@antelopejs/dms 0.5.6 → 0.6.1

package/frontend-vue/layers/dms-core/app/utils/regional.ts

@@ -0,0 +1,269 @@
+/** `h23`: 24-hour clock (14:05); `h12`: 12-hour clock (2:05 PM). */
+export type TimeFormatPreference = "h23" | "h12";
+
+/** `numeric`: 01/10/2026; `text`: the month as a word (1 Oct 2026). */
+export type DateFormatPreference = "numeric" | "text";
+
+/** First day of the week: 0 Sunday, 1 Monday, 6 Saturday. */
+export type WeekStartPreference = 0 | 1 | 6;
+
+/**
+ * How the signed-in user wants dates and times written. An unset field is
+ * automatic: the browser's time zone, the language's week and clock, and each
+ * screen's own date format.
+ */
+export interface RegionalPreferences {
+  timeZone?: string;
+  weekStart?: WeekStartPreference;
+  timeFormat?: TimeFormatPreference;
+  dateFormat?: DateFormatPreference;
+}
+
+/** The regional fields as the session user carries them. */
+export interface RegionalPreferenceFields {
+  timeZone?: unknown;
+  weekStart?: unknown;
+  timeFormat?: unknown;
+  dateFormat?: unknown;
+}
+
+export interface RegionalOptionsSettings {
+  /**
+   * Keep the browser's time zone. For values that are calendar days computed
+   * in the browser (a date picker's day, a period's bounds): moving them to
+   * another zone would show the day before or after.
+   */
+  keepLocalZone?: boolean;
+}
+
+type PreferencesSource = () => RegionalPreferences;
+
+const WEEK_STARTS: readonly number[] = [0, 1, 6];
+const TIME_FORMATS: readonly string[] = ["h23", "h12"];
+const DATE_FORMATS: readonly string[] = ["numeric", "text"];
+const TEXT_MONTHS: readonly string[] = ["long", "short", "narrow"];
+const NUMERIC_MONTHS: readonly string[] = ["numeric", "2-digit"];
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MONDAY = 1;
+const DAYS_PER_WEEK = 7;
+
+/** `timeStyle` as the fields it stands for, when a date format replaces `dateStyle`. */
+const TIME_STYLE_FIELDS: Record<string, Intl.DateTimeFormatOptions> = {
+  full: { hour: "2-digit", minute: "2-digit", second: "2-digit" },
+  long: { hour: "2-digit", minute: "2-digit", second: "2-digit" },
+  medium: { hour: "2-digit", minute: "2-digit", second: "2-digit" },
+  short: { hour: "2-digit", minute: "2-digit" },
+};
+
+const NUMERIC_DATE: Intl.DateTimeFormatOptions = {
+  day: "2-digit",
+  month: "2-digit",
+  year: "numeric",
+};
+
+const knownTimeZones = new Map<string, boolean>();
+let preferencesSource: PreferencesSource | undefined;
+
+/** Whether the runtime knows `timeZone` (an unknown one would throw in Intl). */
+export function isKnownTimeZone(timeZone: string): boolean {
+  const known = knownTimeZones.get(timeZone);
+  if (known !== undefined) return known;
+  let isKnown = true;
+  try {
+    new Intl.DateTimeFormat("en", { timeZone });
+  } catch {
+    isKnown = false;
+  }
+  knownTimeZones.set(timeZone, isKnown);
+  return isKnown;
+}
+
+/** The time zone the browser (or the server, while rendering) runs in. */
+export function browserTimeZone(): string {
+  return new Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+
+const pickFrom = <T>(allowed: readonly unknown[], value: unknown) =>
+  allowed.includes(value) ? (value as T) : undefined;
+
+/**
+ * Keeps the regional preferences of a session user that this runtime can
+ * apply, so a stale or hand-edited value never makes a date throw.
+ */
+export function readRegionalPreferences(
+  fields: RegionalPreferenceFields | null | undefined,
+): RegionalPreferences {
+  if (!fields) return {};
+  const timeZone =
+    typeof fields.timeZone === "string" && isKnownTimeZone(fields.timeZone)
+      ? fields.timeZone
+      : undefined;
+  return {
+    timeZone,
+    weekStart: pickFrom<WeekStartPreference>(WEEK_STARTS, fields.weekStart),
+    timeFormat: pickFrom<TimeFormatPreference>(TIME_FORMATS, fields.timeFormat),
+    dateFormat: pickFrom<DateFormatPreference>(DATE_FORMATS, fields.dateFormat),
+  };
+}
+
+/**
+ * Tells the shared formatters where to read the current user's preferences.
+ * The source is called on every format, so on the server it resolves the
+ * request being rendered rather than a value captured once.
+ */
+export function setRegionalPreferencesSource(source: PreferencesSource): void {
+  preferencesSource = source;
+}
+
+/** The current user's preferences; none outside an application. */
+export function currentRegionalPreferences(): RegionalPreferences {
+  try {
+    return preferencesSource?.() ?? {};
+  } catch {
+    return {};
+  }
+}
+
+const hasTime = (options: Intl.DateTimeFormatOptions): boolean =>
+  options.hour !== undefined || options.timeStyle !== undefined;
+
+const isFullDate = (options: Intl.DateTimeFormatOptions): boolean =>
+  options.day !== undefined &&
+  options.year !== undefined &&
+  options.weekday === undefined;
+
+function toNumericDate(
+  options: Intl.DateTimeFormatOptions,
+): Intl.DateTimeFormatOptions {
+  if (options.dateStyle && options.dateStyle !== "short") {
+    const { dateStyle: _dateStyle, timeStyle, ...rest } = options;
+    return {
+      ...rest,
+      ...NUMERIC_DATE,
+      ...(timeStyle ? TIME_STYLE_FIELDS[timeStyle] : {}),
+    };
+  }
+  if (isFullDate(options) && TEXT_MONTHS.includes(options.month ?? "")) {
+    return { ...options, ...NUMERIC_DATE };
+  }
+  return options;
+}
+
+function toTextDate(
+  options: Intl.DateTimeFormatOptions,
+): Intl.DateTimeFormatOptions {
+  if (options.dateStyle === "short") return { ...options, dateStyle: "medium" };
+  if (isFullDate(options) && NUMERIC_MONTHS.includes(options.month ?? "")) {
+    return { ...options, month: "short" };
+  }
+  return options;
+}
+
+const DATE_FORMAT_REWRITES: Record<
+  DateFormatPreference,
+  (options: Intl.DateTimeFormatOptions) => Intl.DateTimeFormatOptions
+> = {
+  numeric: toNumericDate,
+  text: toTextDate,
+};
+
+/**
+ * Adds the user's preferences to a set of `Intl.DateTimeFormat` options. What
+ * the caller states explicitly wins: a given `timeZone`, `hour12` or
+ * `hourCycle` is kept. The date format only rewrites full dates (day, month
+ * and year), never a "Sep 27" or a weekday.
+ *
+ * @param options What the screen asks for
+ * @param settings `keepLocalZone` for calendar days computed in the browser
+ * @param preferences Defaults to the current user's
+ */
+export function withRegionalOptions(
+  options: Intl.DateTimeFormatOptions,
+  settings: RegionalOptionsSettings = {},
+  preferences: RegionalPreferences = currentRegionalPreferences(),
+): Intl.DateTimeFormatOptions {
+  let result = preferences.dateFormat
+    ? DATE_FORMAT_REWRITES[preferences.dateFormat](options)
+    : { ...options };
+  if (preferences.timeZone && !settings.keepLocalZone && !result.timeZone) {
+    result = { ...result, timeZone: preferences.timeZone };
+  }
+  const statesClock =
+    result.hour12 !== undefined || result.hourCycle !== undefined;
+  if (preferences.timeFormat && hasTime(result) && !statesClock) {
+    result = { ...result, hourCycle: preferences.timeFormat };
+  }
+  return result;
+}
+
+/** `new Intl.DateTimeFormat` with the user's preferences applied. */
+export function regionalDateTimeFormat(
+  locale: string,
+  options: Intl.DateTimeFormatOptions,
+  settings?: RegionalOptionsSettings,
+): Intl.DateTimeFormat {
+  return new Intl.DateTimeFormat(
+    locale,
+    withRegionalOptions(options, settings),
+  );
+}
+
+/**
+ * The calendar day `date` falls on in the user's time zone, as a day count
+ * since the epoch: two dates share a day when their numbers are equal, and
+ * the difference of two numbers is the number of days between them.
+ */
+export function regionalDayNumber(
+  date: Date,
+  preferences: RegionalPreferences = currentRegionalPreferences(),
+): number {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: preferences.timeZone,
+    year: "numeric",
+    month: "numeric",
+    day: "numeric",
+  }).formatToParts(date);
+  const read = (type: Intl.DateTimeFormatPartTypes) =>
+    Number(parts.find((part) => part.type === type)?.value ?? 0);
+  return Date.UTC(read("year"), read("month") - 1, read("day")) / DAY_MS;
+}
+
+/** `YYYY-MM-DD` of the day `date` falls on in the user's time zone. */
+export function regionalDayKey(date: Date): string {
+  return new Date(regionalDayNumber(date) * DAY_MS).toISOString().slice(0, 10);
+}
+
+interface WeekInfo {
+  firstDay: number;
+}
+
+type LocaleWithWeekInfo = Intl.Locale & {
+  getWeekInfo?: () => WeekInfo;
+  weekInfo?: WeekInfo;
+};
+
+/**
+ * First day of the week of a locale (0 = Sunday … 6 = Saturday). A locale
+ * with a region answers for itself where the runtime exposes week data; a
+ * bare language tag ("en", "fr") stands for the DMS locales, en-GB and
+ * fr-FR, which both start on Monday.
+ */
+export function localeWeekStart(locale: string): number {
+  try {
+    const info = new Intl.Locale(locale) as LocaleWithWeekInfo;
+    if (!info.region) return MONDAY;
+    const weekInfo = info.getWeekInfo?.() ?? info.weekInfo;
+    if (weekInfo) return weekInfo.firstDay % DAYS_PER_WEEK;
+  } catch {
+    // An unknown tag falls back to Monday.
+  }
+  return MONDAY;
+}
+
+/** The user's first day of the week, else the locale's. */
+export function regionalWeekStart(
+  locale: string,
+  preferences: RegionalPreferences = currentRegionalPreferences(),
+): number {
+  return preferences.weekStart ?? localeWeekStart(locale);
+}

package/frontend-vue/layers/dms-core/app/utils/url-interpolation.ts

@@ -1,16 +1,37 @@
 import { get } from "@nuxt/ui/runtime/utils/index.js";
 
 const VARIABLE_PATTERN = /{([^}]+)}/g;
+// A colon is a valid path character (RFC 3986 pchar) and the API router
+// matches path parameters without decoding them: tenant-scoped ids
+// ("default:<uuid>") must reach a `/:id/...` route as they are.
+const ENCODED_COLON = /%3A/gi;
 
+const SCHEME_PATTERN = /^\s*([a-z][a-z0-9+.-]*):/i;
+const SAFE_SCHEMES: ReadonlySet<string> = new Set(["http", "https", "mailto"]);
+const REFUSED_URL = "";
+
+// The colon survives the encoding, so a template starting with a field
+// (`{website}`) takes its scheme from row data: `javascript:` must not reach
+// a link or `location.href`.
+function hasSafeScheme(url: string): boolean {
+  const scheme = SCHEME_PATTERN.exec(url)?.[1];
+  return scheme === undefined || SAFE_SCHEMES.has(scheme.toLowerCase());
+}
+
+/**
+ * Fills `{field}` placeholders of a URL template with encoded row values. A
+ * result with a scheme other than http, https or mailto comes back empty.
+ */
 export const interpolateUrl = (
   url: string,
   data: Record<string, unknown>,
 ): string => {
-  return url.replace(VARIABLE_PATTERN, (_, key: string) => {
+  const interpolated = url.replace(VARIABLE_PATTERN, (_, key: string) => {
     const value = get(data, key);
     if (value === undefined || value === null) {
       return "";
     }
-    return encodeURIComponent(String(value));
+    return encodeURIComponent(String(value)).replace(ENCODED_COLON, ":");
   });
+  return hasSafeScheme(interpolated) ? interpolated : REFUSED_URL;
 };

package/frontend-vue/layers/dms-core/i18n/locales/core-en-GB.json

@@ -395,21 +395,39 @@
     "showing_entries": "Showing {shown} of {total}"
   },
   "dms": {
+    "field_errors": {
+      "required": "This field is required.",
+      "invalid": "This value isn’t valid.",
+      "invalid_email": "Enter a valid email address.",
+      "too_long": "This value is too long.",
+      "too_short": "This value is too short.",
+      "too_small": "This value is too small.",
+      "too_large": "This value is too large.",
+      "with_values": "{message}: {values}",
+      "code_incomplete": "Enter every digit of the code.",
+      "password_rules": "The password doesn’t meet every rule.",
+      "invalid_duration": "Enter a duration such as 1h30m or 01:30.",
+      "range_incomplete": "Pick the end of the range too.",
+      "invalid_json": "This isn’t valid JSON.",
+      "key_missing": "Give every value a name.",
+      "key_duplicate": "Each name can appear only once."
+    },
     "confirm": {
-      "unsaved_changes_title": "Unsaved changes",
-      "unsaved_changes_description": "You have unsaved changes. Are you sure you want to leave? Your changes will be lost.",
-      "discard": "Discard",
-      "stay": "Stay",
       "confirm": "Confirm",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "esc_hint": "to cancel",
+      "type_to_confirm": "Type {text} to confirm",
+      "type_mismatch": "The text doesn’t match. Type {text} exactly.",
+      "close": "Close",
+      "esc_close_hint": "to close"
     },
     "date": {
       "undefined": "Unknown"
     },
     "components": {
       "tableview": "📄 TableView",
-      "tree": "🎋 Tree",
-      "tab": "🗂️ Tab"
+      "tab": "🗂️ Tab",
+      "global": "🌐 Global"
     },
     "chart": {
       "no_data": "No data",
@@ -442,6 +460,27 @@
         "previous-period": "vs previous period",
         "previous-year": "vs previous year",
         "custom": "Custom"
+      },
+      "compare_options": {
+        "none": "No comparison",
+        "previous-period": "Previous period",
+        "previous-year": "Previous year",
+        "custom": "Custom"
+      },
+      "popover": {
+        "dialog_aria": "Choose period",
+        "presets": "Presets",
+        "custom_range": "Custom range",
+        "start": "Start",
+        "end": "End",
+        "compare_to": "Compare to",
+        "cancel": "Cancel",
+        "apply": "Apply",
+        "vs": "vs",
+        "days": "{count} day | {count} days",
+        "hours": "{count} hour | {count} hours",
+        "previous_month": "Previous month",
+        "next_month": "Next month"
       }
     }
   }

package/frontend-vue/layers/dms-core/i18n/locales/core-fr-FR.json

@@ -395,21 +395,39 @@
     "showing_entries": "Affiché {shown} sur {total}"
   },
   "dms": {
+    "field_errors": {
+      "required": "Ce champ est obligatoire.",
+      "invalid": "Cette valeur n’est pas valide.",
+      "invalid_email": "Saisissez une adresse e-mail valide.",
+      "too_long": "Cette valeur est trop longue.",
+      "too_short": "Cette valeur est trop courte.",
+      "too_small": "Cette valeur est trop petite.",
+      "too_large": "Cette valeur est trop grande.",
+      "with_values": "{message} : {values}",
+      "code_incomplete": "Saisissez tous les chiffres du code.",
+      "password_rules": "Le mot de passe ne respecte pas toutes les règles.",
+      "invalid_duration": "Saisissez une durée comme 1h30m ou 01:30.",
+      "range_incomplete": "Choisissez aussi la fin de la période.",
+      "invalid_json": "Ce JSON n’est pas valide.",
+      "key_missing": "Donnez un nom à chaque valeur.",
+      "key_duplicate": "Chaque nom ne peut apparaître qu’une fois."
+    },
     "confirm": {
-      "unsaved_changes_title": "Modifications non sauvegardées",
-      "unsaved_changes_description": "Vous avez des modifications non sauvegardées. Êtes-vous sûr de vouloir quitter ? Vos modifications seront perdues.",
-      "discard": "Abandonner",
-      "stay": "Rester",
       "confirm": "Confirmer",
-      "cancel": "Annuler"
+      "cancel": "Annuler",
+      "esc_hint": "pour annuler",
+      "type_to_confirm": "Saisissez {text} pour confirmer",
+      "type_mismatch": "Le texte ne correspond pas. Saisissez exactement {text}.",
+      "close": "Fermer",
+      "esc_close_hint": "pour fermer"
     },
     "date": {
       "undefined": "Inconnue"
     },
     "components": {
       "tableview": "📄 TableView",
-      "tree": "🎋 Arbre",
-      "tab": "🗂️ Onglet"
+      "tab": "🗂️ Onglet",
+      "global": "🌐 Global"
     },
     "chart": {
       "no_data": "Aucune donnée",
@@ -442,6 +460,27 @@
         "previous-period": "vs période précédente",
         "previous-year": "vs année précédente",
         "custom": "Personnalisé"
+      },
+      "compare_options": {
+        "none": "Aucune comparaison",
+        "previous-period": "Période précédente",
+        "previous-year": "Année précédente",
+        "custom": "Personnalisée"
+      },
+      "popover": {
+        "dialog_aria": "Choisir la période",
+        "presets": "Préréglages",
+        "custom_range": "Plage personnalisée",
+        "start": "Début",
+        "end": "Fin",
+        "compare_to": "Comparer à",
+        "cancel": "Annuler",
+        "apply": "Appliquer",
+        "vs": "vs",
+        "days": "{count} jour | {count} jours",
+        "hours": "{count} heure | {count} heures",
+        "previous_month": "Mois précédent",
+        "next_month": "Mois suivant"
       }
     }
   }

package/frontend-vue/layers/dms-core/shared/types/runtime-config.d.ts

@@ -41,14 +41,6 @@ interface DmsPrivateConfig {
      * backend-side from the instance `jwtSecret`; never exposed to browsers.
      */
     relaySecret: string;
-    /**
-     * Whether a trusted reverse proxy sits immediately in front and appends
-     * to `x-forwarded-for`.
-     *
-     * @deprecated Mirrors the deprecated `auth.oauth.trustProxy`. The frontend
-     * server keys its OAuth rate limit on its own `DMS_TRUSTED_PROXY_HOPS`.
-     */
-    trustProxy?: boolean;
   };
 }