@bygghammar/cms-platform 0.94.0 → 0.96.0

package/src/navigation/visibility.ts

@@ -0,0 +1,235 @@
+/**
+ * Which saved menu and footer links a visitor is shown right now.
+ *
+ * Saved navigation is never edited by a page changing state: an item pointing
+ * at a page that is offline or link-only is simply not rendered, and comes back
+ * by itself when the page is published or listed again. The same goes for
+ * booking links while booking is switched off.
+ *
+ * Only links positively known to point at such a page are hidden. External
+ * links, `#fragment` links, `mailto:`/`tel:` and every internal address the CMS
+ * does not know about are left alone — an address missing from the CMS list is
+ * a route the site serves some other way, not an offline page.
+ */
+import { isBookingHref } from "../cms/booking-links";
+import type { HiddenPageReason } from "../cms/page-visibility";
+import { normalizeOrigin, normalizeRoutePath } from "../site/route-index";
+import type { NavigationItem } from "./index";
+
+/** Why a saved link is not shown. */
+export type HiddenLinkReason = HiddenPageReason | "booking" | "unknown";
+
+export const HIDDEN_LINK_REASONS: Record<HiddenLinkReason, string> = {
+  offline: "Not shown on the site: the page it links to is offline.",
+  "link-only": "Not shown on the site: the page it links to is link-only.",
+  booking: "Not shown on the site: booking is switched off in Site settings.",
+  unknown: "Not shown right now: the site could not read which pages are public.",
+};
+
+/**
+ * What the chrome needs to decide, in a serializable shape a server can hand
+ * to the browser with the page.
+ */
+export type LinkVisibilityPolicy = {
+  /** False when the server could not read the policy: see {@link linkHideReason}. */
+  known: boolean;
+  /** Booking links in site-wide chrome (menu, footer, header button). */
+  bookingVisible: boolean;
+  /** Normalized served paths of unlisted pages, every locale and alias. */
+  hiddenPaths: Readonly<Record<string, HiddenPageReason>>;
+  /** Origins that are this site, for absolute links written with the domain. */
+  origins: readonly string[];
+  /** Locale prefixes, so `/EN/...` and `/en/...` compare equal. */
+  locales?: readonly string[];
+};
+
+/** No filtering at all: what screens without a public policy render with. */
+export const OPEN_LINK_POLICY: LinkVisibilityPolicy = Object.freeze({
+  known: true,
+  bookingVisible: true,
+  hiddenPaths: Object.freeze({}),
+  origins: Object.freeze([]) as readonly string[],
+});
+
+/**
+ * The site path an address leads to, or null when it leads off the site (or
+ * is not a navigable path at all).
+ */
+export function internalPathOf(
+  href: string,
+  policy: Pick<LinkVisibilityPolicy, "origins" | "locales">,
+): string | null {
+  const value = href.trim();
+  if (!value || value.startsWith("#")) return null;
+  const pathPolicy = { locales: policy.locales ?? [] };
+  if (value.startsWith("/") && !value.startsWith("//")) {
+    return normalizeRoutePath(value, pathPolicy);
+  }
+  const absolute = value.startsWith("//") ? `https:${value}` : value;
+  if (!/^https?:\/\//i.test(absolute)) return null;
+  let url: URL;
+  try {
+    url = new URL(absolute);
+  } catch {
+    return null;
+  }
+  const own = new Set(policy.origins.map((origin) => normalizeOrigin(origin)).filter(Boolean));
+  if (!own.has(url.origin)) return null;
+  return normalizeRoutePath(url.pathname, pathPolicy);
+}
+
+/** Why this saved link is hidden, or null when it is shown. */
+export function linkHideReason(href: string, policy: LinkVisibilityPolicy): HiddenLinkReason | null {
+  if (!policy.bookingVisible && isBookingHref(href)) return "booking";
+  const path = internalPathOf(href, policy);
+  if (path === null) return null;
+  /*
+   * A policy that could not be read hides every internal page link except the
+   * front page, rather than showing links to pages that may be offline or
+   * link-only. The pages themselves come from the same database, so a read
+   * that failed here is rarely the only thing failing.
+   */
+  if (!policy.known) return path === "/" ? null : "unknown";
+  return policy.hiddenPaths[path] ?? null;
+}
+
+/**
+ * Navigation with hidden links removed, order preserved.
+ *
+ * A hidden entry is removed with its submenu. A submenu whose entries are all
+ * hidden is removed and its parent stays an ordinary link — never an empty
+ * dropdown.
+ */
+export function filterNavigationForPolicy(
+  items: readonly NavigationItem[] | undefined,
+  policy: LinkVisibilityPolicy,
+): NavigationItem[] {
+  const out: NavigationItem[] = [];
+  for (const item of items ?? []) {
+    if (linkHideReason(item.href ?? "", policy) !== null) continue;
+    if (!item.children || item.children.length === 0) {
+      out.push(item);
+      continue;
+    }
+    const children = filterNavigationForPolicy(item.children, policy);
+    out.push(children.length > 0 ? { ...item, children } : { ...item, children: undefined });
+  }
+  return out;
+}
+
+/** A footer column as the visibility filter needs to see it. */
+type FooterColumnLike = { links: ReadonlyArray<{ href: string }> };
+
+/** Footer columns with hidden links removed; a column left with no links is dropped. */
+export function filterFooterColumnsForPolicy<C extends FooterColumnLike>(
+  columns: readonly C[] | undefined,
+  policy: LinkVisibilityPolicy,
+): C[] {
+  const out: C[] = [];
+  for (const column of columns ?? []) {
+    const links = column.links.filter((link) => linkHideReason(link.href ?? "", policy) === null);
+    if (links.length === 0 && column.links.length > 0) continue;
+    out.push(links.length === column.links.length ? column : { ...column, links });
+  }
+  return out;
+}
+
+/** A saved menu or footer link that is not shown, with the reason. */
+export type HiddenSavedLink = { label: string; href: string; reason: HiddenLinkReason };
+
+function labelText(label: unknown): string {
+  if (typeof label === "string") return label;
+  if (label && typeof label === "object") {
+    const first = Object.values(label as Record<string, unknown>).find(
+      (value) => typeof value === "string" && value.trim() !== "",
+    );
+    if (typeof first === "string") return first;
+  }
+  return "(no label)";
+}
+
+/**
+ * Every saved link in a menu (`nav`, an item list) or footer (`footer`, with
+ * `columns`) that the site is not showing right now, and why. For the editor,
+ * which explains rather than deletes: the saved item stays exactly as it is.
+ */
+export function hiddenSavedLinks(
+  section: "nav" | "footer",
+  value: unknown,
+  policy: LinkVisibilityPolicy,
+): HiddenSavedLink[] {
+  const out: HiddenSavedLink[] = [];
+  const visit = (label: unknown, href: unknown) => {
+    if (typeof href !== "string" || href.trim() === "") return;
+    const reason = linkHideReason(href, policy);
+    if (reason) out.push({ label: labelText(label), href, reason });
+  };
+  if (section === "nav") {
+    const walk = (items: unknown) => {
+      if (!Array.isArray(items)) return;
+      for (const item of items as Array<Record<string, unknown>>) {
+        visit(item?.["label"], item?.["href"]);
+        walk(item?.["children"]);
+      }
+    };
+    walk(value);
+  } else {
+    const columns = (value as { columns?: unknown } | null)?.columns;
+    if (Array.isArray(columns)) {
+      for (const column of columns as Array<{ links?: unknown }>) {
+        if (!Array.isArray(column?.links)) continue;
+        for (const link of column.links as Array<Record<string, unknown>>) {
+          visit(link?.["label"], link?.["href"]);
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** Every `href` in a menu (items with children) or a footer (`{ columns: [{ links }] }`). */
+export function savedLinkHrefs(section: "nav" | "footer", value: unknown): string[] {
+  const out: string[] = [];
+  const add = (href: unknown) => {
+    if (typeof href === "string" && href.trim() !== "") out.push(href);
+  };
+  if (section === "nav") {
+    const walk = (items: unknown) => {
+      if (!Array.isArray(items)) return;
+      for (const item of items as Array<Record<string, unknown>>) {
+        add(item?.["href"]);
+        walk(item?.["children"]);
+      }
+    };
+    walk(value);
+  } else {
+    const columns = (value as { columns?: unknown } | null)?.columns;
+    if (Array.isArray(columns)) {
+      for (const column of columns as Array<{ links?: unknown }>) {
+        if (!Array.isArray(column?.links)) continue;
+        for (const link of column.links as Array<Record<string, unknown>>) add(link?.["href"]);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * The policy cut down to the addresses actually linked from `hrefs`.
+ *
+ * A policy sent to the browser with the page must not list every unlisted
+ * page: that would publish the address of each link-only page in the source of
+ * every other page. The chrome only needs answers for the links it has, and
+ * those addresses are already in the content that is sent anyway.
+ */
+export function restrictToLinks(
+  policy: LinkVisibilityPolicy,
+  hrefs: readonly string[],
+): LinkVisibilityPolicy {
+  const hiddenPaths: Record<string, LinkVisibilityPolicy["hiddenPaths"][string]> = {};
+  for (const href of hrefs) {
+    const path = internalPathOf(href, policy);
+    if (path !== null && policy.hiddenPaths[path]) hiddenPaths[path] = policy.hiddenPaths[path]!;
+  }
+  return { ...policy, hiddenPaths };
+}

package/src/popups/runtime.tsx

@@ -10,7 +10,7 @@
  * design tokens — so neither the popup package nor the site has to know about
  * the other.
  */
-import { useCallback, useEffect, useMemo, useRef } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import type { ReactNode } from "react";
 import { useRouterState } from "@tanstack/react-router";
 import {
@@ -25,6 +25,8 @@ import type {
 import { ManagedForm } from "../forms/FormRenderer";
 import { onFormSubmissionSuccess } from "../forms/success-listeners";
 import { siteConfig } from "../config/site-config";
+import { containsBookingTarget, isBookingHref, stripBookingDeep } from "../cms/booking-links";
+import { useLinkVisibility } from "../site/link-visibility";
 import type { PopupPublicHost } from "./host";
 import { popupPublicHost } from "./host";
 
@@ -95,6 +97,63 @@ export function popupExcludedPaths(
 export function PopupModuleRuntime(): ReactNode {
   const path = useRouterState({ select: (state) => state.location.pathname });
   const host = popupPublicHost();
+  /*
+   * The runtime keeps the popups it was handed until its `configs` adapter
+   * changes, and keeps everything else — the popup on screen, the form in it,
+   * the visitor's counts, its timers and its analytics queue. It is never
+   * remounted, which would throw away a newsletter form a visitor is typing in.
+   *
+   * What it is handed is decided here, in render, from what this module last
+   * had from the site's repository and the policy now. So a change of policy
+   * restricts what the runtime holds at once: before the refresh it also
+   * starts has answered, and whatever becomes of it — a slow or failed read
+   * changes nothing that booking-off takes away. A read only ever brings what
+   * it found through the same rules, and only the latest read counts, so one
+   * begun under the old policy cannot bring booking back. Without a policy
+   * provider booking is visible and nothing changes.
+   */
+  const bookingVisible = useLinkVisibility().bookingVisible;
+  const [loaded, setLoaded] = useState<readonly PopupConfig[] | null>(null);
+  const offered = useRef<Offered>(NOTHING_OFFERED);
+  const offer = useMemo(
+    () => popupsToOffer(loaded ?? [], offered.current, bookingVisible),
+    // `offered` is what the runtime was last handed, read for identity only.
+    [loaded, bookingVisible],
+  );
+  useEffect(() => {
+    offered.current = offer;
+  }, [offer]);
+
+  // The repository is asked again when the host or the policy changes — and
+  // only once the runtime asks for its popups, so never where it does not run.
+  const askedFor = useRef<{ configs: PopupPublicHost["configs"]; bookingVisible: boolean } | null>(null);
+  const latestRead = useRef(0);
+  const configs = useMemo<RuntimeAdapters["configs"]>(
+    () => ({
+      listActive: async () => {
+        const asked = askedFor.current;
+        if (asked === null || asked.configs !== host.configs || asked.bookingVisible !== bookingVisible) {
+          askedFor.current = { configs: host.configs, bookingVisible };
+          const read = ++latestRead.current;
+          Promise.resolve()
+            .then(() => host.configs.listActive())
+            .then(
+              (answer) => {
+                if (read !== latestRead.current) return;
+                setLoaded((previous) =>
+                  previous !== null && JSON.stringify(previous) === JSON.stringify(answer) ? previous : answer,
+                );
+              },
+              // A failed read changes nothing: what the runtime holds already
+              // follows the policy, and stays as it is until a read succeeds.
+              () => undefined,
+            );
+        }
+        return offer.list;
+      },
+    }),
+    [host.configs, bookingVisible, offer],
+  );
 
   // The argument type comes from the port, not a copy of it: a package that
   // stopped supplying `popupKey` would fail to compile here rather than
@@ -105,14 +164,15 @@ export function PopupModuleRuntime(): ReactNode {
     ),
     [],
   );
+  const forms = useMemo(() => ({ renderForm }), [renderForm]);
 
   const adapters = useMemo<RuntimeAdapters>(
     () => ({
-      configs: host.configs,
+      configs,
       analytics: host.analytics,
-      forms: { renderForm },
+      forms,
     }),
-    [host, renderForm],
+    [configs, host, forms],
   );
 
   return (
@@ -124,5 +184,96 @@ export function PopupModuleRuntime(): ReactNode {
   );
 }
 
+type PopupConfig = Awaited<ReturnType<RuntimeAdapters["configs"]["listActive"]>>[number];
+type ContentBlock = PopupConfig["steps"][number]["blocks"][number];
+type PopupButton = Extract<ContentBlock, { type: "buttons" }>["buttons"][number];
+type BlockAction = PopupButton["action"];
+
+/** The list last handed to the runtime, and each popup's content, by key. */
+type Offered = { list: readonly PopupConfig[]; content: ReadonlyMap<string, string> };
+const NOTHING_OFFERED: Offered = { list: [], content: new Map() };
+
+/**
+ * What the runtime is handed from a load, given what it already holds.
+ *
+ * - While booking is hidden, a popup that leads to booking is not offered: it
+ *   is handed over retired (see {@link retire}).
+ * - A popup the runtime already holds is never dropped, even when the load no
+ *   longer has it (a server that withholds booking popups, a popup paused or
+ *   deleted since). The runtime tracks the open popup by key, so dropping the
+ *   open one would leave it unclosable and stop every other popup for the
+ *   rest of the visit. It stays, retired.
+ * - A popup whose content has not changed is handed over as the very object
+ *   the runtime already has. The popup on screen then re-renders nothing:
+ *   its focus trap is not re-installed (that would pull focus out of the
+ *   field being typed in), and a list with nothing new is the same list, so
+ *   the runtime's schedule is not even restarted.
+ */
+function popupsToOffer(
+  loaded: readonly PopupConfig[],
+  previous: Offered,
+  bookingVisible: boolean,
+): Offered {
+  const held = new Map(previous.list.map((popup) => [popup.key, popup]));
+  const content = new Map<string, string>();
+  const list: PopupConfig[] = [];
+  const offer = (popup: PopupConfig) => {
+    const text = JSON.stringify(popup);
+    const same = held.get(popup.key);
+    content.set(popup.key, text);
+    list.push(same !== undefined && previous.content.get(popup.key) === text ? same : popup);
+  };
+  for (const popup of loaded) {
+    offer(bookingVisible || !containsBookingTarget(popup) ? popup : retire(popup, true));
+  }
+  for (const popup of previous.list) {
+    if (!content.has(popup.key)) offer(retire(popup, !bookingVisible));
+  }
+  const unchanged =
+    list.length === previous.list.length && list.every((popup, index) => popup === previous.list[index]);
+  return { list: unchanged ? previous.list : list, content };
+}
+
+/**
+ * A popup the runtime keeps but never offers again.
+ *
+ * Paused, which the runtime neither shows nor reports as suppressed. With
+ * `hideBooking`, everything in it that leads to booking is taken out too —
+ * links, buttons, an answer or a form that would open the booking site now
+ * simply closes — so if it is the one on screen, the visitor keeps what they
+ * were reading, cannot reach booking from it, and closes it the usual way.
+ * The stored popup is not touched; this is the copy the visitor sees.
+ */
+function retire(popup: PopupConfig, hideBooking: boolean): PopupConfig {
+  const paused: PopupConfig = { ...popup, status: "paused" };
+  if (!hideBooking) return paused;
+  return stripBookingDeep({
+    ...paused,
+    steps: paused.steps.map((step) => ({ ...step, blocks: step.blocks.flatMap(withoutBookingTargets) })),
+  });
+}
+
+function withoutBookingTargets(block: ContentBlock): ContentBlock[] {
+  switch (block.type) {
+    case "link":
+      return isBookingHref(block.href) ? [] : [block];
+    case "buttons": {
+      const buttons = block.buttons.filter((button) => !opensBooking(button.action));
+      return buttons.length === 0 ? [] : [{ ...block, buttons }];
+    }
+    case "choice":
+      return [{ ...block, yes: closingInstead(block.yes), no: closingInstead(block.no) }];
+    case "form":
+      return [opensBooking(block.onSuccess) ? { ...block, onSuccess: { kind: "close" } } : block];
+    default:
+      return [block];
+  }
+}
+
+const opensBooking = (action: BlockAction) => action.kind === "openUrl" && isBookingHref(action.href);
+
+const closingInstead = (button: PopupButton): PopupButton =>
+  opensBooking(button.action) ? { ...button, action: { kind: "close" } } : button;
+
 // Default export so the module host can load this file lazily.
 export default PopupModuleRuntime;

package/src/server/forms-core.ts

@@ -11,6 +11,7 @@
  *  - a field key that already has stored answers can never be removed
  *  - snapshots and audit entries never block the write they describe
  */
+import { checkWebhookUrl } from "./webhook-url-guard";
 import {
   defaultFieldsFor,
   mergeFields,
@@ -410,6 +411,14 @@ export async function saveFormCore(
     }
   }
 
+  // A webhook address is checked when it is saved, not first when a visitor's
+  // submission tries to reach it (where it is checked again, on every hop).
+  const webhookUrl = (data.private_settings as { webhookUrl?: unknown }).webhookUrl;
+  if (typeof webhookUrl === "string" && webhookUrl.trim() !== "") {
+    const checked = checkWebhookUrl(webhookUrl);
+    if (!checked.ok) throw new Error(`Webhook URL: ${checked.message}`);
+  }
+
   const row = {
     key: data.key,
     name: data.name,

package/src/server/forms-delivery-core.ts

@@ -13,6 +13,8 @@
  */
 
 import type { FormFieldDef } from "../forms/field-sets";
+import { safeRequest, WEBHOOK_POLICY, type Resolver, type Transport } from "./outbound-http";
+import { checkWebhookUrl } from "./webhook-url-guard";
 import { sendViaProvider } from "./email-send-core";
 import { logEmail } from "./email-log-core";
 import { appendGoogleSheetRow, DEFAULT_WORKSHEET } from "./google-sheets-core";
@@ -489,6 +491,11 @@ export async function appendToSheetCore(opts: {
  * POST one submission to an external endpoint (CRM, Zapier, Make…).
  * Signed with an optional shared secret so the receiver can verify origin.
  * Never throws: the submission is already stored and must never be lost.
+ *
+ * The endpoint is reached only through the shared outbound policy: https
+ * only, public addresses only (looked up, pinned, every redirect hop checked),
+ * one deadline and a capped reply. A failure says what kind it was; the
+ * endpoint's own reply is never copied into it.
  */
 export async function postWebhookCore(opts: {
   url: string;
@@ -501,11 +508,13 @@ export async function postWebhookCore(opts: {
   createdAt: string;
   payload: Record<string, string>;
   timeoutMs?: number;
+  /** Test seams: a fake resolver and transport instead of the network. */
+  network?: { resolver?: Resolver; transport?: Transport };
 }): Promise<DeliveryResult & { status?: number }> {
   const url = (opts.url ?? "").trim();
   if (!url) return { ok: false, error: "No webhook URL configured." };
-  if (!/^https:\/\//i.test(url))
-    return { ok: false, error: "Webhook URL must start with https://" };
+  const checked = checkWebhookUrl(url);
+  if (!checked.ok) return { ok: false, error: checked.message };
 
   const body = JSON.stringify({
     event: "form.submission",
@@ -530,28 +539,26 @@ export async function postWebhookCore(opts: {
       const { createHmac } = await import("crypto");
       headers["X-Signature"] = createHmac("sha256", secret).update(body).digest("hex");
     } catch {
-      /* signing unavailable — send unsigned rather than dropping the delivery */
+      // A receiver that was promised a signature must never get an unsigned
+      // request it cannot tell from a forgery.
+      return { ok: false, error: "Webhook not sent: it could not be signed." };
     }
   }
 
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 10_000);
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers,
-      body,
-      signal: controller.signal,
-    });
-    if (!res.ok) {
-      const text = (await res.text().catch(() => "")).slice(0, 300);
-      return { ok: false, status: res.status, error: `Webhook [${res.status}]: ${text}` };
-    }
-    return { ok: true, status: res.status };
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return { ok: false, error: msg === "The operation was aborted." ? "Webhook timed out." : msg };
-  } finally {
-    clearTimeout(timer);
+  const res = await safeRequest({
+    url: checked.url.toString(),
+    method: "POST",
+    headers,
+    body,
+    policy: { ...WEBHOOK_POLICY, timeoutMs: opts.timeoutMs ?? WEBHOOK_POLICY.timeoutMs },
+    resolver: opts.network?.resolver,
+    transport: opts.network?.transport,
+  });
+  if (!res.ok) {
+    return { ok: false, error: res.failure === "timeout" ? "Webhook timed out." : `Webhook not delivered: ${res.message}` };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    return { ok: false, status: res.status, error: `Webhook answered ${res.status}.` };
   }
+  return { ok: true, status: res.status };
 }

package/src/server/forms-submissions-core.ts

@@ -34,6 +34,7 @@ import {
   type FormsDb,
 } from "./forms-core";
 import { auditAs } from "./audit-core";
+import { redactUrl } from "./outbound-http";
 import {
   evaluateRule,
   isFieldVisible,
@@ -358,7 +359,7 @@ export async function submitFormCore(admin: FormsDb, data: SubmitInput, meta: Re
       formKey: form.key,
       channel: "webhook",
       ok: res.ok,
-      target: eff.webhookUrl,
+      target: redactUrl(eff.webhookUrl),
       error: res.error,
       durationMs: Date.now() - startedAt,
       meta: { status: res.status ?? null },
@@ -1170,10 +1171,12 @@ export async function deliverChannelCore(
       })
       .eq("id", sub.id);
   } else if (channel === "webhook") {
-    target = toOverride?.trim() || eff.webhookUrl;
-    if (!target) throw new Error(`No webhook URL configured for "${form.key}".`);
+    const webhookUrl = toOverride?.trim() || eff.webhookUrl;
+    if (!webhookUrl) throw new Error(`No webhook URL configured for "${form.key}".`);
+    // Recorded without its query string, which may carry the receiver's key.
+    target = redactUrl(webhookUrl);
     result = await postWebhookCore({
-      url: target,
+      url: webhookUrl,
       secret: eff.webhookSecret,
       formKey: form.key,
       formName: form.name,
@@ -1385,7 +1388,7 @@ export async function testWebhookCore(
     formKey: form.key,
     channel: "webhook",
     ok: res.ok,
-    target: url,
+    target: redactUrl(url),
     error: res.error,
     durationMs: Date.now() - startedAt,
     meta: { test: true, status: res.status ?? null },