** Resolve the host app's authenticated user, or null when unauthenticated. */
+    resolveUser?: (event: SvelteKitFeedbackProxyEvent) => MaybePromise<User | null>;
+    /** Extract an email from the resolved user. Defaults to `user.email`. */
+    getUserEmail?: (user: User) => string | null | undefined;
+    /**
+     * Require an authenticated user before proxying. Use `true` for private apps,
+     * or a callback when public status reads should remain anonymous.
+     */
+    requireUser?: boolean | ((context: FeedbackProxyRequireUserContext) => MaybePromise<boolean>);
+    /**
+     * Additional host-app authorization. Return false for a standard 403 or a
+     * Response for a custom denial body/status.
+     */
+    authorize?: (context: FeedbackProxyContext<User>) => MaybePromise<boolean | Response | void>;
+    /**
+     * Extra gate for DevFeedback submissions. Triggered for requests under a
+     * `dev/` prefix, such as `/svc/feedback/dev/api/feedback`.
+     */
+    canSubmitInAppFeedback?: (context: FeedbackProxyContext<User>) => MaybePromise<boolean>;
+    /**
+     * When true, feedback `email` and response `author` are derived from the
+     * authenticated user. Defaults to true when `resolveUser` is supplied.
+     */
+    deriveUserFields?: boolean;
+    /** Rest parameter name used by the SvelteKit catch-all route. Default: path. */
+    pathParam?: string;
+    /** Optional fetch override for tests. Defaults to event.fetch, then global fetch. */
+    fetch?: typeof globalThis.fetch;
+}
+export interface SvelteKitFeedbackProxyHandlers {
+    GET: (event: SvelteKitFeedbackProxyEvent) => Promise<Response>;
+    POST: (event: SvelteKitFeedbackProxyEvent) => Promise<Response>;
+    PATCH: (event: SvelteKitFeedbackProxyEvent) => Promise<Response>;
+}
+export declare function createSvelteKitFeedbackProxy<User = FeedbackProxyUser>(options: SvelteKitFeedbackProxyOptions<User>): SvelteKitFeedbackProxyHandlers;
+export declare function isFeedbackProxyConfigured(config: {
+    apiUrl: string | null | undefined;
+    apiKey: string | null | undefined;
+}): boolean;
+export {};

package/dist/sveltekit/server.js

@@ -0,0 +1,383 @@
+/**
+ * SvelteKit server adapter for hiding status-feedback-admin project API keys
+ * behind a same-origin proxy route.
+ *
+ * Recommended consumer route:
+ *
+ *   // src/routes/svc/feedback/[...path]/+server.ts
+ *   import { createSvelteKitFeedbackProxy } from '@alliance-droid/status-feedback-system/sveltekit/server';
+ *
+ *   export const { GET, POST, PATCH } = createSvelteKitFeedbackProxy({
+ *     apiUrl: env.SF_API_URL,
+ *     apiKey: env.SF_API_KEY,
+ *     resolveUser,
+ *   });
+ */
+const INCIDENT_QUERY_KEYS = ['limit', 'includeResolved'];
+const UPTIME_QUERY_KEYS = ['days'];
+const BOARD_QUERY_KEYS = ['category', 'status', 'sort', 'limit', 'offset'];
+export function createSvelteKitFeedbackProxy(options) {
+    return {
+        GET: (event) => handleProxyRequest(event, options),
+        POST: (event) => handleProxyRequest(event, options),
+        PATCH: (event) => handleProxyRequest(event, options),
+    };
+}
+export function isFeedbackProxyConfigured(config) {
+    return Boolean(config.apiUrl?.trim() && config.apiKey?.trim());
+}
+async function handleProxyRequest(event, options) {
+    const resolvedPath = getResolvedPath(event, options.pathParam ?? 'path');
+    const route = getRouteSpec(event.request.method, resolvedPath.path);
+    if (!route)
+        return feedbackError(404, 'Feedback endpoint not found');
+    const config = await getResolvedConfig(options);
+    if (!config)
+        return feedbackError(503, 'Feedback service is not configured');
+    const user = options.resolveUser ? await options.resolveUser(event) : null;
+    const requireUser = await shouldRequireUser(event, options, route.operation, resolvedPath.source);
+    if (requireUser && !user)
+        return feedbackError(401, 'Unauthorized');
+    const authResponse = await authorizeRequest(event, options, user, route.operation, resolvedPath.source);
+    if (authResponse)
+        return authResponse;
+    if (resolvedPath.source === 'devFeedback' && route.operation === 'submitFeedback') {
+        if (!user)
+            return feedbackError(401, 'Unauthorized');
+        if (options.canSubmitInAppFeedback) {
+            const allowed = await options.canSubmitInAppFeedback({
+                event,
+                user,
+                operation: route.operation,
+                source: resolvedPath.source,
+            });
+            if (!allowed) {
+                return feedbackError(403, 'Forbidden: in-app feedback is not allowed for this user');
+            }
+        }
+    }
+    const upstreamUrl = buildUpstreamUrl(config.apiUrl, route.upstreamPath, copyAllowedSearchParams(event.url.searchParams, route.allowedSearchParams ?? []));
+    const headers = new Headers({
+        Accept: 'application/json',
+        'x-api-key': config.apiKey,
+    });
+    if (route.forwardBearerToken) {
+        const authorization = event.request.headers.get('authorization');
+        if (!authorization?.toLowerCase().startsWith('bearer ')) {
+            return feedbackError(401, 'Status feedback access token required');
+        }
+        headers.set('Authorization', authorization);
+    }
+    const method = event.request.method.toUpperCase();
+    let body;
+    if (method !== 'GET' && method !== 'HEAD') {
+        headers.set('Content-Type', 'application/json');
+        const parsedBody = await parseProxyBody(event, options, route.bodyKind, user);
+        if (parsedBody instanceof Response)
+            return parsedBody;
+        body = JSON.stringify(parsedBody);
+    }
+    try {
+        const fetchFn = options.fetch ?? event.fetch ?? globalThis.fetch;
+        const upstreamResponse = await fetchFn(upstreamUrl, {
+            method,
+            headers,
+            body,
+        });
+        return await toProxyResponse(upstreamResponse);
+    }
+    catch {
+        return feedbackError(502, 'Feedback service request failed');
+    }
+}
+function getResolvedPath(event, pathParam) {
+    let path = event.params?.[pathParam] ?? '';
+    path = trimSlashes(path);
+    let source = 'default';
+    if (path === 'dev' || path.startsWith('dev/')) {
+        source = 'devFeedback';
+        path = trimSlashes(path.slice(3));
+    }
+    return { path, source };
+}
+function getRouteSpec(method, path) {
+    const normalizedMethod = method.toUpperCase();
+    const normalizedPath = normalizeApiPath(path);
+    if (normalizedMethod === 'GET' && normalizedPath === 'api/status') {
+        return { operation: 'status', upstreamPath: '/api/status', bodyKind: 'none' };
+    }
+    if (normalizedMethod === 'GET' && normalizedPath === 'api/incidents') {
+        return {
+            operation: 'incidents',
+            upstreamPath: '/api/incidents',
+            bodyKind: 'none',
+            allowedSearchParams: INCIDENT_QUERY_KEYS,
+        };
+    }
+    if (normalizedMethod === 'GET' && normalizedPath === 'api/uptime') {
+        return {
+            operation: 'uptime',
+            upstreamPath: '/api/uptime',
+            bodyKind: 'none',
+            allowedSearchParams: UPTIME_QUERY_KEYS,
+        };
+    }
+    if (normalizedMethod === 'POST' && normalizedPath === 'api/feedback') {
+        return { operation: 'submitFeedback', upstreamPath: '/api/feedback', bodyKind: 'feedback' };
+    }
+    if (normalizedMethod === 'GET' && normalizedPath === 'api/board') {
+        return {
+            operation: 'board',
+            upstreamPath: '/api/board',
+            bodyKind: 'none',
+            allowedSearchParams: BOARD_QUERY_KEYS,
+        };
+    }
+    if (normalizedMethod === 'POST' && normalizedPath === 'api/board/vote') {
+        return { operation: 'vote', upstreamPath: '/api/board/vote', bodyKind: 'vote' };
+    }
+    const responsesMatch = /^api\/board\/([^/]+)\/responses$/.exec(normalizedPath);
+    if (responsesMatch && normalizedMethod === 'GET') {
+        return {
+            operation: 'responses',
+            upstreamPath: `/api/board/${encodeURIComponent(responsesMatch[1])}/responses`,
+            bodyKind: 'none',
+        };
+    }
+    if (responsesMatch && normalizedMethod === 'POST') {
+        return {
+            operation: 'submitResponse',
+            upstreamPath: `/api/board/${encodeURIComponent(responsesMatch[1])}/responses`,
+            bodyKind: 'response',
+        };
+    }
+    const transitionsMatch = /^api\/board\/feedback\/([^/]+)\/transitions$/.exec(normalizedPath);
+    if (transitionsMatch && normalizedMethod === 'GET') {
+        return {
+            operation: 'transitions',
+            upstreamPath: `/api/board/feedback/${encodeURIComponent(transitionsMatch[1])}/transitions`,
+            bodyKind: 'none',
+            forwardBearerToken: true,
+        };
+    }
+    const statusMatch = /^api\/board\/feedback\/([^/]+)\/status$/.exec(normalizedPath);
+    if (statusMatch && normalizedMethod === 'PATCH') {
+        return {
+            operation: 'updateStatus',
+            upstreamPath: `/api/board/feedback/${encodeURIComponent(statusMatch[1])}/status`,
+            bodyKind: 'status',
+            forwardBearerToken: true,
+        };
+    }
+    return null;
+}
+function normalizeApiPath(path) {
+    const normalized = trimSlashes(path);
+    if (!normalized)
+        return 'api';
+    return normalized.startsWith('api/') ? normalized : `api/${normalized}`;
+}
+async function getResolvedConfig(options) {
+    const apiUrl = (await resolveConfigValue(options.apiUrl))?.trim().replace(/\/+$/, '');
+    const apiKey = (await resolveConfigValue(options.apiKey))?.trim();
+    if (!apiUrl || !apiKey)
+        return null;
+    return { apiUrl, apiKey };
+}
+async function resolveConfigValue(value) {
+    return typeof value === 'function' ? value() : value;
+}
+async function shouldRequireUser(event, options, operation, source) {
+    if (typeof options.requireUser === 'function') {
+        return options.requireUser({ event, operation, source });
+    }
+    return options.requireUser ?? false;
+}
+async function authorizeRequest(event, options, user, operation, source) {
+    if (!options.authorize)
+        return null;
+    const result = await options.authorize({ event, user, operation, source });
+    if (result instanceof Response)
+        return result;
+    if (result === false)
+        return feedbackError(403, 'Forbidden');
+    return null;
+}
+function copyAllowedSearchParams(source, allowedKeys) {
+    const result = new URLSearchParams();
+    for (const key of allowedKeys) {
+        if (key === 'key')
+            continue;
+        const value = source.get(key);
+        if (value !== null)
+            result.set(key, value);
+    }
+    return result;
+}
+function buildUpstreamUrl(apiUrl, upstreamPath, searchParams) {
+    const upstreamUrl = new URL(upstreamPath.replace(/^\/+/, ''), `${apiUrl}/`);
+    for (const [key, value] of searchParams) {
+        if (key === 'key')
+            continue;
+        upstreamUrl.searchParams.set(key, value);
+    }
+    return upstreamUrl;
+}
+async function parseProxyBody(event, options, bodyKind, user) {
+    if (bodyKind === 'none')
+        return {};
+    let rawBody;
+    try {
+        rawBody = await event.request.json();
+    }
+    catch {
+        return feedbackError(400, 'Invalid JSON body');
+    }
+    try {
+        const deriveUserFields = options.deriveUserFields ?? Boolean(options.resolveUser);
+        if (bodyKind === 'feedback') {
+            const body = parseFeedbackBody(rawBody);
+            if (deriveUserFields) {
+                const email = getResolvedUserEmail(options, user);
+                if (!email)
+                    return feedbackError(403, 'Authenticated user email required');
+                body.email = email;
+            }
+            return body;
+        }
+        if (bodyKind === 'vote')
+            return parseVoteBody(rawBody);
+        if (bodyKind === 'response') {
+            const body = parseResponseBody(rawBody);
+            if (deriveUserFields) {
+                const email = getResolvedUserEmail(options, user);
+                if (!email)
+                    return feedbackError(403, 'Authenticated user email required');
+                body.author = email;
+            }
+            return body;
+        }
+        return parseStatusBody(rawBody);
+    }
+    catch {
+        return feedbackError(400, 'Invalid feedback request');
+    }
+}
+function getResolvedUserEmail(options, user) {
+    if (!user)
+        return null;
+    const email = options.getUserEmail
+        ? options.getUserEmail(user)
+        : user.email;
+    const normalized = email?.trim();
+    return normalized || null;
+}
+function parseFeedbackBody(rawBody) {
+    const body = requireRecord(rawBody);
+    const result = {
+        message: requireString(body, 'message', 1, 20_000),
+    };
+    assignOptionalString(result, body, 'title', 500);
+    assignOptionalString(result, body, 'category', 100);
+    assignOptionalString(result, body, 'pageUrl', 2_048);
+    assignOptionalString(result, body, 'email', 320);
+    if (body.metadata !== undefined) {
+        if (!isRecord(body.metadata))
+            throw new Error('Invalid metadata');
+        result.metadata = body.metadata;
+    }
+    return result;
+}
+function parseVoteBody(rawBody) {
+    const body = requireRecord(rawBody);
+    const result = {
+        feedbackId: requireString(body, 'feedbackId', 1, 200),
+    };
+    if (body.direction !== undefined) {
+        const direction = requireString(body, 'direction', 1, 10);
+        if (direction !== 'up' && direction !== 'down')
+            throw new Error('Invalid direction');
+        result.direction = direction;
+    }
+    return result;
+}
+function parseResponseBody(rawBody) {
+    const body = requireRecord(rawBody);
+    const result = {
+        message: requireString(body, 'message', 1, 20_000),
+    };
+    assignOptionalString(result, body, 'author', 320);
+    assignOptionalString(result, body, 'pastedImage');
+    return result;
+}
+function parseStatusBody(rawBody) {
+    const body = requireRecord(rawBody);
+    const result = {
+        status: requireString(body, 'status', 1, 100),
+    };
+    assignOptionalString(result, body, 'reason', 2_000);
+    return result;
+}
+function requireRecord(value) {
+    if (!isRecord(value))
+        throw new Error('Expected object');
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requireString(body, key, minLength, maxLength) {
+    const value = body[key];
+    if (typeof value !== 'string')
+        throw new Error(`Invalid ${key}`);
+    const trimmed = value.trim();
+    if (trimmed.length < minLength)
+        throw new Error(`Invalid ${key}`);
+    if (maxLength !== undefined && trimmed.length > maxLength)
+        throw new Error(`Invalid ${key}`);
+    return trimmed;
+}
+function assignOptionalString(target, body, key, maxLength) {
+    const value = body[key];
+    if (value === undefined)
+        return;
+    if (value === null) {
+        target[key] = null;
+        return;
+    }
+    if (typeof value !== 'string')
+        throw new Error(`Invalid ${key}`);
+    const trimmed = value.trim();
+    if (maxLength !== undefined && trimmed.length > maxLength)
+        throw new Error(`Invalid ${key}`);
+    target[key] = trimmed;
+}
+async function toProxyResponse(upstreamResponse) {
+    const body = await upstreamResponse.arrayBuffer();
+    const headers = new Headers({
+        'Cache-Control': 'no-store',
+    });
+    const contentType = upstreamResponse.headers.get('content-type');
+    if (contentType)
+        headers.set('Content-Type', contentType);
+    return new Response(body, {
+        status: upstreamResponse.status,
+        headers,
+    });
+}
+function feedbackError(status, message) {
+    return new Response(JSON.stringify({
+        success: false,
+        error: message,
+        message,
+    }), {
+        status,
+        headers: {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+        },
+    });
+}
+function trimSlashes(value) {
+    return value.replace(/^\/+|\/+$/g, '');
+}