@appsemble/node-utils 0.35.20 → 0.36.1

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.35.20/config/assets/logo.svg) Appsemble Node Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.36.1/config/assets/logo.svg) Appsemble Node Utilities
 
 > NodeJS utilities used by Appsemble internally.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/node-utils)](https://www.npmjs.com/package/@appsemble/node-utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.35.20/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.35.20)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.36.1/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.36.1)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ compatibility is not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.35.20/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.36.1/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/app.js

@@ -26,7 +26,7 @@ const getPluralRules = memoize((locale, opts) => new Intl.PluralRules(locale, op
  * @returns A localized remapper context for the app.
  */
 export async function getRemapperContext(app, language, options, context) {
-    const { getAppMessages, getAppUrl, getAppVariables, getCurrentAppMember } = options;
+    const { getAppMessages, getAppUrl, getAppVariables, getCurrentAppMember, getCurrentAppMemberSelectedGroup, } = options;
     const appUrl = String(await getAppUrl({ context, app }));
     const appMessages = await getAppMessages({
         app,
@@ -35,6 +35,7 @@ export async function getRemapperContext(app, language, options, context) {
     });
     const appVariables = await getAppVariables({ context, app });
     const appMemberInfo = await getCurrentAppMember({ context, app });
+    const groupInfo = await getCurrentAppMemberSelectedGroup({ context, app });
     const cache = objectCache((message) => new IntlMessageFormat(message, language, undefined, {
         formatters: {
             // XXX: idk
@@ -64,6 +65,7 @@ export async function getRemapperContext(app, language, options, context) {
         appMemberInfo,
         context: {},
         locale: appMemberInfo?.locale ?? app.definition.defaultLanguage ?? defaultLocale,
+        group: groupInfo ?? undefined,
     };
 }
 function replaceStyle(stylesheet, selector, property, value) {

package/middleware/frontend.js

@@ -8,7 +8,7 @@ import webpackDevMiddleware from 'webpack-dev-middleware';
  */
 const skipRoute = /^\/(api|oauth2\/token)/;
 export async function frontend(webpackConfigs, argv, serveStudio = false) {
-    // eslint-disable-next-line @typescript-eslint/prefer-ts-expect-error
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore Because the webpack core config isn’t built when building the server, an error is
     // expected here at build time, but while type checking.
     const { createAppConfig, createStudioConfig } = await import('@appsemble/webpack-core');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/node-utils",
-  "version": "0.35.20",
+  "version": "0.36.1",
   "description": "NodeJS utilities used by Appsemble internally.",
   "keywords": [
     "app",
@@ -40,9 +40,10 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/lang-sdk": "0.35.20",
-    "@appsemble/types": "0.35.20",
-    "@appsemble/utils": "0.35.20",
+    "@appsemble/lang-sdk": "0.36.1",
+    "@appsemble/types": "0.36.1",
+    "@appsemble/utils": "0.36.1",
+    "@appsemble/webpack-core": "0.36.1",
     "@formatjs/fast-memoize": "^2.0.0",
     "@fortawesome/fontawesome-free": "^6.0.0",
     "@kubernetes/client-node": "^0.22.2",
@@ -65,14 +66,12 @@
     "form-data": "^4.0.4",
     "fs-extra": "^11.0.0",
     "inquirer": "^9.0.0",
-    "intl-messageformat": "^10.0.0",
+    "intl-messageformat": "^11.0.0",
     "jsonschema": "~1.4.1",
     "keytar": "^7.0.0",
     "koa": "^2.0.0",
     "koa-compose": "^4.0.0",
-    "koa-compress": "^5.1.1",
     "koa-mount": "^4.0.0",
-    "koa-range": "^0.3.0",
     "koa-static": "^5.0.0",
     "koas-body-parser": "^0.7.0",
     "koas-core": "^0.7.0",
@@ -106,9 +105,10 @@
   },
   "devDependencies": {
     "@types/busboy": "1.5.4",
-    "@types/css-tree": "2.3.10",
-    "@types/koa-compress": "4.0.6",
-    "@types/koa-range": "0.3.5",
+    "@types/css-tree": "2.3.11",
+    "@types/express-to-koa": "1.0.4",
+    "@types/koa-mount": "4.0.5",
+    "@types/mustache": "4.2.5",
     "@types/type-is": "1.6.7",
     "@types/uuid": "10.0.0",
     "axios-mock-adapter": "1.22.0",

package/readAsset.d.ts

@@ -1,4 +1,4 @@
-export declare const assetDir: import("url").URL;
+export declare const assetDir: import("node:url").URL;
 /**
  * Read a file from the server assets directory.
  *

package/server/routes/appRouter/index.js

@@ -14,6 +14,7 @@ import { createManifestHandler } from './manifestHandler.js';
 import { createReadmeHandler } from './readmeHandler.js';
 import { createRobotsHandler } from './robotsHandler.js';
 import { createScreenshotHandler } from './screenshotHandler.js';
+import { createSecurityHandler } from './securityHandler.js';
 import { createServiceWorkerHandler } from './serviceWorkerHandler.js';
 import { createStaticHandler } from './staticHandler.js';
 const require = createRequire(import.meta.url);
@@ -24,6 +25,10 @@ export function createAppRouter(options) {
             route: '/manifest.json',
             get: createManifestHandler(options),
         },
+        {
+            route: '/.well-known/security.txt',
+            get: createSecurityHandler(options),
+        },
         {
             route: '/robots.txt',
             get: createRobotsHandler(options),

package/server/routes/appRouter/indexHandler.js

@@ -10,6 +10,12 @@ export function createIndexHandler({ createSettings, getApp, getAppDetails, getA
     return async (ctx) => {
         const { hostname, path } = ctx;
         const host = getHost({ context: ctx });
+        // Prevent mime-type sniffing,
+        // Visit https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options to know more.
+        ctx.set('x-content-type-options', 'nosniff');
+        // Less strict due to the OAuth mechanism
+        // Visit https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy to know more.
+        ctx.set('Referrer-Policy', 'strict-origin-when-cross-origin');
         // Most of the fields here are used either directly or indirectly that's why no attributes query
         const app = await getApp({ context: ctx });
         if (!app) {

package/server/routes/appRouter/securityHandler.d.ts

@@ -0,0 +1,3 @@
+import { type Middleware } from 'koa';
+import { type Options } from '../../../index.js';
+export declare function createSecurityHandler({ getApp }: Options): Middleware;

package/server/routes/appRouter/securityHandler.js

@@ -0,0 +1,11 @@
+import { addDays } from 'date-fns';
+import { assertKoaCondition } from '../../../index.js';
+export function createSecurityHandler({ getApp }) {
+    return async (ctx) => {
+        const app = await getApp({ context: ctx, query: { attributes: ['id', 'updated'] } });
+        assertKoaCondition(app != null, ctx, 404, 'App not found');
+        const expires = addDays(new Date(app.$updated ?? app.$created), 180);
+        ctx.body = `Contact: mailto:security@appsemble.com\nExpires: ${expires}`;
+    };
+}
+//# sourceMappingURL=securityHandler.js.map

package/server/types.d.ts

@@ -1,5 +1,5 @@
 import { type Readable } from 'node:stream';
-import { type BlockDefinition, type ControllerDefinition, type CustomAppPermission, type EmailActionDefinition, type IdentifiableBlock, type ResourceDefinition, type Theme as ThemeType } from '@appsemble/lang-sdk';
+import { type AppMemberGroup, type BlockDefinition, type ControllerDefinition, type CustomAppPermission, type EmailActionDefinition, type IdentifiableBlock, type ResourceDefinition, type Theme as ThemeType } from '@appsemble/lang-sdk';
 import { type App, type AppConfigEntry, type AppMemberInfo, type AppMessages, type Asset, type BlockManifest, type Group, type OrganizationPermission, type Resource } from '@appsemble/types';
 import { type RawAxiosRequestConfig } from 'axios';
 import { type DefaultContext as DefaultContextInterface, type DefaultState, type ParameterizedContext } from 'koa';
@@ -115,6 +115,9 @@ declare module 'koas-parameters' {
         selectedGroupId: number;
         $own: boolean;
         delimiter?: string;
+        email: string;
+        width?: number;
+        height?: number;
     }
 }
 export type Operator = 'and' | 'not' | 'or';
@@ -217,6 +220,10 @@ export interface GetCurrentAppMemberParams {
     context: ParameterizedContext<DefaultState, DefaultContextInterface, any>;
     app: App;
 }
+export interface GetCurrentAppMemberSelectedGroupParams {
+    context: ParameterizedContext<DefaultState, DefaultContextInterface, any>;
+    app: App;
+}
 export interface GetCurrentAppMemberGroupsParams {
     context: ParameterizedContext<DefaultState, DefaultContextInterface, any>;
     app: App;
@@ -367,6 +374,7 @@ export interface ParsedQuery {
 export type ContentSecurityPolicy = Record<string, (string | false)[]>;
 export interface Options {
     getCurrentAppMember: (params: GetCurrentAppMemberParams) => Promise<AppMemberInfo | null>;
+    getCurrentAppMemberSelectedGroup: (params: GetCurrentAppMemberSelectedGroupParams) => Promise<AppMemberGroup | null>;
     getCurrentAppMemberGroups: (params: GetCurrentAppMemberGroupsParams) => Promise<Group[] | null>;
     getApp: (params: GetAppParams) => Promise<App>;
     getAppDetails: (params: GetAppParams) => Promise<AppDetails>;