@commonpub/layer 0.3.13 → 0.3.14

package/components/ContentAttachments.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-defineProps<{
+const { attachments } = defineProps<{
   attachments: Array<{ type: string; url: string; name?: string }>;
 }>();
 
@@ -10,6 +10,15 @@ function iconForType(type: string): string {
   return 'fa-solid fa-file';
 }
 
+function isSafeUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === 'https:' || parsed.protocol === 'http:';
+  } catch {
+    return false;
+  }
+}
+
 function fileName(att: { url: string; name?: string }): string {
   if (att.name) return att.name;
   try {
@@ -18,14 +27,18 @@ function fileName(att: { url: string; name?: string }): string {
     return 'attachment';
   }
 }
+
+const safeAttachments = computed(() =>
+  attachments.filter((att) => att.url && att.type && isSafeUrl(att.url)),
+);
 </script>
 
 <template>
-  <div v-if="attachments.length > 0" class="cpub-attachments">
+  <div v-if="safeAttachments.length > 0" class="cpub-attachments">
     <div class="cpub-attachments-label">Attachments</div>
     <div class="cpub-attachments-list">
       <a
-        v-for="(att, i) in attachments"
+        v-for="(att, i) in safeAttachments"
         :key="i"
         :href="att.url"
         target="_blank"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -44,14 +44,14 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/auth": "0.5.0",
-    "@commonpub/config": "0.7.0",
     "@commonpub/docs": "0.5.2",
     "@commonpub/editor": "0.5.0",
     "@commonpub/learning": "0.5.0",
     "@commonpub/protocol": "0.9.4",
+    "@commonpub/server": "2.11.1",
     "@commonpub/schema": "0.8.11",
-    "@commonpub/server": "2.11.0",
+    "@commonpub/auth": "0.5.0",
+    "@commonpub/config": "0.7.0",
     "@commonpub/ui": "0.7.1"
   },
   "scripts": {}

package/pages/hubs/[slug]/posts/[postId].vue

@@ -62,20 +62,22 @@ async function toggleLike(): Promise<void> {
 
 // Mod actions
 async function togglePin(): Promise<void> {
+  const wasPinned = post.value?.isPinned;
   try {
     await $fetch(`/api/hubs/${slug.value}/posts/${postId.value}/pin`, { method: 'POST' });
     await refreshPost();
-    toast.success(post.value?.isPinned ? 'Post unpinned' : 'Post pinned');
+    toast.success(wasPinned ? 'Post unpinned' : 'Post pinned');
   } catch {
     toast.error('Failed to toggle pin');
   }
 }
 
 async function toggleLock(): Promise<void> {
+  const wasLocked = post.value?.isLocked;
   try {
     await $fetch(`/api/hubs/${slug.value}/posts/${postId.value}/lock`, { method: 'POST' });
     await refreshPost();
-    toast.success(post.value?.isLocked ? 'Post unlocked' : 'Post locked');
+    toast.success(wasLocked ? 'Post unlocked' : 'Post locked');
   } catch {
     toast.error('Failed to toggle lock');
   }
@@ -352,7 +354,7 @@ useSeoMeta({
   display: flex; gap: 6px;
 }
 
-.cpub-btn-primary { background: var(--accent); color: #fff; border-color: var(--accent); }
+.cpub-btn-primary { background: var(--accent); color: var(--accent-text, #fff); border-color: var(--accent); }
 .cpub-btn-primary:hover:not(:disabled) { opacity: 0.9; }
 .cpub-btn-primary:disabled { opacity: 0.5; cursor: default; }
 .cpub-btn-danger { color: var(--red); border-color: var(--red); }

package/pages/messages/[conversationId].vue

@@ -2,7 +2,6 @@
 const route = useRoute();
 const conversationId = route.params.conversationId as string;
 
-useSeoMeta({ title: () => `Message — ${participantLabel.value}` });
 definePageMeta({ middleware: 'auth' });
 
 const { user } = useAuth();
@@ -57,17 +56,18 @@ const participantLabel = computed(() => {
   return others.length > 0 ? others.join(', ') : 'Conversation';
 });
 
+useSeoMeta({ title: () => `Message — ${participantLabel.value}` });
+
 async function handleSend(text: string): Promise<void> {
   await $fetch(`/api/messages/${conversationId}` as string, {
     method: 'POST',
     body: { body: text },
   });
   // SSE will pick up the new message, but also do an immediate refresh for responsiveness
-  refresh().then((result: any) => {
-    if (result?.data?.value) {
-      messages.value = result.data.value;
-    }
-  });
+  await refresh();
+  if (initialMessages.value) {
+    messages.value = [...initialMessages.value];
+  }
 }
 </script>
 

package/pages/mirror/[id].vue

@@ -117,6 +117,7 @@ useSeoMeta({
             <p v-if="transformedContent.author.bio" class="cpub-mirror-bio">{{ stripHtml(transformedContent.author.bio) }}</p>
           </div>
         </div>
+        <!-- Content is sanitized on ingest (inboxHandlers.ts → sanitizeHtml). Safe for v-html. -->
         <div v-if="typeof transformedContent.content === 'string'" class="cpub-mirror-body prose" v-html="transformedContent.content" />
         <ContentAttachments v-if="transformedContent.attachments?.length" :attachments="transformedContent.attachments" />
         <div v-if="transformedContent.tags?.length" class="cpub-mirror-tags">
@@ -146,7 +147,7 @@ useSeoMeta({
   display: flex; align-items: center; gap: 4px; font-size: 11px;
 }
 .cpub-fed-banner-follow {
-  margin-left: auto; background: var(--accent); color: #fff; border: none;
+  margin-left: auto; background: var(--accent); color: var(--accent-text, #fff); border: none;
   font-size: 11px; font-weight: 600; padding: 3px 10px; cursor: pointer;
   display: flex; align-items: center; gap: 4px; white-space: nowrap;
 }

package/server/api/federation/dm.post.ts

@@ -2,7 +2,7 @@ import { federateDirectMessage, resolveRemoteHandle } from '@commonpub/server';
 import { z } from 'zod';
 
 const dmSchema = z.object({
-  handle: z.string().min(3),
+  handle: z.string().min(3).regex(/^@?[\w.-]+@[\w.-]+\.\w+$/, 'Invalid federation handle'),
   body: z.string().min(1).max(10000),
 });
 
@@ -18,7 +18,11 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, statusMessage: 'Could not resolve remote user' });
   }
 
-  await federateDirectMessage(db, user.id, resolved.actorUri, input.body, config.instance.domain);
+  try {
+    await federateDirectMessage(db, user.id, resolved.actorUri, input.body, config.instance.domain);
+  } catch {
+    throw createError({ statusCode: 502, statusMessage: 'Failed to deliver message to remote server' });
+  }
 
   return {
     sent: true,

package/server/api/hubs/[slug]/posts/[postId]/like.post.ts

@@ -1,4 +1,4 @@
-import { likePost, unlikePost, hasLikedPost, getHubBySlug, getPostById, federateHubPostLike } from '@commonpub/server';
+import { likePost, unlikePost, hasLikedPost, getHubBySlug, getPostById, federateHubPostLike, checkBan } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event);
@@ -12,6 +12,10 @@ export default defineEventHandler(async (event) => {
   const post = await getPostById(db, postId);
   if (!post || post.hubId !== community.id) throw createError({ statusCode: 404, statusMessage: 'Post not found' });
 
+  // Banned users cannot like posts
+  const ban = await checkBan(db, community.id, user.id);
+  if (ban) throw createError({ statusCode: 403, statusMessage: 'You are banned from this hub' });
+
   const alreadyLiked = await hasLikedPost(db, user.id, postId);
   if (alreadyLiked) {
     await unlikePost(db, user.id, postId);

package/server/api/hubs/[slug]/posts/[postId].put.ts

@@ -14,7 +14,7 @@ export default defineEventHandler(async (event): Promise<HubPostItem> => {
   }
 
   const input = await parseBody(event, editPostSchema);
-  const updated = await editPost(db, postId, user.id, input);
+  const updated = await editPost(db, postId, user.id, community.id, input);
   if (!updated) {
     throw createError({ statusCode: 403, statusMessage: 'Not authorized to edit this post' });
   }