@datagouv/components-next 1.0.2-dev.181 → 1.0.2-dev.183

package/dist/{vue3-xml-viewer.common-B1KPK4L4.js → vue3-xml-viewer.common-BBV8Gl3e.js}

@@ -1,4 +1,4 @@
-import { g as Ke } from "./main-DD4ieUAo.js";
+import { g as Ke } from "./main-OEOVgq_i.js";
 import We from "vue";
 function Fe($, K) {
   for (var V = 0; V < K.length; V++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagouv/components-next",
-  "version": "1.0.2-dev.181",
+  "version": "1.0.2-dev.183",
   "private": false,
   "type": "module",
   "engines": {

package/src/composables/useResourceCapabilities.ts

@@ -1,14 +1,13 @@
 import { computed, type MaybeRefOrGetter, toValue } from 'vue'
 import { useComponentsConfig } from '../config'
 import { isOrganizationCertified } from '../functions/organizations'
-import { getWfsExportFormats } from '../functions/resourceCapabilities'
+import { getGeneratedFormats, getWfsExportFormats } from '../functions/resourceCapabilities'
 import { detectOgcService, getParsingErrorMessage, getParsingErrorStep, isImagePreviewFormat } from '../functions/resources'
 import type { Dataset, DatasetV2 } from '../types/datasets'
 import type { Resource, WfsMetadata } from '../types/resources'
 import { useHasTabularData } from './useHasTabularData'
 import { useTranslation } from './useTranslation'
 
-const GENERATED_FORMATS = ['parquet', 'pmtiles', 'geojson']
 const URL_FORMATS = ['url', 'doi', 'www:link', 'www:link-1.0-http--link', 'www:link-1.0-http--partners', 'www:link-1.0-http--related', 'www:link-1.0-http--samples']
 
 // Which preview the data tab shows. Single source of truth: the viewer renders it and
@@ -54,24 +53,7 @@ export function useResourceCapabilities(
   const hasPmtilesError = computed(() => getParsingErrorStep(toValue(resource)) === 'pmtiles_export')
   const pmtilesError = computed(() => hasPmtilesError.value ? getParsingErrorMessage(toValue(resource)) : null)
 
-  const generatedFormats = computed(() => {
-    const r = toValue(resource)
-    const formats = GENERATED_FORMATS
-      .filter(format => `analysis:parsing:${format}_url` in r.extras)
-      .map(format => ({
-        url: r.extras[`analysis:parsing:${format}_url`] as string,
-        size: r.extras[`analysis:parsing:${format}_size`] as number | undefined,
-        format,
-      }))
-    if ('analysis:parsing:parsing_table' in r.extras) {
-      formats.push({
-        url: `${config.tabularApiUrl}/api/resources/${r.id}/data/json/`,
-        size: undefined,
-        format: 'json',
-      })
-    }
-    return formats
-  })
+  const generatedFormats = computed(() => getGeneratedFormats(toValue(resource), config.tabularApiUrl))
 
   const wfsFormats = computed(() => {
     return getWfsExportFormats(toValue(resource))

package/src/functions/helpers.ts

@@ -38,6 +38,21 @@ export const summarize = (val: number, fractionDigits = 0) => {
   return `${toFixedIfNotZero(val)}Y`
 }
 
+// Guards any value that ends up in an `href`: only absolute http(s) URLs are allowed.
+// Some of these URLs come from resource extras, which are freely writable by the
+// resource owner, so an unguarded value could carry a `javascript:` or `data:` scheme
+// and execute in the platform origin when a visitor clicks the link.
+export const isSafeHttpUrl = (value: unknown): value is string => {
+  if (typeof value !== 'string') return false
+  try {
+    const { protocol } = new URL(value)
+    return protocol === 'http:' || protocol === 'https:'
+  }
+  catch {
+    return false
+  }
+}
+
 export const escapeCsvValue = (value: string | number | null | undefined): string => {
   if (value === null || value === undefined || value === '') {
     return ''

package/src/functions/metrics.ts

@@ -31,49 +31,73 @@ export type ReuseMetrics = {
   visitsTotal: number
 }
 
+type MonthlyVisitsRow = { metric_month: string, monthly_visit: number }
+type MonthlyDatasetRow = MonthlyVisitsRow & { monthly_download_resource: number }
+type MonthlyOrganizationRow = {
+  metric_month: string
+  monthly_download_resource: number
+  monthly_visit_dataservice: number
+  monthly_visit_dataset: number
+  monthly_visit_reuse: number
+}
+
+type TotalVisitsRow = { visit: number }
+type TotalDatasetRow = TotalVisitsRow & { download_resource: number }
+type TotalOrganizationRow = {
+  download_resource: number
+  visit_dataservice: number
+  visit_dataset: number
+  visit_reuse: number
+}
+
+/**
+ * The metrics API is a separate service that answers over the network, so a call fails in
+ * three ways: the request itself, an error status, or a body that isn't the expected page
+ * of rows. Rejecting on the last two turns them into the same failure as the first, which
+ * callers already hand to `useAsyncData` — reading `page.data` straight would instead throw
+ * a `TypeError` a few lines later, naming a symptom rather than the service.
+ */
+async function fetchMetrics<Row>(url: string): Promise<Array<Row>> {
+  const response = await fetch(url)
+  if (!response.ok) throw new Error(`The metrics API answered ${response.status} for ${url}`)
+
+  const page: { data?: Array<Row> } = await response.json()
+  if (!Array.isArray(page?.data)) throw new Error(`The metrics API answered an unexpected body for ${url}`)
+
+  return page.data
+}
+
 /**
  * There is only one metrics API endpoint to get these 3 values.
  * The rest of the metrics aren't stored yet at the organization level
  */
 export async function getOrganizationMetrics(oid: string, metricsApi: string): Promise<OrganizationMetrics> {
   // Fetching last 12 months
-  const response = await fetch(`${metricsApi}/api/organizations/data/?organization_id__exact=${oid}&metric_month__sort=desc&page_size=12`)
-  const page = await response.json()
+  const rows = await fetchMetrics<MonthlyOrganizationRow>(`${metricsApi}/api/organizations/data/?organization_id__exact=${oid}&metric_month__sort=desc&page_size=12`)
 
   const dataservicesViews: Record<string, number> = {}
   const datasetsViews: Record<string, number> = {}
   const downloads: Record<string, number> = {}
   const reusesViews: Record<string, number> = {}
 
-  for (const { metric_month, monthly_download_resource, monthly_visit_dataservice, monthly_visit_dataset, monthly_visit_reuse } of page.data) {
+  for (const { metric_month, monthly_download_resource, monthly_visit_dataservice, monthly_visit_dataset, monthly_visit_reuse } of rows) {
     dataservicesViews[metric_month] = monthly_visit_dataservice
     datasetsViews[metric_month] = monthly_visit_dataset
     downloads[metric_month] = monthly_download_resource
     reusesViews[metric_month] = monthly_visit_reuse
   }
   // Fetching totals
-  const totalResponse = await fetch(`${metricsApi}/api/organizations_total/data/?organization_id__exact=${oid}`)
-  const totalPage = await totalResponse.json()
-
-  let dataservicesViewsTotal = 0
-  let datasetsViewsTotal = 0
-  let downloadsTotal = 0
-  let reusesViewsTotal = 0
-  if (page.data[0]) {
-    dataservicesViewsTotal = totalPage.data[0].visit_dataservice
-    datasetsViewsTotal = totalPage.data[0].visit_dataset
-    downloadsTotal = totalPage.data[0].download_resource
-    reusesViewsTotal = totalPage.data[0].visit_reuse
-  }
+  const total = (await fetchMetrics<TotalOrganizationRow>(`${metricsApi}/api/organizations_total/data/?organization_id__exact=${oid}`))[0]
+
   return {
     downloads,
-    downloadsTotal,
+    downloadsTotal: total?.download_resource ?? 0,
     reusesViews,
-    reusesViewsTotal,
+    reusesViewsTotal: total?.visit_reuse ?? 0,
     dataservicesViews,
-    dataservicesViewsTotal,
+    dataservicesViewsTotal: total?.visit_dataservice ?? 0,
     datasetsViews,
-    datasetsViewsTotal,
+    datasetsViewsTotal: total?.visit_dataset ?? 0,
   }
 }
 
@@ -89,33 +113,24 @@ export function createOrganizationMetricsUrl(datasetsViews: Record<string, numbe
 
 export async function getDatasetMetrics(datasetId: string, metricsApi: string): Promise<DatasetMetrics> {
   // Fetching last 12 months
-  const response = await fetch(`${metricsApi}/api/datasets/data/?dataset_id__exact=${datasetId}&metric_month__sort=desc&page_size=12`)
-  const page = await response.json()
+  const rows = await fetchMetrics<MonthlyDatasetRow>(`${metricsApi}/api/datasets/data/?dataset_id__exact=${datasetId}&metric_month__sort=desc&page_size=12`)
 
   const visits: Record<string, number> = {}
   const downloads: Record<string, number> = {}
 
-  for (const { metric_month, monthly_visit, monthly_download_resource } of page.data) {
+  for (const { metric_month, monthly_visit, monthly_download_resource } of rows) {
     visits[metric_month] = monthly_visit
     downloads[metric_month] = monthly_download_resource
   }
 
   // Fetching totals
-  const totalResponse = await fetch(`${metricsApi}/api/datasets_total/data/?dataset_id__exact=${datasetId}`)
-  const totalPage = await totalResponse.json()
-
-  let visitsTotal = 0
-  let downloadsTotal = 0
-  if (totalPage.data[0]) {
-    visitsTotal = totalPage.data[0].visit
-    downloadsTotal = totalPage.data[0].download_resource
-  }
+  const total = (await fetchMetrics<TotalDatasetRow>(`${metricsApi}/api/datasets_total/data/?dataset_id__exact=${datasetId}`))[0]
 
   return {
     visits,
-    visitsTotal,
+    visitsTotal: total?.visit ?? 0,
     downloads,
-    downloadsTotal,
+    downloadsTotal: total?.download_resource ?? 0,
   }
 }
 
@@ -151,52 +166,38 @@ export async function createDatasetsForOrganizationMetricsUrl(organizationId: st
 
 export async function getDataserviceMetrics(dataserviceId: string, metricsApi: string): Promise<DataserviceMetrics> {
   // Fetching last 12 months
-  const response = await fetch(`${metricsApi}/api/dataservices/data/?dataservice_id__exact=${dataserviceId}&metric_month__sort=desc&page_size=12`)
-  const page = await response.json()
+  const rows = await fetchMetrics<MonthlyVisitsRow>(`${metricsApi}/api/dataservices/data/?dataservice_id__exact=${dataserviceId}&metric_month__sort=desc&page_size=12`)
 
   const visits: Record<string, number> = {}
 
-  for (const { metric_month, monthly_visit } of page.data) {
+  for (const { metric_month, monthly_visit } of rows) {
     visits[metric_month] = monthly_visit
   }
 
   // Fetching totals
-  const totalResponse = await fetch(`${metricsApi}/api/dataservices_total/data/?dataservice_id__exact=${dataserviceId}`)
-  const totalPage = await totalResponse.json()
-
-  let visitsTotal = 0
-  if (totalPage.data[0]) {
-    visitsTotal = totalPage.data[0].visit
-  }
+  const total = (await fetchMetrics<TotalVisitsRow>(`${metricsApi}/api/dataservices_total/data/?dataservice_id__exact=${dataserviceId}`))[0]
 
   return {
     visits,
-    visitsTotal,
+    visitsTotal: total?.visit ?? 0,
   }
 }
 
 export async function getReuseMetrics(reuseId: string, metricsApi: string): Promise<ReuseMetrics> {
   // Fetching last 12 months
-  const response = await fetch(`${metricsApi}/api/reuses/data/?reuse_id__exact=${reuseId}&metric_month__sort=desc&page_size=12`)
-  const page = await response.json()
+  const rows = await fetchMetrics<MonthlyVisitsRow>(`${metricsApi}/api/reuses/data/?reuse_id__exact=${reuseId}&metric_month__sort=desc&page_size=12`)
 
   const visits: Record<string, number> = {}
 
-  for (const { metric_month, monthly_visit } of page.data) {
+  for (const { metric_month, monthly_visit } of rows) {
     visits[metric_month] = monthly_visit
   }
 
   // Fetching totals
-  const totalResponse = await fetch(`${metricsApi}/api/reuses_total/data/?reuse_id__exact=${reuseId}`)
-  const totalPage = await totalResponse.json()
-
-  let visitsTotal = 0
-  if (totalPage.data[0]) {
-    visitsTotal = totalPage.data[0].visit
-  }
+  const total = (await fetchMetrics<TotalVisitsRow>(`${metricsApi}/api/reuses_total/data/?reuse_id__exact=${reuseId}`))[0]
 
   return {
     visits,
-    visitsTotal,
+    visitsTotal: total?.visit ?? 0,
   }
 }

package/src/functions/resourceCapabilities.ts

@@ -1,4 +1,35 @@
 import type { Resource, WfsMetadata, OgcLayerInfo } from '../types/resources'
+import { isSafeHttpUrl } from './helpers'
+
+const GENERATED_FORMATS = ['parquet', 'pmtiles', 'geojson']
+
+export type GeneratedFormat = {
+  url: string
+  size: number | undefined
+  format: string
+}
+
+export function getGeneratedFormats(resource: Pick<Resource, 'extras' | 'id'>, tabularApiUrl: string | undefined): GeneratedFormat[] {
+  const formats: GeneratedFormat[] = GENERATED_FORMATS.flatMap((format) => {
+    const url = resource.extras[`analysis:parsing:${format}_url`]
+    // The URL is read verbatim from owner-writable extras: drop any entry that is not
+    // a plain http(s) URL so a `javascript:`/`data:` value never reaches an href.
+    if (!isSafeHttpUrl(url)) return []
+    return [{
+      url,
+      size: resource.extras[`analysis:parsing:${format}_size`] as number | undefined,
+      format,
+    }]
+  })
+  if ('analysis:parsing:parsing_table' in resource.extras) {
+    formats.push({
+      url: `${tabularApiUrl}/api/resources/${resource.id}/data/json/`,
+      size: undefined,
+      format: 'json',
+    })
+  }
+  return formats
+}
 
 const WFS_EXPORT_FORMATS = [
   {
@@ -46,6 +77,9 @@ export function getWfsExportFormats(resource: Pick<Resource, 'extras' | 'url'>)
   const outputFormats = wfsMetadata.output_formats.map((format: string) => format.toLowerCase())
   const layer = wfsMetadata.detected_layer
   if (!layer) return []
+  // Every download URL below is built on top of `resource.url`, so its scheme is the one
+  // of `resource.url`: guard it once here rather than on each of the built URLs.
+  if (!isSafeHttpUrl(resource.url)) return []
   const formats = WFS_EXPORT_FORMATS.filter(format => outputFormats.includes(format.mimetype.toLowerCase()))
     .map(format => ({
       url: buildWfsDownloadUrl(resource.url, wfsMetadata, format, layer),