@bygghammar/cms-platform 0.95.0 → 0.97.0

package/CHANGELOG.md

@@ -8,6 +8,127 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.97.0
+
+Booking-off search landing pages. No migration: the settings live in the
+existing `site_settings` table (the migration manifest is unchanged at 60). Two
+exports were added — `./cms/booking-landing` and `./site/BookingOffNotice` —
+and none removed. With nothing stored, every site behaves exactly as on 0.96.0.
+
+- **Pages hidden from the website while booking is hidden** (Site settings →
+  Booking, after the pages that keep their booking links). While booking is
+  hidden, a page on this list is left out of every structured link the website
+  offers, and returns when booking is shown again. It stays live (200),
+  self-canonical, indexable and in the sitemap, so a visitor arriving from a
+  search result still gets the page: `pageIsIndexable` and `unlistedPages` are
+  unchanged, link-only stays `noindex`, offline stays a 404. Being indexable is
+  not a ranking promise, and the screen says so.
+- **One rule for structured links** (`useDiscoverableLink`,
+  `isHiddenFromDiscovery`, `hiddenPaths` reason `booking-off`): header menu,
+  mobile menu and footer; link tiles (dropped); hero, banner, media-split,
+  price-table, countdown and trip buttons (dropped); media-split slide links,
+  icon-grid card links and Instagram links (link removed, picture or card
+  kept). Applied in render from the link policy the server rendered with, so
+  the server's HTML and later client navigations agree. Links inside rich text
+  are the one documented exception. `restrictToLinks` keeps `booking-off`
+  entries, which name public pages.
+- **Popups** that lead to a hidden page are retired in the runtime the way
+  booking popups are; `withoutPopupsLeadingTo` lets a host withhold them on the
+  server.
+- **The booking-off notice** (`BookingOffNotice`, placed by the page renderer's
+  new `notice` prop after a leading hero): a plain-text heading, message and an
+  optional link, from a site-wide default with optional per-page replacements,
+  field by field, Swedish and English. The link must be an internal path or an
+  `https://` address and never leads to booking or to a hidden page: hosts name
+  their booking page (`LinkVisibilityPolicy.bookingPagePaths`, checked when the
+  notice renders) and check links on save (`VisibilityDeps.noticeTargetProblem`,
+  with `noticeTargetProblem(href, routes)` doing the work from the host's
+  routes). The platform names no route.
+- **Storage and staff writes**: rows `booking.landing.<page uuid>` and
+  `booking.landing.default`, written by `setBookingLandingCore` and
+  `setBookingLandingDefaultCore` — staff only, validated, compare-and-swap on
+  `updated_at`, audited, cache-invalidating. Protected pages and booking
+  exceptions are refused, and adding an exception for a landing page is refused
+  too (`BookingConflictError`); rows that say both are treated as an exception
+  only, and the Booking card warns. After a refused save the page-message editor
+  shows the stored version and says why, so a stale draft is never resubmitted
+  unseen.
+- **Host wiring (optional)**: `booking.fns.setBookingLanding` and
+  `setBookingLandingDefault` show the new subsection; without them the Booking
+  card is unchanged.
+
+## 0.96.0
+
+Security release. No migration, and no export was added or removed.
+
+- **Rich text is sanitized by a parser, not by patterns** (`./html/sanitize-html`).
+  The old sanitizer copied the text between the tags it recognised through as
+  written, so an unterminated tag at the end of a fragment (for example an image
+  tag with an event handler and no closing `>`) survived, and in server
+  rendering the markup after the fragment completed it into a live element.
+  Markup is now read the way a browser's HTML tokenizer reads it (every quoting
+  form, comments, DOCTYPE, CDATA, raw-text elements, a tag cut off by the end of
+  the input) and the output is written from scratch: allowlisted elements and
+  attributes only, attributes decoded once and escaped once, and every `<` and
+  `>` in text escaped. The editor's allowlist, URL rules and booking-link
+  `&amp;` handling are unchanged.
+  - Tightened: a `data:` image is accepted only in an image's `src`, never as a
+    link target. `svg`, `math`, `template`, `textarea`, `title`, `xmp`,
+    `noembed`, `noframes` and `plaintext` are dropped together with their
+    content.
+  - `htmlToText` now returns plain text, with entities decoded.
+- **The builder and its preview only talk to each other**
+  (`./site/routes/preview-page`, the page builder). The public preview route
+  used to render blocks posted by any window that put a marker string in its
+  message, and both ends posted to `"*"`. Now:
+  - the preview accepts the builder's messages only from its parent frame,
+    from its own origin or an origin the host lists, in one builder session
+    with increasing sequence numbers, shape-checked and at most 4 MB;
+  - the builder accepts the preview's messages only from its own iframe, and
+    every message names its target origin.
+  - **Host change, only for a builder on another origin:** list that origin in
+    the preview page deps as `trustedEditorOrigins`. A builder on the site's own
+    origin (Voyara's) needs no configuration.
+- **One outbound request policy** for every address staff or configuration
+  chooses: media import, form webhooks and popup opt-in webhooks. Each of these
+  was a server-side request forgery primitive. Every request now:
+  - allows only the schemes its policy names (webhooks: https only), with no
+    credentials in the URL, no local or single-label host names and no
+    privileged ports other than 80 and 443;
+  - looks the host up and goes ahead only if every address it resolves to is
+    public (IPv4 and IPv6 special-purpose ranges, including mapped, NAT64 and
+    6to4 forms), then connects to the address it checked (pinned, so a DNS
+    answer that changes in between cannot redirect it), with TLS still verified
+    for the host name;
+  - follows redirects itself, checking and pinning every hop, up to a cap;
+  - runs under one deadline for the whole request, which also holds when a
+    lookup, connection or response body ignores cancellation (Node's DNS
+    lookup cannot be cancelled), and reads at most a fixed number of bytes,
+    streaming, whatever `Content-Length` says;
+  - reports failures by category, with messages that carry no address, query
+    string or response body.
+- **What each path does with that policy:**
+  - **Media import:** a downloaded file is stored as what its first bytes say
+    it is (JPEG, PNG, GIF, WebP, AVIF, MP4, MOV, M4V, WebM, MP3, WAV, Ogg or
+    PDF), with that extension, never as the server's content type or the URL's
+    extension. SVG and HTML are refused. Public redirects to other sites are
+    still followed, carrying only plain request headers.
+  - **Form and popup webhooks never follow a redirect to another site.** A
+    signed body, its signature, timestamp, event id and idempotency key reach
+    only the configured origin (a redirect within that origin is followed;
+    popup webhooks report the refusal as `blocked-endpoint`). When a redirect
+    turns a request into a GET, entity and signature headers are dropped.
+    **Receivers that redirect to another host must be configured with their
+    final address.**
+  - **Form webhooks** are checked when the form is saved, report a failure by
+    status only (the receiver's reply is never copied into it), and are never
+    sent unsigned when signing fails.
+- **Addresses in records keep the origin only.** Webhook delivery records,
+  errors and the form audit trail show a webhook as its origin plus a fixed
+  `/[redacted]` marker, never its path, query string or credentials, because
+  receivers put keys in paths as well as in query strings. Settings whose name
+  says they are a secret are recorded as changed, never with a value.
+
 ## 0.95.0
 
 - **Pages can be link-only, and unpublished from the page itself.** Listing is

package/docs/PAGES.md

@@ -541,11 +541,50 @@ Listing is a second property beside publication, and the two never touch:
   booking links in their own content. Removal (`stripBookingDeep`,
   `withoutBookingPopups`) is for the host to apply to data before it leaves the
   server; stored content is never changed.
+- **Booking-off landing pages** (`cms/booking-landing`). While booking is off, a
+  page in this list leaves every structured link the website offers (see the
+  inventory below; `hiddenPaths` reason `booking-off`, `isHiddenFromDiscovery`,
+  `useDiscoverableLink`), but stays live, self-canonical, indexable and in the
+  sitemap: `pageIsIndexable` and `unlistedPages` do not change. Indexable is
+  not a ranking promise: removing a page's internal links can change how search
+  engines value it. Its booking links go as on any page, and it shows a
+  plain-text notice (`BookingOffNotice`, placed by the page renderer's `notice`
+  prop after a leading hero) with an optional link that never leads to booking
+  or to another hidden page. Staff write a site-wide default and optional
+  per-page replacements, field by field (`resolveNotice`). A page cannot be both
+  a booking exception and a landing page (`BookingConflictError`); stored rows
+  that say both are treated as an exception only, and the Booking card warns.
+  Offline still wins (404); link-only stays `noindex`. Protected pages are
+  refused. With booking on, nothing changes.
+
+### Booking-off landing pages: structured links (reviewed 2026-10-17)
+
+Enforced in render from the link policy the server rendered with (and every
+client navigation refreshes), so server HTML and the browser agree. Stored
+content is never changed. `tests/booking-landing-discovery-inventory.test.tsx`
+fails when a block type is added without being classified here.
+
+| Surface | While booking is hidden, a link to a landing page… |
+| --- | --- |
+| Header menu, mobile menu, footer, header button | not rendered (`hiddenPaths`); an emptied footer column goes |
+| `linkTiles` | tile dropped |
+| `heroFull`, `ctaBanner`, `mediaSplit` (both buttons), `priceTable`, `countdown` (expired button), `tripList`/`courseList` button | button dropped |
+| `mediaSplit` slide link, `iconGrid` card link, `instagram` profile and tiles | link removed, picture or card kept |
+| Popups (link block, button or answer `openUrl`, form success `openUrl`) | popup withheld on the server (`withoutPopupsLeadingTo`) and retired in the runtime, like a booking popup |
+| Booking-off notice link | dropped when it leads to booking (a booking site or the host's `bookingPagePaths`) or to a hidden page; refused at save by the host's `noticeTargetProblem` |
+| `richText` | **exception**: links in editor-written text stay as written |
+| `form` thank-you redirect | exempt: the result of submitting, not a link offered |
+| `layout`, `faq`, `prose`, `checklist`, `imageMarquee`, `cabinTabs` | no links of their own |
+
+Hosts add their own sections to the same rule with `useDiscoverableLink()`
+(Voyara: its legacy hero buttons and destination cards).
 
 ### Storage
 
 No migration: one `site_settings` row per decision, keyed by page id —
-`page.listing.<uuid>`, `booking`, `booking.exception.<uuid>`. Every write is a
+`page.listing.<uuid>`, `booking`, `booking.exception.<uuid>`,
+`booking.landing.<uuid>` (`{ landing, notice? }`) and `booking.landing.default`
+(`{ notice }`). Every write is a
 compare-and-swap on `updated_at` (`VisibilityConflictError` when someone else
 changed the row first). None is an `OVERRIDABLE_SETTING_KEYS` key, so the generic
 settings save and reset cannot reach them.
@@ -570,7 +609,11 @@ shown. The public page route takes a per-page `pagePolicy` query and adds
 
 ```ts
 pages: { fns: { setPageStatus?, setPageListing?, ... } }
-booking?: { fns: { getBookingSettings, setBookingEnabled, setBookingException } }
+booking?: { fns: { getBookingSettings, setBookingEnabled, setBookingException,
+                   setBookingLanding?, setBookingLandingDefault? } }
+// server: VisibilityDeps.noticeTargetProblem?(href) — the host's route check
+// (noticeTargetProblem(href, routes) does the work from the host's routes)
+// browser policy: LinkVisibilityPolicy.bookingPagePaths — the host's booking page, every alias
 useLinkVisibility?: () => LinkVisibilityPolicy | undefined
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.95.0",
+  "version": "0.97.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -210,6 +210,7 @@
     "./cms/page-publication": "./src/cms/page-publication.ts",
     "./cms/page-visibility": "./src/cms/page-visibility.ts",
     "./cms/booking-links": "./src/cms/booking-links.ts",
+    "./cms/booking-landing": "./src/cms/booking-landing.ts",
     "./site/routes": "./src/site/routes.ts",
     "./site/PageRenderer": "./src/site/PageRenderer.tsx",
     "./server/env": "./src/server/env.ts",
@@ -239,6 +240,7 @@
     "./site/route-index": "./src/site/route-index.ts",
     "./site/route-aliases": "./src/site/route-aliases.ts",
     "./site/link-visibility": "./src/site/link-visibility.tsx",
+    "./site/BookingOffNotice": "./src/site/BookingOffNotice.tsx",
     "./site/SiteHeader": "./src/site/SiteHeader.tsx",
     "./site/SiteFooter": "./src/site/SiteFooter.tsx",
     "./server/schemas": "./src/server/schemas.ts",

package/src/admin/describe-log.ts

@@ -37,6 +37,8 @@ export const ACTION_LABELS: Record<string, string> = {
   "page.listing": "Changed whether a page is listed",
   "booking.settings": "Switched booking on or off",
   "booking.exception": "Changed which pages keep booking links",
+  "booking.landing": "Changed which pages are hidden from the website while booking is hidden",
+  "booking.landing.default": "Changed the booking-off landing page message",
   "page.version.create": "Saved page version",
   "page.version.restore": "Restored page version",
   "template.create": "Created block template",