@dwp/govuk-casa 7.0.6 → 8.0.0-beta1

package/lib/validation/rules/postalAddressObject.js

@@ -1,142 +0,0 @@
-/* eslint-disable class-methods-use-this */
-/**
- * Works hand in hand with the core CASA `postalAddressObject` form macro.
- *
- * The errors sent back from this validator are specific to each subfield. For
- * example, if the field name being tested is "address", any errors related to
- * the "postcode" component would be associated with "address[postcode]".
- *
- * Config options:
- *   string|object errorMsg = General error message for the entire address block
- *   string|object errorMsgAddress1 = Error message for address1 part
- *   string|object errorMsgAddress2 = Error message for address2 part
- *   string|object errorMsgAddress3 = Error message for address3 part
- *   string|object errorMsgAddress4 = Error message for address4 part
- *   string|object errorMsgPostcode = Error message for postcode part
- *   int strlenmax = Max. String length for each of the inputs appress[1-4]
- *   array requiredFields = Field parts required (others become optional)
- */
-const ValidationError = require('../ValidationError.js');
-const ValidatorFactory = require('../ValidatorFactory.js');
-const { isObjectType, stringifyInput } = require('../../Util.js');
-
-class PostalAddressObject extends ValidatorFactory {
-  validate(value, dataContext = {}) {
-    const cfg = {
-      requiredFields: ['address1', 'address3', 'postcode'],
-      strlenmax: undefined,
-      errorMsgAddress1: {
-        inline: 'validation:rule.postalAddressObject.address1.inline',
-        summary: 'validation:rule.postalAddressObject.address1.summary',
-        focusSuffix: '[address1]',
-      },
-      errorMsgAddress2: {
-        inline: 'validation:rule.postalAddressObject.address2.inline',
-        summary: 'validation:rule.postalAddressObject.address2.summary',
-        focusSuffix: '[address2]',
-      },
-      errorMsgAddress3: {
-        inline: 'validation:rule.postalAddressObject.address3.inline',
-        summary: 'validation:rule.postalAddressObject.address3.summary',
-        focusSuffix: '[address3]',
-      },
-      errorMsgAddress4: {
-        inline: 'validation:rule.postalAddressObject.address4.inline',
-        summary: 'validation:rule.postalAddressObject.address4.summary',
-        focusSuffix: '[address4]',
-      },
-      errorMsgPostcode: {
-        inline: 'validation:rule.postalAddressObject.postcode.inline',
-        summary: 'validation:rule.postalAddressObject.postcode.summary',
-        focusSuffix: '[postcode]',
-      },
-      errorMsg: {
-        inline: 'validation:rule.postalAddressObject.group.inline',
-        summary: 'validation:rule.postalAddressObject.group.summary',
-        focusSuffix: '[address1]',
-      },
-      ...this.config,
-    };
-
-    /* eslint-disable-next-line require-jsdoc */
-    const objectifyError = (err) => (typeof err === 'string' ? {
-      inline: err,
-      summary: err,
-    } : err);
-
-    // Work out required/optional parts based on config
-    const reqF = Object.create(null);
-    const reqC = cfg.requiredFields;
-    ['address1', 'address2', 'address3', 'address4', 'postcode'].forEach((k) => {
-      reqF[k] = reqC.indexOf(k) > -1;
-    });
-
-    let valid = true;
-    const errorMsgs = [];
-
-    if (typeof value === 'object') {
-      const reAddr = /^[^\s]+[a-z0-9\-,.&#()/\\:;'" ]+$/i;
-      const reAddrLine1 = /^\d+|[^\s]+[a-z0-9\-,.&#()/\\:;'" ]+$/i;
-      // UK Postcode regex taken from the dwp java pc checker
-      // https://github.com/dwp/postcode-format-validation
-      const pc = /^(?![QVX])[A-Z]((?![IJZ])[A-Z][0-9](([0-9]?)|([ABEHMNPRVWXY]?))|([0-9]([0-9]?|[ABCDEFGHJKPSTUW]?))) ?[0-9]((?![CIKMOV])[A-Z]){2}$|^(BFPO)[ ]?[0-9]{1,4}$/i;
-
-      const rePostcode = new RegExp(pc, 'i');
-
-      // [required, regex, strlenmax, error message]
-      const attributes = {
-        address1: [reqF.address1, reAddrLine1, cfg.strlenmax, cfg.errorMsgAddress1],
-        address2: [reqF.address2, reAddr, cfg.strlenmax, cfg.errorMsgAddress2],
-        address3: [reqF.address3, reAddr, cfg.strlenmax, cfg.errorMsgAddress3],
-        address4: [reqF.address4, reAddr, cfg.strlenmax, cfg.errorMsgAddress4],
-        postcode: [reqF.postcode, rePostcode, null, cfg.errorMsgPostcode],
-      };
-      Object.keys(attributes).forEach((k) => {
-        const attr = attributes[k];
-        const hasProperty = Object.prototype.hasOwnProperty.call(value, k);
-        const hasContent = hasProperty && value[k].length > 0;
-
-        const condMissingOrRegexMismatch = (attr[0] || hasContent)
-          && (!hasProperty || !value[k].match(attr[1]));
-        const condExceedStrlen = attr[2] > 0 && hasContent
-          && String(value[k]).length > attr[2];
-
-        if (condMissingOrRegexMismatch || condExceedStrlen) {
-          valid = false;
-          errorMsgs.push(Object.assign(Object.create(null), objectifyError(attr[3]), {
-            fieldKeySuffix: `[${k}]`,
-          }));
-        }
-      });
-    } else {
-      valid = false;
-      errorMsgs.push(cfg.errorMsg);
-    }
-
-    // Build ValidationErrorGroup
-    const errorGroup = errorMsgs.map((err) => (
-      ValidationError.make({ errorMsg: err, dataContext })));
-
-    return valid ? Promise.resolve() : Promise.reject(errorGroup);
-  }
-
-  sanitise(value) {
-    // Only objects are supported
-    if (!isObjectType(value)) {
-      return Object.create(null);
-    }
-
-    // Prune unrecognised attributes, and coerce to Strings
-    const validKeys = ['address1', 'address2', 'address3', 'address4', 'postcode'];
-    const pruned = Object.fromEntries(
-      Object.entries(value).filter(
-        ([k]) => (validKeys.includes(k)),
-      ).map(
-        ([k, v]) => ([k, stringifyInput(v)]),
-      ),
-    );
-    return Object.assign(Object.create(null), pruned);
-  }
-}
-
-module.exports = PostalAddressObject;

package/lib/validation/rules/regex.js

@@ -1,39 +0,0 @@
-/* eslint-disable class-methods-use-this */
-/**
- * Match a string pattern.
- *
- * Config options:
- *   string|object errorMsg = Error message to use on validation failure
- *   RegExp pattern = Regular expression to test against
- *   boolean invert = return reject on positive regex match
- */
-const ValidatorFactory = require('../ValidatorFactory.js');
-const ValidationError = require('../ValidationError.js');
-const { stringifyInput } = require('../../Util.js');
-
-class Regex extends ValidatorFactory {
-  validate(value = '', dataContext = {}) {
-    const invert = this.config.invert || false;
-    const match = value.match(this.config.pattern || /.*/);
-    const valid = invert ? !match : match;
-
-    const errorMsg = this.config.errorMsg || {
-      inline: 'validation:rule.regex.inline',
-      summary: 'validation:rule.regex.summary',
-    };
-
-    return valid ? Promise.resolve() : Promise.reject(ValidationError.make({
-      errorMsg,
-      dataContext,
-    }));
-  }
-
-  sanitise(value) {
-    if (value !== undefined) {
-      return stringifyInput(value);
-    }
-    return undefined;
-  }
-}
-
-module.exports = Regex;

package/lib/validation/rules/required.js

@@ -1,57 +0,0 @@
-/* eslint-disable class-methods-use-this */
-/**
- * Test is value is present.
- *
- * Value is required. The following values will fail this rule:
- *  (all values that satisify `Util.isEmpty()`) plus '\s'
- */
-const {
-  isEmpty, isObjectType, isStringable, stringifyInput,
-} = require('../../Util.js');
-const ValidatorFactory = require('../ValidatorFactory.js');
-const ValidationError = require('../ValidationError.js');
-
-class Required extends ValidatorFactory {
-  validate(value, dataContext = {}) {
-    const {
-      errorMsg = {
-        inline: 'validation:rule.required.inline',
-        summary: 'validation:rule.required.summary',
-      },
-    } = this.config;
-
-    let result;
-    if (!isEmpty(value, {
-      regexRemove: /\s/g,
-    })) {
-      result = Promise.resolve();
-    } else {
-      result = Promise.reject(ValidationError.make({ errorMsg, dataContext }));
-    }
-    return result;
-  }
-
-  sanitise(value) {
-    const coerce = (val) => (stringifyInput(val, undefined));
-
-    if (isStringable(value)) {
-      return stringifyInput(value);
-    }
-
-    // Coerce all elements to Strings.
-    // This only supports one dimensional array, with stringable element.
-    if (Array.isArray(value)) {
-      return value.map(coerce);
-    }
-
-    // Coerce all elements to Strings.
-    // This only supports a one dimensional object, with stringable elements.
-    if (isObjectType(value)) {
-      return Object.fromEntries(Object.entries(value).map(([k, v]) => ([k, coerce(v)])));
-    }
-
-    return undefined;
-  }
-}
-
-module.exports = Required;

package/lib/validation/rules/strlen.js

@@ -1,57 +0,0 @@
-/* eslint-disable class-methods-use-this */
-/**
- * Test the length of a string.
- *
- * Config options:
- *   string|object errorMsgMax = Error message to use on max length failure
- *   string|object errorMsgMin = Error message to use on min length failure
- *   int max = Maximum string length allowed
- *   int min = Minimum string length required
- */
-const ValidatorFactory = require('../ValidatorFactory.js');
-const ValidationError = require('../ValidationError.js');
-const { stringifyInput } = require('../../Util.js');
-
-class Strlen extends ValidatorFactory {
-  validate(inputValue = '', dataContext = {}) {
-    const {
-      errorMsgMax = {
-        inline: 'validation:rule.strlen.max.inline',
-        summary: 'validation:rule.strlen.max.summary',
-      },
-      errorMsgMin = {
-        inline: 'validation:rule.strlen.min.inline',
-        summary: 'validation:rule.strlen.min.summary',
-      },
-      min,
-      max,
-    } = this.config;
-
-    let errorMsg;
-    let valid = true;
-
-    if (typeof max !== 'undefined' && inputValue.length > max) {
-      valid = false;
-      errorMsg = errorMsgMax;
-    }
-
-    if (typeof min !== 'undefined' && inputValue.length < min) {
-      valid = false;
-      errorMsg = errorMsgMin;
-    }
-
-    return valid ? Promise.resolve() : Promise.reject(ValidationError.make({
-      errorMsg,
-      dataContext,
-    }));
-  }
-
-  sanitise(value) {
-    if (value !== undefined) {
-      return stringifyInput(value);
-    }
-    return undefined;
-  }
-}
-
-module.exports = Strlen;

package/lib/validation/rules/wordCount.js

@@ -1,61 +0,0 @@
-/* eslint-disable class-methods-use-this */
-/**
- * Test the number of words in a string.
- *
- * Config options:
- *   string|object errorMsgMax = Error message to use on max length failure
- *   string|object errorMsgMin = Error message to use on min length failure
- *   int max = Maximum word count allowed
- *   int min = Minimum word count required
- */
-const ValidatorFactory = require('../ValidatorFactory.js');
-const ValidationError = require('../ValidationError.js');
-const { stringifyInput } = require('../../Util.js');
-
-class WordCount extends ValidatorFactory {
-  count(input) {
-    return (input.match(/\S+/g) || []).length;
-  }
-
-  validate(inputValue = '', dataContext = {}) {
-    const {
-      errorMsgMax = {
-        inline: 'validation:rule.wordCount.max.inline',
-        summary: 'validation:rule.wordCount.max.summary',
-      },
-      errorMsgMin = {
-        inline: 'validation:rule.wordCount.min.inline',
-        summary: 'validation:rule.wordCount.min.summary',
-      },
-      min,
-      max,
-    } = this.config;
-
-    let errorMsg;
-    let valid = true;
-
-    if (typeof max !== 'undefined' && (inputValue.match(/\S+/g) || []).length > max) {
-      valid = false;
-      errorMsg = errorMsgMax;
-    }
-
-    if (typeof min !== 'undefined' && (inputValue.match(/\S+/g) || []).length < min) {
-      valid = false;
-      errorMsg = errorMsgMin;
-    }
-
-    return valid ? Promise.resolve() : Promise.reject(ValidationError.make({
-      errorMsg,
-      dataContext,
-    }));
-  }
-
-  sanitise(value) {
-    if (value !== undefined) {
-      return stringifyInput(value);
-    }
-    return undefined;
-  }
-}
-
-module.exports = WordCount;

package/lib/view-filters/formatDateObject.js

@@ -1,35 +0,0 @@
-/**
- * Format a given date object into a string.
- *
- * Requires NodeJS >= 14
- */
-
-const { DateTime } = require('luxon');
-
-/**
- * Format a given date.
- *
- * `date` may be any of the following types:
- *   object - {dd:'', mm:'', yyyy:''}
- *
- * @param  {object} date Date (see supported formats above)
- * @param  {object} config Holds locale
- * @returns {string} Formatted date
- */
-module.exports = function formatDateObject(date, config = {}) {
-  const { locale = 'en' } = config;
-
-  if (
-    Object.prototype.toString.call(date) === '[object Object]'
-    && 'yyyy' in date
-    && 'mm' in date
-    && 'dd' in date
-  ) {
-    return DateTime.fromObject({
-      year: Math.max(0, parseInt(date.yyyy, 10)),
-      month: Math.max(0, parseInt(date.mm, 10)),
-      day: Math.max(1, parseInt(date.dd, 10)),
-    }).setLocale(locale).toFormat('d MMMM yyyy');
-  }
-  return 'INVALID DATE OBJECT';
-};

package/lib/view-filters/includes.js

@@ -1,10 +0,0 @@
-/**
- * Test if an array includes the given element.
- *
- * @param  {Array} source Array to search.
- * @param  {any} search Element to search for.
- * @returns {boolean} Result.
- */
-module.exports = function includes(source = [], search = '') {
-  return source.includes(search);
-};

package/lib/view-filters/index.js

@@ -1,23 +0,0 @@
-/**
- * This is a convenience script that will attach all filters in this directory
- * to the given Nunjucks environment.
- */
-
-const formatDateObject = require('./formatDateObject.js');
-const renderAsAttributes = require('./renderAsAttributes.js');
-const mergeObjectsDeep = require('./mergeObjectsDeep.js');
-const includes = require('./includes.js');
-
-/**
- * Load filters into the given Nunjucks environment
- *
- * @param {any} env Nunjucks environment
- * @returns {void}
- */
-module.exports = (env) => {
-  env.addFilter('formatDateObject', formatDateObject);
-  env.addFilter('renderAsAttributes', renderAsAttributes);
-  env.addGlobal('mergeObjects', mergeObjectsDeep);
-  env.addGlobal('mergeObjectsDeep', mergeObjectsDeep);
-  env.addGlobal('includes', includes);
-};

package/lib/view-filters/mergeObjectsDeep.js

@@ -1,21 +0,0 @@
-const merge = require('lodash.merge');
-
-/**
- * Merge the given objects. The first object given will _not_ be mutated.
- *
- * @param {...any} objects Objects to be merged.
- * @returns {object} Merged object.
- * @throws {TypeError} When attempting to merge a non-object
- */
-module.exports = function mergeObjectsDeep(...objects) {
-  // Validate
-  if (!objects || !objects.length) {
-    throw new Error('You must specify some objects to merge');
-  }
-  objects.forEach((o) => {
-    if (Object.prototype.toString.call(o) !== '[object Object]') {
-      throw new TypeError('Cannot merge objects of type %s', Object.prototype.toString.call(o));
-    }
-  });
-  return merge(Object.create(null), ...objects);
-};

package/lib/view-filters/renderAsAttributes.js

@@ -1,33 +0,0 @@
-/**
- * Renders a given attributes object into a format suitable for adding to an
- * HTML element.
- */
-
-const nunjucks = require('nunjucks');
-
-/**
- * Attribute values will be HTML/attribute escaped.
- *
- * Example:
- *   Given: {class: 'basic', 'data-ga': 3}
- *   Output: class="basic" data-ga="3"
- *
- * @param  {object} attrsObject Attributes object (in name:value pairs)
- * @returns {string} Formatted
- */
-module.exports = function renderAsAttributes(attrsObject) {
-  const attrsList = [];
-  if (typeof attrsObject === 'object') {
-    Object.keys(attrsObject).forEach((key) => {
-      const value = String(attrsObject[key]).replace(/[<>"'&]/g, (m) => ({
-        '<': '&lt;',
-        '>': '&gt;',
-        '"': '&quot;',
-        '\'': '&#039;',
-        '&': '&amp;',
-      }[m]));
-      attrsList.push(`${key}="${value}"`);
-    });
-  }
-  return new nunjucks.runtime.SafeString(attrsList.join(' '));
-};

package/middleware/errors/404.js

@@ -1,12 +0,0 @@
-/**
- * 404 handler.
- *
- * This middleware must be the last non-error middleware defined in the
- * stack as it handles the last case when all other middleware have been
- * exhausted.
- */
-
-module.exports = (logger) => (req, res) => {
-  logger.info('[404] %s', req.url);
-  res.status(404).render('casa/errors/404.njk');
-};

package/middleware/errors/catch-all.js

@@ -1,27 +0,0 @@
-/**
- * Catch-all unhandled routing exceptions.
- *
- * This must be the last handler in the entire middleware chain to ensure it
- * catches errors from all previous middleware functions.
- */
-
-/* eslint-disable-next-line no-unused-vars */
-module.exports = (logger) => (err, req, res, next) => {
-  if (err.code === 'EBADCSRFTOKEN') {
-    logger.info('[403] CSRF token missing/invalid');
-    res.status(403).render('casa/errors/403.njk');
-  } else if (err.type === 'entity.verify.failed') {
-    logger.info('[403] Request payload blocked');
-    res.status(403).render('casa/errors/403.njk');
-  } else if (!res.headersSent) {
-    logger.error('[500] Internal Server Error (rendered page) - %s - %s', err.message, err.stack.toString());
-    res.status(500).render('casa/errors/500.njk');
-  } else {
-    // This is usually caused by a session save operation failing after the
-    // page has already been rendered. So to the end user, the page will appear
-    // as normal. It is only when they attempt to POST that they may see the
-    // proper `500.njk` error page, because at that point the session is
-    // explicitly saved (and error checked) prior to rendering.
-    logger.error('[500] Internal Server Error (unrendered; headers already sent) - %s - %s', err.message, err.stack.toString());
-  }
-};

package/middleware/errors/index.js

@@ -1,9 +0,0 @@
-const logger = require('../../lib/Logger.js')('errors');
-
-const mw404 = require('./404.js');
-const mwCatchAll = require('./catch-all.js');
-
-module.exports = (app) => {
-  app.use(mw404(logger));
-  app.use(mwCatchAll(logger));
-};

package/middleware/headers/config-defaults.js

@@ -1,57 +0,0 @@
-/**
- * Generates and returns some default HTTP headers for use in all requests,
- * and sets a few global Express defaults.
- */
-
-module.exports = (app, cspConfig = {}) => {
-  // ETags are disabled by default here. See also "static" middleware, where
-  // they are re-enabled on a case-by-case basis.
-  app.set('etag', false);
-
-  // Remove powered by express header
-  app.set('x-powered-by', false);
-
-  // Prepare common CSP directives
-  // Content-Security-Policy directives
-  const csp = cspConfig;
-  const cspKeyScriptSrc = 'script-src';
-  let cspDirectives = Object.getOwnPropertyNames(csp).length > 0 ? csp : {
-    [cspKeyScriptSrc]: [],
-  };
-
-  // CASA requires these script-src entries to be included in the CSP
-  const requiredScriptSources = [
-    '\'self\'',
-    // hash of inline GOV.UK template JS to add 'js-enabled' body class
-    '\'sha256-+6WnXIl4mbFTCARd8N3COQmT3bJJmo32N8q8ZSQAIcU=\'',
-    'https://www.google-analytics.com/',
-    'https://www.googletagmanager.com/',
-  ];
-
-  if (!Object.prototype.hasOwnProperty.call(cspDirectives, cspKeyScriptSrc)) {
-    cspDirectives[cspKeyScriptSrc] = [];
-  }
-
-  requiredScriptSources.forEach((source) => {
-    if (cspDirectives[cspKeyScriptSrc].indexOf(source) === -1) {
-      cspDirectives[cspKeyScriptSrc].push(source);
-    }
-  });
-
-  // Compile the CSP
-  cspDirectives = Object.keys(cspDirectives).map((directive) => `${directive} ${cspDirectives[directive].join(' ')}`);
-
-  // Prepare default headers
-  // added X-Robots-Tag based on https://www.gov.uk/service-manual/technology/get-a-domain-name
-  const defaultHeaders = {
-    'X-Content-Type-Options': 'nosniff',
-    'X-XSS-Protection': '1; mode=block',
-    'X-Frame-Options': 'DENY',
-    'Content-Security-Policy': cspDirectives.join('; '),
-    'X-Robots-Tag': 'noindex, nofollow',
-  };
-
-  return {
-    defaultHeaders,
-  };
-};

package/middleware/headers/headers.js

@@ -1,40 +0,0 @@
-/**
- * Apply HTTP headers to all requests.
- */
-
-const isStaticAsset = /.*\.(js|jpe?g|css|png|svg|woff2?|eot|ttf|otf)/;
-const isIE8 = /MSIE\s*8/i;
-const oneDay = 86400000;
-
-module.exports = (logger, defaultHeaders = {}, disabledHeaders = []) => (req, res, next) => {
-  logger.trace('apply headers to %s %s', req.method.toUpperCase(), req.url);
-
-  const headers = Object.assign(Object.create(null), defaultHeaders);
-
-  // X-XSS-Protection introduces a security bug into IE8, so disable it if IE8
-  if (isIE8.test(req.headers['user-agent'])) {
-    logger.trace('disabling xss protection for IE8');
-    headers['X-XSS-Protection'] = '0';
-  }
-
-  // Caching policy
-  // Cache static assets more agressively
-  if (isStaticAsset.test(req.url)) {
-    headers['Cache-Control'] = 'public';
-    headers.Pragma = 'cache';
-    headers.Expires = new Date(Date.now() + oneDay).toUTCString();
-  } else {
-    headers['Cache-Control'] = 'no-cache, no-store, must-revalidate, private';
-    headers.Pragma = 'no-cache';
-    headers.Expires = 0;
-  }
-
-  // Write headers
-  Object.keys(headers).forEach((k) => {
-    if (disabledHeaders.indexOf(k) === -1) {
-      res.setHeader(k, headers[k]);
-    }
-  });
-
-  next();
-};

package/middleware/headers/index.js

@@ -1,9 +0,0 @@
-const logger = require('../../lib/Logger.js')('headers');
-
-const mwHeaders = require('./headers.js');
-const config = require('./config-defaults.js');
-
-module.exports = (app, cspConfig = {}, disabledHeadersConfig = []) => {
-  const { defaultHeaders } = config(app, cspConfig);
-  app.use(mwHeaders(logger, defaultHeaders, disabledHeadersConfig));
-};