@autobusal/utilities 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this package are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
+
+## [1.1.2] - 2026-07-24
+
+### Added
+
+- New `sanitizeHtml(html)` helper (wraps DOMPurify) for sanitizing admin-authored CMS content (pages, articles, notifications, policies, affiliate terms, document previews) before rendering via `dangerouslySetInnerHTML`. Added `dompurify` as a dependency.
+
+## [1.1.1] - 2026-07-19
+
+### Added
+
+- `form.tsx`: the `Validate` helper now supports a cross-field `matches:<otherField>` rule (e.g. password confirmation). It accepts an optional third argument, react-hook-form's `getValues` (`UseFormGetValues<any>`), and emits a `validate` callback that compares the field against the named field, failing with the `errors.matches` message on mismatch. When `getValues` is not supplied the rule passes rather than blocking the form, so single-field rules keep working unchanged.
+- `users.tsx` / `index.ts`: new `GetEnvironment(t)` helper exposing a payment-gateway `sandbox` / `production` mode selector (labels `admin_label.manage.environment.*`), following the same shape as `GetStatus`. It is now exported from the package index.
+
+### Fixed
+
+- `users.tsx`: `GetStatus` now returns all four real statuses. Previously it listed only Available (`1`) and Unavailable (`0`), so records whose actual status was Suspended (`2`) or Pending (`3`) had no matching `<option>`; the admin select silently fell back to Available and an unrelated save could overwrite the real status with Available. Added `suspended` and `pending` options to keep it in sync with `DisplayStatus`.
+
+Authored by Ferjolt Ozuni. Consolidated from the magus and alvavel whitelabel patch sets into canonical @autobusal source (eliminates per-repo patch-package divergence).

package/form.tsx

@@ -1,5 +1,5 @@
 import { TFunction } from 'i18next';
-import { FieldError, Merge, FieldErrorsImpl } from 'react-hook-form';
+import { FieldError, Merge, FieldErrorsImpl, UseFormGetValues } from 'react-hook-form';
 import styled from 'styled-components';
 
 interface ValidateType {
@@ -9,10 +9,14 @@ interface ValidateType {
   minLength?: any
   min?: any
   max?: any
+  validate?: (value: any) => (boolean | string)
   onChange?: (event?: any) => void
 }
 
-export const Validate = (rules: string, t: TFunction<'common'>): ValidateType => {
+// `getValues` is only needed for cross-field rules (e.g. `matches:otherField`);
+// pass react-hook-form's getValues from the calling component for those. Rules
+// that don't reference another field work without it.
+export const Validate = (rules: string, t: TFunction<'common'>, getValues?: UseFormGetValues<any>): ValidateType => {
   const analyze = rules.split('|');
 
   const validation: ValidateType = {};
@@ -25,6 +29,15 @@ export const Validate = (rules: string, t: TFunction<'common'>): ValidateType =>
         validation.required = t('errors.required', { ns: 'common' });
       break;
 
+      case 'matches':
+        // This field must equal another field (type[1] = the other field's name),
+        // e.g. password confirmation. Without getValues we can't compare, so we
+        // pass validation rather than blocking the form.
+        validation.validate = (value: any) => (
+          !getValues || value === getValues(type[1]) || t('errors.matches', { ns: 'common' })
+        );
+      break;
+
       case 'email':
         validation.pattern = {
           value: /^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}$/i,

package/index.ts

@@ -3,11 +3,13 @@ import { Validate, Display } from './form';
 import { error, notify, success } from './notify';
 import { getAllowed, getLanguages, getPayments } from './options';
 import { getSex, getOptionsSex } from './passengers';
-import { GetStatus, DisplayStatus } from './users';
+import { GetStatus, GetEnvironment, DisplayStatus } from './users';
 import { getRandomNumber } from './numbers';
 import { getParams } from './manage';
+import { sanitizeHtml } from './sanitize';
 
 export {
+  sanitizeHtml,
   Validate,
   Display,
   error,
@@ -26,5 +28,6 @@ export {
   getOptionsSex,
   getRandomNumber,
   getSex,
-  GetStatus
+  GetStatus,
+  GetEnvironment
 };

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "@autobusal/utilities",
-  "version": "1.1.0",
+  "version": "1.1.2",
+  "author": "Ferjolt Ozuni",
   "type": "module",
-  "main": "index.ts"
+  "main": "index.ts",
+  "dependencies": {
+    "dompurify": "^3.4.12"
+  }
 }

package/sanitize.ts

@@ -0,0 +1,11 @@
+import DOMPurify from 'dompurify';
+
+// Sanitizes admin-authored HTML (CMS pages, articles, notifications, policies,
+// affiliate terms, document previews) before it's rendered via
+// dangerouslySetInnerHTML. These fields are only writable by an admin-type
+// account today, but rendering them unsanitized still means a compromised or
+// phished admin can persist JS that runs in every visitor's and every other
+// admin's browser - this is the defense-in-depth layer for that case.
+export const sanitizeHtml = (html: string | null | undefined): string => (
+  DOMPurify.sanitize(html ?? '')
+);

package/users.tsx

@@ -1,6 +1,11 @@
 import { TFunction } from 'i18next';
 import styled, { css } from 'styled-components';
 
+// Kept in sync with DisplayStatus() below - the data model has 4 real
+// states, so the admin select needs an <option> for every one of them.
+// Without this, a record whose real status is Pending/Suspended had no
+// matching option and the select silently fell back to showing (and, on
+// an unrelated save, would silently overwrite the status with) Available.
 export const GetStatus = (t: TFunction<'common'>) => ([
   {
     id: 1,
@@ -8,6 +13,25 @@ export const GetStatus = (t: TFunction<'common'>) => ([
   }, {
     id: 0,
     name: t('data.statuses.unavailable', { ns: 'common' })
+  }, {
+    id: 2,
+    name: t('data.statuses.suspended', { ns: 'common' })
+  }, {
+    id: 3,
+    name: t('data.statuses.pending', { ns: 'common' })
+  }
+]);
+
+// Edited: Ferjolt Ozuni - Date: 2026-07-18
+// Added: payment gateway sandbox/production mode selector, same pattern as
+// GetStatus above.
+export const GetEnvironment = (t: TFunction<'common'>) => ([
+  {
+    id: 'sandbox',
+    name: t('admin_label.manage.environment.sandbox', { ns: 'common' }),
+  }, {
+    id: 'production',
+    name: t('admin_label.manage.environment.production', { ns: 'common' })
   }
 ]);