@bygghammar/cms-platform 0.95.0 → 0.97.0

package/src/cms/booking-landing.ts

@@ -0,0 +1,359 @@
+/**
+ * Booking-off landing pages: pages that leave the website's menus and page
+ * lists while booking is hidden, but stay live and indexable for anyone who
+ * arrives from a search engine or a direct link.
+ *
+ * Four things are kept apart on purpose:
+ *
+ * - **Booking availability** — the site-wide switch (`booking`). Unchanged.
+ * - **Discovery** — whether the site's own menus, footer and page cards point
+ *   at the page. A landing page is left out of them while booking is hidden,
+ *   and only then.
+ * - **Indexability** — whether search engines may index it. Unchanged: a
+ *   landing page keeps its canonical address, has no `noindex` and stays in
+ *   the sitemap, so the result people find keeps working.
+ * - **Link-only and offline** — the permanent listing and publication states.
+ *   Unchanged: link-only stays `noindex`, offline stays a 404.
+ *
+ * While booking is hidden a landing page shows a short notice in place of its
+ * booking actions — a heading, a message and optionally a link to somewhere
+ * that is not booking (a contact page, an interest form). The site-wide
+ * default can be replaced field by field for one page. The notice is plain
+ * text: no markup is stored or rendered.
+ *
+ * Client-safe: no server imports.
+ */
+import { isBookingHref } from "./booking-links";
+import type { LocalizedString } from "../i18n/types";
+
+/** Longest values accepted, per locale. */
+export const NOTICE_LIMITS = Object.freeze({
+  heading: 160,
+  body: 1200,
+  ctaLabel: 80,
+  href: 2048,
+});
+
+/** A link on the notice. Its target is never a booking site. */
+export type NoticeCta = { label: LocalizedString; href: string };
+
+/** The site-wide default notice, as stored. */
+export type NoticeContent = {
+  heading: LocalizedString;
+  body: LocalizedString;
+  cta: NoticeCta | null;
+};
+
+/**
+ * One page's replacements for the default. A field that is absent uses the
+ * default; `cta: "none"` shows no link on this page even when the default has
+ * one.
+ */
+export type PageNoticeOverride = {
+  heading?: LocalizedString;
+  body?: LocalizedString;
+  cta?: NoticeCta | "none";
+};
+
+/** The notice a page shows: every field chosen, still localized. */
+export type ResolvedNotice = NoticeContent;
+
+/**
+ * What a landing page says when nobody has written anything: neutral and
+ * true whatever the reason booking is hidden. Swedish is the source locale.
+ */
+export const BUILT_IN_NOTICE: ResolvedNotice = Object.freeze({
+  heading: Object.freeze({
+    sv: "Bokning är inte tillgänglig just nu",
+    en: "Booking is not available right now",
+  }),
+  body: Object.freeze({
+    sv: "Informationen på den här sidan finns kvar. Bokningslänkarna visas igen när bokningen öppnar.",
+    en: "The information on this page is still here. Booking links will be shown again when booking opens.",
+  }),
+  cta: null,
+}) as ResolvedNotice;
+
+/* ------------------------------------------------------------------------ */
+/* Links                                                                     */
+/* ------------------------------------------------------------------------ */
+
+export type CtaHrefProblem =
+  | "empty"
+  | "too-long"
+  | "whitespace"
+  | "unsupported-scheme"
+  | "protocol-relative"
+  | "credentials"
+  | "invalid"
+  | "booking";
+
+export type CtaHrefResult = { ok: true; href: string } | { ok: false; reason: CtaHrefProblem };
+
+/**
+ * Check a notice link as staff typed it.
+ *
+ * Accepted: an address on this site (`/kontakt`, `/intresse?från=resa#form`)
+ * or an `https://` address with a host name. Refused: every other scheme
+ * (`javascript:`, `data:`, `http:`, `mailto:` …), a protocol-relative `//host`
+ * or a backslash (both leave the site in a browser), whitespace or control
+ * characters, a user name or password in the address — and any booking link,
+ * because the notice exists to say booking is not offered here.
+ */
+export function parseNoticeCtaHref(raw: unknown): CtaHrefResult {
+  if (typeof raw !== "string") return { ok: false, reason: "empty" };
+  const value = raw.trim();
+  if (!value) return { ok: false, reason: "empty" };
+  if (value.length > NOTICE_LIMITS.href) return { ok: false, reason: "too-long" };
+  // eslint-disable-next-line no-control-regex
+  if (/[\s\u0000-\u001f\u007f]/.test(value)) return { ok: false, reason: "whitespace" };
+  if (value.includes("\\")) return { ok: false, reason: "protocol-relative" };
+  if (value.startsWith("//")) return { ok: false, reason: "protocol-relative" };
+  if (isBookingHref(value)) return { ok: false, reason: "booking" };
+  if (value.startsWith("/")) return { ok: true, href: value };
+  if (!/^https:\/\//i.test(value)) return { ok: false, reason: "unsupported-scheme" };
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return { ok: false, reason: "invalid" };
+  }
+  if (url.protocol !== "https:" || !url.hostname) return { ok: false, reason: "invalid" };
+  if (url.username || url.password) return { ok: false, reason: "credentials" };
+  return { ok: true, href: value };
+}
+
+export function ctaHrefProblemMessage(reason: CtaHrefProblem): string {
+  switch (reason) {
+    case "empty":
+      return "Enter the address the link opens.";
+    case "too-long":
+      return `The address is longer than ${NOTICE_LIMITS.href} characters.`;
+    case "whitespace":
+      return "The address cannot contain spaces or line breaks.";
+    case "unsupported-scheme":
+      return "Use an address on this site (starting with /) or one starting with https://.";
+    case "protocol-relative":
+      return "Start an address on this site with a single / — // and backslashes lead off the site.";
+    case "credentials":
+      return "The address cannot contain a user name or password.";
+    case "invalid":
+      return "That is not a valid https:// address.";
+    case "booking":
+      return "The link cannot lead to booking: this notice is shown because booking is hidden.";
+  }
+}
+
+/* ------------------------------------------------------------------------ */
+/* Stored values                                                             */
+/* ------------------------------------------------------------------------ */
+
+export class NoticeValidationError extends Error {
+  readonly code = "notice_invalid";
+  constructor(message: string) {
+    super(message);
+    this.name = "NoticeValidationError";
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * A localized text with empty locales dropped. Returns null when nothing is
+ * left. Strict mode (saving) refuses anything over its limit or not a string;
+ * lenient mode (reading what is stored) skips it.
+ */
+function localizedText(
+  raw: unknown,
+  limit: number,
+  field: string,
+  strict: boolean,
+): LocalizedString | null {
+  if (raw == null) return null;
+  if (!isRecord(raw)) {
+    if (strict) throw new NoticeValidationError(`${field} must be text per language.`);
+    return null;
+  }
+  const out: Record<string, string> = {};
+  for (const [locale, value] of Object.entries(raw)) {
+    if (!/^[a-z]{2}(-[a-z0-9]{2,8})?$/i.test(locale)) {
+      if (strict) throw new NoticeValidationError(`${field} has an unknown language "${locale}".`);
+      continue;
+    }
+    if (value == null) continue;
+    if (typeof value !== "string") {
+      if (strict) throw new NoticeValidationError(`${field} must be text.`);
+      continue;
+    }
+    // Plain text: line breaks are kept, other control characters are not.
+    // eslint-disable-next-line no-control-regex
+    const text = value.replace(/\r\n?/g, "\n").replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "").trim();
+    if (!text) continue;
+    if (text.length > limit) {
+      if (strict) {
+        throw new NoticeValidationError(`${field} (${locale.toUpperCase()}) is longer than ${limit} characters.`);
+      }
+      continue;
+    }
+    out[locale] = text;
+  }
+  return Object.keys(out).length > 0 ? (out as LocalizedString) : null;
+}
+
+function cta(raw: unknown, strict: boolean, field: string): NoticeCta | null {
+  if (raw == null) return null;
+  if (!isRecord(raw)) {
+    if (strict) throw new NoticeValidationError(`${field} must have a label and an address.`);
+    return null;
+  }
+  const label = localizedText(raw["label"], NOTICE_LIMITS.ctaLabel, `${field} label`, strict);
+  const href = parseNoticeCtaHref(raw["href"]);
+  if (!label && !href.ok && href.reason === "empty") return null;
+  if (!label) {
+    if (strict) throw new NoticeValidationError(`${field} needs a label.`);
+    return null;
+  }
+  if (!href.ok) {
+    if (strict) throw new NoticeValidationError(`${field}: ${ctaHrefProblemMessage(href.reason)}`);
+    return null;
+  }
+  return { label, href: href.href };
+}
+
+/**
+ * The default notice from staff input (strict) or from a stored row
+ * (lenient). Empty fields stay empty; {@link resolveNotice} falls back to the
+ * built-in copy for them.
+ */
+export function normalizeNoticeContent(raw: unknown, strict: boolean): NoticeContent {
+  const value = isRecord(raw) ? raw : {};
+  if (strict && raw != null && !isRecord(raw)) throw new NoticeValidationError("The notice is not valid.");
+  return {
+    heading: localizedText(value["heading"], NOTICE_LIMITS.heading, "Heading", strict) ?? {},
+    body: localizedText(value["body"], NOTICE_LIMITS.body, "Message", strict) ?? {},
+    cta: cta(value["cta"], strict, "Link"),
+  };
+}
+
+/** One page's replacements, from staff input (strict) or a stored row (lenient). */
+export function normalizePageNoticeOverride(raw: unknown, strict: boolean): PageNoticeOverride {
+  if (raw == null) return {};
+  if (!isRecord(raw)) {
+    if (strict) throw new NoticeValidationError("The page's own notice is not valid.");
+    return {};
+  }
+  const out: PageNoticeOverride = {};
+  const heading = localizedText(raw["heading"], NOTICE_LIMITS.heading, "Heading", strict);
+  if (heading) out.heading = heading;
+  const body = localizedText(raw["body"], NOTICE_LIMITS.body, "Message", strict);
+  if (body) out.body = body;
+  if (raw["cta"] === "none") out.cta = "none";
+  else {
+    const link = cta(raw["cta"], strict, "Link");
+    if (link) out.cta = link;
+  }
+  return out;
+}
+
+function hasText(value: LocalizedString | undefined | null): value is LocalizedString {
+  return Boolean(value && Object.values(value).some((text) => typeof text === "string" && text !== ""));
+}
+
+/**
+ * The notice one page shows: each field from the page's own replacement when
+ * it has one, otherwise from the site default, otherwise the built-in copy.
+ * Locale fallback within a field is the site's usual one, applied when it is
+ * rendered.
+ */
+export function resolveNotice(
+  defaults: NoticeContent | null | undefined,
+  override: PageNoticeOverride | null | undefined,
+): ResolvedNotice {
+  const heading = hasText(override?.heading)
+    ? override!.heading
+    : hasText(defaults?.heading)
+      ? defaults!.heading
+      : BUILT_IN_NOTICE.heading;
+  // A page that replaces the heading but not the message keeps the default
+  // message only if the site wrote one; the built-in message goes with the
+  // built-in heading.
+  const body = hasText(override?.body)
+    ? override!.body
+    : hasText(defaults?.body)
+      ? defaults!.body
+      : hasText(override?.heading) || hasText(defaults?.heading)
+        ? {}
+        : BUILT_IN_NOTICE.body;
+  const link =
+    override?.cta === "none" ? null : override?.cta ? override.cta : (defaults?.cta ?? null);
+  return { heading, body, cta: link };
+}
+
+/** Which fields a page replaces, for the settings list. */
+export function overriddenFields(override: PageNoticeOverride | null | undefined): string[] {
+  const out: string[] = [];
+  if (hasText(override?.heading)) out.push("heading");
+  if (hasText(override?.body)) out.push("message");
+  if (override?.cta === "none") out.push("no link");
+  else if (override?.cta) out.push("link");
+  return out;
+}
+
+/* ------------------------------------------------------------------------ */
+/* Where a notice link leads, as the host's routes say                       */
+/* ------------------------------------------------------------------------ */
+
+/**
+ * What the host knows about its routes, for checking a notice link. The
+ * platform names no route: the host says which of its pages is the booking
+ * page (in every locale, slug and alias) and resolves an address to a page.
+ */
+export type NoticeTargetRoutes = {
+  /** The normalized site path an address leads to, or null when it leaves the site. */
+  internalPath: (href: string) => string | null;
+  /** The page key served at a normalized path, or null. */
+  pageKeyAt: (path: string) => string | null;
+  /** Keys of the site's booking pages. */
+  bookingPageKeys: readonly string[];
+  /** Keys of the pages on the booking-off landing list. */
+  landingPageKeys: ReadonlySet<string>;
+};
+
+export const NOTICE_TARGET_PROBLEMS = Object.freeze({
+  booking: "The link leads to booking. The notice is shown because booking is hidden, so link somewhere else (a contact page or an interest form).",
+  hidden: "The link leads to a page that is hidden from the website while booking is hidden. Link somewhere that stays visible.",
+});
+
+/**
+ * Why a notice may not link to `href`, or null when it may: a booking site,
+ * the host's booking page in any spelling (query strings and fragments do not
+ * matter), or a page on the landing list — that page is hidden whenever the
+ * notice is shown.
+ */
+export function noticeTargetProblem(href: string, routes: NoticeTargetRoutes): string | null {
+  if (isBookingHref(href)) return NOTICE_TARGET_PROBLEMS.booking;
+  const path = routes.internalPath(href);
+  if (path === null) return null;
+  const key = routes.pageKeyAt(path);
+  if (key === null) return null;
+  if (routes.bookingPageKeys.includes(key)) return NOTICE_TARGET_PROBLEMS.booking;
+  if (routes.landingPageKeys.has(key)) return NOTICE_TARGET_PROBLEMS.hidden;
+  return null;
+}
+
+/** Every link address a stored notice or a page's replacement holds. */
+export function noticeLinkHrefs(notice: NoticeContent | PageNoticeOverride | null | undefined): string[] {
+  const cta = notice?.cta;
+  return cta && cta !== "none" && typeof cta.href === "string" ? [cta.href] : [];
+}
+
+/** The notice with its link removed when `blocked` says so; the rest is kept. */
+export function withoutBlockedLink(
+  notice: ResolvedNotice | null,
+  blocked: (href: string) => boolean,
+): ResolvedNotice | null {
+  if (!notice?.cta || !blocked(notice.cta.href)) return notice;
+  return { ...notice, cta: null };
+}

package/src/cms/booking-links.ts

@@ -174,3 +174,27 @@ export function containsBookingTarget(value: unknown): boolean {
 export function withoutBookingPopups<T>(configs: readonly T[]): T[] {
   return configs.filter((config) => !containsBookingTarget(config));
 }
+
+/**
+ * True when any string anywhere inside `value` is, as a whole, an address
+ * `leads` says yes to — a popup's link, a button's or an answer's `openUrl`,
+ * a form's success action. Text inside markup is not read.
+ */
+export function containsLinkTo(value: unknown, leads: (href: string) => boolean): boolean {
+  if (typeof value === "string") return value.trim() !== "" && leads(value);
+  if (Array.isArray(value)) return value.some((item) => containsLinkTo(item, leads));
+  if (value !== null && typeof value === "object") {
+    return Object.values(value as Record<string, unknown>).some((item) => containsLinkTo(item, leads));
+  }
+  return false;
+}
+
+/**
+ * Popups without the ones that lead where `leads` says — for example to a
+ * page hidden while booking is hidden. Withheld whole, for the reason
+ * {@link withoutBookingPopups} gives: a popup has one purpose, and taking only
+ * its button out would leave a promise with no way to act on it.
+ */
+export function withoutPopupsLeadingTo<T>(configs: readonly T[], leads: (href: string) => boolean): T[] {
+  return configs.filter((config) => !containsLinkTo(config, leads));
+}

package/src/cms/page-visibility.ts

@@ -17,6 +17,12 @@
  */
 import type { PublicationState } from "./page-publication";
 import { isPubliclyVisible } from "./page-publication";
+import {
+  resolveNotice,
+  type NoticeContent,
+  type PageNoticeOverride,
+  type ResolvedNotice,
+} from "./booking-landing";
 
 export const PAGE_LISTINGS = ["listed", "link-only"] as const;
 export type PageListing = (typeof PAGE_LISTINGS)[number];
@@ -132,6 +138,14 @@ export type PolicyPage = {
   listing: PageListing;
   /** Booking links in this page's own content stay while booking is off. */
   bookingException: boolean;
+  /**
+   * Chosen as a booking-off landing page: left out of the site's menus and
+   * page lists while booking is off, still live and indexable. Absent in
+   * snapshots made before the feature, which means no.
+   */
+  bookingLanding?: boolean;
+  /** This page's own replacements for the default booking-off notice. */
+  landingNotice?: PageNoticeOverride | null;
 };
 
 /**
@@ -147,6 +161,8 @@ export type PublicPolicySnapshot = {
   pages: PolicyPage[];
   /** The next instant any of this changes on its own (a publication boundary). */
   revalidateAt: number | null;
+  /** The site-wide booking-off notice, when staff wrote one. */
+  landingDefault?: NoticeContent | null;
 };
 
 export const UNKNOWN_PUBLIC_POLICY: PublicPolicySnapshot = Object.freeze({
@@ -193,7 +209,11 @@ export function pageBookingVisible(policy: PublicPolicySnapshot, key: string | n
 
 export type HiddenPageReason = "offline" | "link-only";
 
-/** Pages navigation must not point at, and why. */
+/**
+ * Pages navigation must not point at, and why — the permanent states only.
+ * The sitemap leaves these out too, so booking-off landing pages are not
+ * here: see {@link bookingLandingPages}.
+ */
 export function unlistedPages(
   policy: PublicPolicySnapshot,
 ): Array<{ key: string; reason: HiddenPageReason }> {
@@ -204,3 +224,49 @@ export function unlistedPages(
   }
   return out;
 }
+
+/* ------------------------------------------------------------------------ */
+/* Booking-off landing pages                                                 */
+/* ------------------------------------------------------------------------ */
+
+/**
+ * A page stored both as a booking exception and as a landing page. Neither
+ * screen lets that happen, but rows written before the rule, by hand or by
+ * two editors at the same instant can. Such a page is treated as an
+ * exception only — exactly how it behaved before landing pages existed — and
+ * the settings screen says so.
+ */
+export function isBookingConflict(page: PolicyPage): boolean {
+  return page.bookingException && page.bookingLanding === true;
+}
+
+/**
+ * Is this page a booking-off landing page right now? Only while booking is
+ * off, only for a live page read successfully, and never for a page that is
+ * also a booking exception (see {@link isBookingConflict}).
+ */
+export function pageIsBookingLanding(policy: PublicPolicySnapshot, key: string): boolean {
+  if (!policy.known || policy.bookingEnabled) return false;
+  const page = policyPage(policy, key);
+  return page !== null && page.live && page.bookingLanding === true && !page.bookingException;
+}
+
+/**
+ * Pages to leave out of the site's menus, footer and page lists right now
+ * because booking is off. Not the sitemap, not robots: they stay indexable.
+ * Pages that are offline or link-only are not repeated here — those reasons
+ * come first and keep their own rules.
+ */
+export function bookingLandingPages(policy: PublicPolicySnapshot): string[] {
+  return policy.pages
+    .filter(
+      (page) => page.listing !== "link-only" && pageIsBookingLanding(policy, page.key),
+    )
+    .map((page) => page.key);
+}
+
+/** The notice this page shows right now, or null when it shows none. */
+export function bookingOffNoticeFor(policy: PublicPolicySnapshot, key: string): ResolvedNotice | null {
+  if (!pageIsBookingLanding(policy, key)) return null;
+  return resolveNotice(policy.landingDefault ?? null, policyPage(policy, key)?.landingNotice ?? null);
+}

package/src/forms/form-audit.ts

@@ -2,6 +2,8 @@
 // Every backoffice change to a form (settings + fields) is turned into a list
 // of short change descriptions so the Activity view answers who/what/when.
 
+import { redactUrl } from "../util/redact-url";
+
 export type FormAuditChange = {
   /** Machine scope: "form" | "settings" | "field" */
   scope: "form" | "settings" | "field";
@@ -26,6 +28,24 @@ export type FormSnapshotInput = {
 
 const MAX_LEN = 160;
 
+/** Delivery settings whose value is a credential: the audit says it changed, never what to. */
+const SECRET_SETTING = /secret|token|password|apikey|api_key/i;
+
+/** An address as the audit shows it: its origin only — keys travel in paths and query strings. */
+function addressOnly(v: unknown): unknown {
+  if (typeof v !== "string" || v.trim() === "") return v;
+  const redacted = redactUrl(v.trim());
+  return redacted === "(invalid address)" ? "(not a valid address)" : redacted;
+}
+
+/** A delivery setting's value as the audit may record it. */
+function auditable(group: string, key: string, v: unknown): unknown {
+  if (group !== "private_settings") return v;
+  if (SECRET_SETTING.test(key)) return v == null || v === "" ? v : "(hidden)";
+  if (/url$/i.test(key)) return addressOnly(v);
+  return v;
+}
+
 function short(v: unknown): string {
   if (v == null) return "—";
   if (typeof v === "string") return v.length > MAX_LEN ? `${v.slice(0, MAX_LEN)}…` : v || "—";
@@ -143,8 +163,8 @@ export function diffForms(
       out.push({
         scope: "settings",
         label: `${label}: ${humanKey(k)}`,
-        from: short(a[k]),
-        to: short(b[k]),
+        from: short(auditable(group, k, a[k])),
+        to: short(auditable(group, k, b[k])),
       });
     }
   }