@dwp/govuk-casa 8.1.0 → 8.2.0

package/dist/lib/configuration-ingestor.js

@@ -10,61 +10,10 @@ const Plan_js_1 = __importDefault(require("./Plan.js"));
 const logger_js_1 = __importDefault(require("./logger.js"));
 const utils_js_1 = require("./utils.js");
 /**
- * @typedef {import('./index').ContextEvent} ContextEvent
+ * @typedef {import('../casa').ConfigurationOptions} ConfigurationOptions
  */
 /**
- * @typedef {object} SessionOptions
- * @property {string} [name=casasession] Session name
- * @property {string} [secret=secret] Encryption secret
- * @property {number} [ttl=3600] Session ttl (seconds)
- * @property {boolean} [secure=false] Whether to use secure session cookies
- * @property {boolean|string} [cookieSameSite=true] SameSite (true = Strict)
- * @property {object} [store] Session store (default MemoryStore)
- */
-/**
- * @typedef {object} I18nOptions
- * @property {string[]} dirs Directories to search for locale dictionaries
- * @property {string[]} [locales=['en', 'cy']] Supported locales
- */
-/**
- * @typedef {object} GlobalHook Hook configuration
- * @property {string} hook Hook name in format `<router>.<hook>`
- * @property {Function} middleware Middleware function to insert at the hook point
- * @property {string|RegExp} [path=undefined] Only run if route path matches this string/regexp
- */
-/**
- * @typedef {object} PageHook (extends GlobalHook)
- * @property {string} hook Hook name (without a scope prefix)
- * @property {Function} middleware Middleware function to insert at the hook point
- */
-/**
- * @typedef {object} Page Page configuration. A Page is the interactive representation of a waypoint
- * @property {string} waypoint The waypoint with which this page is associated
- * @property {string} view Template path
- * @property {PageHook[]} [hooks=[]] Page-specific hooks (optional, default [])
- * @property {PageField[]} [fields=[]] Fields to be managed on this page (optional, default [])
- */
-/**
- * @callback HelmetConfigurator
- * @param {object} config A default Helmet configuration provided by CASA
- * @returns {object} The modified configuration object
- */
-/**
- * Configure some middleware for use in creating a new CASA app.
- *
- * `mountUrl` is used to ensure the CSS content uses the correct reference to
- * static assets in the `govuk-frontend` module.
- *
- * @typedef {object} ConfigurationOptions Configuration options
- * @property {string} [mountUrl=/] URL path to root of CASA app
- * @property {string[]} [views=[]] Template directories
- * @property {SessionOptions} [session] Session configuration
- * @property {Page[]} [pages=[]] Pages the represent waypoints
- * @property {GlobalHook[]} [hooks=[]] Hooks to apply
- * @property {object[]} [plugins=[]] Plugins
- * @property {I18nOptions[]} [i18n] I18n configuration
- * @property {Plan} plan CASA Plan
- * @property {ContextEvent[]} [events=[]] Handlers for JourneyContext events
+ * @typedef {import('../casa').HelmetConfigurator} HelmetConfigurator
  */
 const log = (0, logger_js_1.default)('lib:configuration-ingestor');
 const echo = (a) => (a);
@@ -76,7 +25,7 @@ const echo = (a) => (a);
  * @throws {TypeError} For invalid object.
  * @returns {object} Sanitised i18n object.
  */
-function validateI18nObject(i18n, cb = echo) {
+function validateI18nObject(i18n = Object.create(null), cb = echo) {
     if (Object.prototype.toString.call(i18n) !== '[object Object]') {
         throw new TypeError('I18n must be an object');
     }
@@ -91,11 +40,8 @@ exports.validateI18nObject = validateI18nObject;
  * @throws {TypeError} For invalid type.
  * @returns {Array} Array of directories.
  */
-function validateI18nDirs(dirs) {
-    if (typeof dirs === 'undefined') {
-        throw ReferenceError('I18n directories are missing (i18n.dirs)');
-    }
-    else if (!Array.isArray(dirs)) {
+function validateI18nDirs(dirs = []) {
+    if (!Array.isArray(dirs)) {
         throw new TypeError('I18n directories must be an array (i18n.dirs)');
     }
     dirs.forEach((dir, i) => {
@@ -114,11 +60,8 @@ exports.validateI18nDirs = validateI18nDirs;
  * @throws {TypeError} For invalid type.
  * @returns {Array} Array of locales.
  */
-function validateI18nLocales(locales) {
-    if (typeof locales === 'undefined') {
-        throw ReferenceError('I18n locales are missing (i18n.locales)');
-    }
-    else if (!Array.isArray(locales)) {
+function validateI18nLocales(locales = ['en', 'cy']) {
+    if (!Array.isArray(locales)) {
         throw new TypeError('I18n locales must be an array (i18n.locales)');
     }
     locales.forEach((locale, i) => {
@@ -155,7 +98,7 @@ exports.validateMountUrl = validateMountUrl;
  * @throws {TypeError} For invalid object.
  * @returns {object} Sanitised sessions object.
  */
-function validateSessionObject(session, cb = echo) {
+function validateSessionObject(session = Object.create(null), cb = echo) {
     if (session === undefined) {
         return cb(session);
     }
@@ -173,11 +116,8 @@ exports.validateSessionObject = validateSessionObject;
  * @throws {TypeError} For invalid type.
  * @returns {Array} Array of directories.
  */
-function validateViews(dirs) {
-    if (typeof dirs === 'undefined') {
-        throw ReferenceError('View directories are missing (views)');
-    }
-    else if (!Array.isArray(dirs)) {
+function validateViews(dirs = []) {
+    if (!Array.isArray(dirs)) {
         throw new TypeError('View directories must be an array (views)');
     }
     dirs.forEach((dir, i) => {
@@ -214,11 +154,8 @@ exports.validateSessionSecret = validateSessionSecret;
  * @throws {TypeError} For invalid value.
  * @returns {number} Ttl.
  */
-function validateSessionTtl(ttl) {
-    if (typeof ttl === 'undefined') {
-        throw ReferenceError('Session ttl is missing (session.ttl)');
-    }
-    else if (typeof ttl !== 'number') {
+function validateSessionTtl(ttl = 3600) {
+    if (typeof ttl !== 'number') {
         throw new TypeError('Session ttl must be an integer (session.ttl)');
     }
     return ttl;
@@ -227,16 +164,13 @@ exports.validateSessionTtl = validateSessionTtl;
 /**
  * Validates and sanitises sessions name.
  *
- * @param {string} name Session name.
+ * @param {string} [name=casa-session] Session name.
  * @throws {ReferenceError} For missing value type.
  * @throws {TypeError} For invalid value.
  * @returns {string} Name.
  */
-function validateSessionName(name) {
-    if (typeof name === 'undefined') {
-        throw ReferenceError('Session name is missing (session.name)');
-    }
-    else if (typeof name !== 'string') {
+function validateSessionName(name = 'casa-session') {
+    if (typeof name !== 'string') {
         throw new TypeError('Session name must be a string (session.name)');
     }
     return name;
@@ -245,16 +179,13 @@ exports.validateSessionName = validateSessionName;
 /**
  * Validates and sanitises sessions secure flag.
  *
- * @param {boolean} secure Session secure flag.
+ * @param {boolean} [secure=false] Session secure flag.
  * @throws {ReferenceError} For missing value type.
  * @throws {TypeError} For invalid value.
  * @returns {string} Name.
  */
-function validateSessionSecure(secure) {
-    if (typeof secure === 'undefined') {
-        throw ReferenceError('Session secure flag is missing (session.secure)');
-    }
-    else if (typeof secure !== 'boolean') {
+function validateSessionSecure(secure = false) {
+    if (typeof secure !== 'boolean') {
         throw new TypeError('Session secure flag must be boolean (session.secure)');
     }
     return secure;
@@ -371,7 +302,7 @@ const validatePage = (page, index) => {
         throw err;
     }
 };
-function validatePages(pages) {
+function validatePages(pages = []) {
     if (!Array.isArray(pages)) {
         throw new TypeError('Pages must be an array (pages)');
     }
@@ -451,6 +382,9 @@ function ingest(config = {}) {
             dirs: validateI18nDirs(i18n.dirs),
             locales: validateI18nLocales(i18n.locales),
         })),
+        // !!! DEPRECATION NOTICE !!!
+        // This will be removed in next major version
+        //
         // Public URL from which the app will be served
         mountUrl: validateMountUrl(config.mountUrl),
         // Session

package/dist/lib/configure.d.ts

@@ -1,90 +1,19 @@
 /**
- * @typedef {import('express').RequestHandler} ExpressRequestHandler
+ * @typedef {import('../casa').ConfigurationOptions} ConfigurationOptions
  */
 /**
- * @typedef {import('./index').MutableRouter} MutableRouter
+ * @typedef {import('../casa').ConfigurationOptions} ConfigureResult
  */
 /**
- * @typedef {import('./configuration-ingestor').ConfigurationOptions} ConfigurationOptions
- */
-/**
- * @typedef {object} ConfigureResult Result of a call to configure() function
- * @property {nunjucks.Environment} nunjucksEnv Nunjucks environment
- * @property {MutableRouter} staticRouter Router handling all static assets
- * @property {MutableRouter} ancillaryRouter Router handling ancillary routes
- * @property {MutableRouter} journeyRouter Router handling all waypoint requests
- * @property {ExpressRequestHandler[]} preMiddleware Middleware mounted before anything else
- * @property {ExpressRequestHandler[]} postMiddleware Middleware mounted after everything else
- * @property {ExpressRequestHandler[]} csrfMiddleware CSRF get/set middleware (useful for forms)
- * @property {ExpressRequestHandler} sessionMiddleware Session middleware
- * @property {ExpressRequestHandler[]} cookieParserMiddleware Cookie-parsing middleware
- * @property {ExpressRequestHandler[]} i18nMiddleware I18n preparation middleware
- * @property {ExpressRequestHandler} bodyParserMiddleware Body parsing middleware
- * @property {Function} mount Function used to mount all CASA artifacts onto an ExpressJS app
+ * @typedef {import('../casa').Mounter} Mounter
  */
 /**
  * Configure some middleware for use in creating a new CASA app.
  *
- * `mountUrl` is used to ensure the CSS content uses the correct reference to
- * static assets in the `govuk-frontend` module.
- *
  * @param {ConfigurationOptions} config Configuration options
  * @returns {ConfigureResult} Result
  */
 export default function configure(config?: ConfigurationOptions): ConfigureResult;
-export type ExpressRequestHandler = import('express').RequestHandler;
-export type MutableRouter = import('./index').MutableRouter;
-export type ConfigurationOptions = import('./configuration-ingestor').ConfigurationOptions;
-/**
- * Result of a call to configure() function
- */
-export type ConfigureResult = {
-    /**
-     * Nunjucks environment
-     */
-    nunjucksEnv: nunjucks.Environment;
-    /**
-     * Router handling all static assets
-     */
-    staticRouter: MutableRouter;
-    /**
-     * Router handling ancillary routes
-     */
-    ancillaryRouter: MutableRouter;
-    /**
-     * Router handling all waypoint requests
-     */
-    journeyRouter: MutableRouter;
-    /**
-     * Middleware mounted before anything else
-     */
-    preMiddleware: ExpressRequestHandler[];
-    /**
-     * Middleware mounted after everything else
-     */
-    postMiddleware: ExpressRequestHandler[];
-    /**
-     * CSRF get/set middleware (useful for forms)
-     */
-    csrfMiddleware: ExpressRequestHandler[];
-    /**
-     * Session middleware
-     */
-    sessionMiddleware: ExpressRequestHandler;
-    /**
-     * Cookie-parsing middleware
-     */
-    cookieParserMiddleware: ExpressRequestHandler[];
-    /**
-     * I18n preparation middleware
-     */
-    i18nMiddleware: ExpressRequestHandler[];
-    /**
-     * Body parsing middleware
-     */
-    bodyParserMiddleware: ExpressRequestHandler;
-    /**
-     * Function used to mount all CASA artifacts onto an ExpressJS app
-     */
-    mount: Function;
-};
+export type ConfigurationOptions = import('../casa').ConfigurationOptions;
+export type ConfigureResult = import('../casa').ConfigurationOptions;
+export type Mounter = import('../casa').Mounter;

package/dist/lib/configure.js

@@ -3,11 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
 const express_session_1 = require("express-session");
 const path_1 = require("path");
 const module_1 = require("module");
 const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const path_to_regexp_1 = require("path-to-regexp");
 const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
+const utils_js_1 = require("./utils.js");
 const configuration_ingestor_js_1 = __importDefault(require("./configuration-ingestor.js"));
 const nunjucks_js_1 = __importDefault(require("./nunjucks.js"));
 const static_js_1 = __importDefault(require("../routes/static.js"));
@@ -20,36 +23,20 @@ const i18n_js_1 = __importDefault(require("../middleware/i18n.js"));
 const data_js_1 = __importDefault(require("../middleware/data.js"));
 const body_parser_js_1 = __importDefault(require("../middleware/body-parser.js"));
 const csrf_js_1 = __importDefault(require("../middleware/csrf.js"));
+const logger_js_1 = __importDefault(require("./logger.js"));
+const log = (0, logger_js_1.default)('lib:configure');
 /**
- * @typedef {import('express').RequestHandler} ExpressRequestHandler
+ * @typedef {import('../casa').ConfigurationOptions} ConfigurationOptions
  */
 /**
- * @typedef {import('./index').MutableRouter} MutableRouter
+ * @typedef {import('../casa').ConfigurationOptions} ConfigureResult
  */
 /**
- * @typedef {import('./configuration-ingestor').ConfigurationOptions} ConfigurationOptions
- */
-/**
- * @typedef {object} ConfigureResult Result of a call to configure() function
- * @property {nunjucks.Environment} nunjucksEnv Nunjucks environment
- * @property {MutableRouter} staticRouter Router handling all static assets
- * @property {MutableRouter} ancillaryRouter Router handling ancillary routes
- * @property {MutableRouter} journeyRouter Router handling all waypoint requests
- * @property {ExpressRequestHandler[]} preMiddleware Middleware mounted before anything else
- * @property {ExpressRequestHandler[]} postMiddleware Middleware mounted after everything else
- * @property {ExpressRequestHandler[]} csrfMiddleware CSRF get/set middleware (useful for forms)
- * @property {ExpressRequestHandler} sessionMiddleware Session middleware
- * @property {ExpressRequestHandler[]} cookieParserMiddleware Cookie-parsing middleware
- * @property {ExpressRequestHandler[]} i18nMiddleware I18n preparation middleware
- * @property {ExpressRequestHandler} bodyParserMiddleware Body parsing middleware
- * @property {Function} mount Function used to mount all CASA artifacts onto an ExpressJS app
+ * @typedef {import('../casa').Mounter} Mounter
  */
 /**
  * Configure some middleware for use in creating a new CASA app.
  *
- * `mountUrl` is used to ensure the CSS content uses the correct reference to
- * static assets in the `govuk-frontend` module.
- *
  * @param {ConfigurationOptions} config Configuration options
  * @returns {ConfigureResult} Result
  */
@@ -82,7 +69,6 @@ function configure(config = {}) {
     // Prepare a Nunjucks environment for rendering all templates.
     // Resolve priority: userland templates > CASA templates > GOVUK templates > Plugin templates
     const nunjucksEnv = (0, nunjucks_js_1.default)({
-        mountUrl,
         views: [
             ...views,
             (0, path_1.resolve)(dirname_cjs_1.default, '../../views'),
@@ -93,7 +79,7 @@ function configure(config = {}) {
     // These _must_ be added to the ExpressJS application at the start and end
     // of all other middleware respectively.
     const preMiddleware = (0, pre_js_1.default)({ helmetConfigurator });
-    const postMiddleware = (0, post_js_1.default)({ mountUrl });
+    const postMiddleware = (0, post_js_1.default)();
     // Prepare common middleware mounted prior to the ancillaryRouter
     const cookieParserMiddleware = (0, cookie_parser_1.default)(session.secret);
     const sessionMiddleware = (0, session_js_1.default)({
@@ -104,7 +90,6 @@ function configure(config = {}) {
         ttl: session.ttl,
         cookieSameSite: session.cookieSameSite,
         cookiePath: session.cookiePath,
-        mountUrl,
         store: (_b = session.store) !== null && _b !== void 0 ? _b : new express_session_1.MemoryStore(),
     });
     const i18nMiddleware = (0, i18n_js_1.default)({
@@ -117,7 +102,6 @@ function configure(config = {}) {
     });
     const dataMiddleware = (0, data_js_1.default)({
         plan,
-        mountUrl,
         events,
     });
     // Prepare form middleware and its constiuent parts
@@ -125,9 +109,7 @@ function configure(config = {}) {
     const bodyParserMiddleware = (0, body_parser_js_1.default)();
     const csrfMiddleware = (0, csrf_js_1.default)();
     // Setup router to serve up bundled static assets
-    const staticRouter = (0, static_js_1.default)({
-        mountUrl,
-    });
+    const staticRouter = (0, static_js_1.default)();
     // Setup ancillary router default stand-alone pages.
     const ancillaryRouter = (0, ancillary_js_1.default)({
         sessionTtl: session.ttl,
@@ -138,25 +120,85 @@ function configure(config = {}) {
         pages,
         plan,
         csrfMiddleware,
-        mountUrl,
     });
     // Mount function
     // This will mount all of these routes and middleware in the correct order on
     // the given ExpressJS app.
     // Once this is called, you will not be able to modify any of the routers as
     // they will be "sealed".
-    const mount = (app) => {
+    /**
+     * Mounting function.
+     *
+     * @type {Mounter} mount
+     */
+    const mount = (app, { route = '/' } = {}) => {
         nunjucksEnv.express(app);
         app.set('view engine', 'njk');
+        // !!! DEPRECATION NOTICE !!!
+        // This provides a non-breaking pathway to replacing `mountUrl` with
+        // `req.baseUrl` in all internal route handlers/middleware for services
+        // that use a proxy path in their mount point.
+        //
+        // In some cases, the URL on which `app` instance is mounted might include a
+        // proxy path so that it can handle incoming requests that have had a path
+        // prepended to it by an intermediary, such as nginx. This would be common
+        // in a hosting environment that serves several separate applications.
+        //
+        // This bit of middleware removes that proxy path segment from the request
+        // so that all subsequent middleware behave as if it was never present.
+        //
+        // e.g. Where the proxy path is `my-proxy`, then a request to
+        // `/my-proxy/app` will be seen as `/app` in all subsequent middleware, and
+        // all URLs generated for the browser will use `/app`.
+        //
+        // Using `config.mountUrl` rather than `mountUrl` here to test whether the
+        // consumer explicitly set a `mountUrl`, in which case we're dealing with
+        // backwards-compatibility mode.
+        if (config.mountUrl) {
+            log.warn('[DEPRECATION WARNING] Using configuration attribute, mountUrl. This will be removed in an upcoming major version');
+            app.use((req, res, next) => {
+                req.baseUrl = mountUrl.replace(/\/$/, '');
+                next();
+            });
+        }
+        // Attach a handler to redirect requests for `/` to the first waypoint in
+        // the plan
+        if (plan) {
+            const re = (0, path_to_regexp_1.pathToRegexp)(`${route}`.replace(/\/+/g, '/'));
+            app.use(re, (req, res) => {
+                const reqUrl = new URL(req.url, 'https://placeholder.test/');
+                const reqPath = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}${reqUrl.pathname}${plan.getWaypoints()[0]}`);
+                let reqParams = reqUrl.searchParams.toString();
+                reqParams = reqParams ? `?${reqParams}` : '';
+                res.redirect(302, `${reqPath}${reqParams}`);
+            });
+        }
+        // Service static assets from the `app` rather than the `router`. The router
+        // may contain paramaterised path segments which would mean serving static
+        // assets over a dynamic URL each time, thus causing lots of cache misses on
+        // the browser.
+        const sealedStaticRouter = staticRouter.seal();
         app.use(preMiddleware);
-        app.use(staticRouter.seal());
-        app.use(sessionMiddleware); // A session is useful to all pages, so always mounted
-        app.use(i18nMiddleware);
-        app.use(bodyParserMiddleware);
-        app.use(dataMiddleware);
-        app.use(ancillaryRouter.seal());
-        app.use(journeyRouter.seal());
-        app.use(postMiddleware);
+        app.use(sealedStaticRouter);
+        const router = (0, express_1.Router)({
+            // Required so that any parameters in the URL are propagated to middleware
+            mergeParams: true,
+        });
+        router.use(preMiddleware);
+        // !!! DEPRECATE in v9 !!! For performance reasons, static assets will
+        // always be handled via the `app` middleware rather than `router`.
+        // Anywhere `mountUrl` is used in templates to service static assets must be
+        // changed to use `staticMountUrl`.
+        // TASK: remove this line below
+        router.use(sealedStaticRouter);
+        router.use(sessionMiddleware);
+        router.use(i18nMiddleware);
+        router.use(bodyParserMiddleware);
+        router.use(dataMiddleware);
+        router.use(ancillaryRouter.seal());
+        router.use(journeyRouter.seal());
+        router.use(postMiddleware);
+        app.use(route, router);
         return app;
     };
     // Prepare configuration result

package/dist/lib/nunjucks.d.ts

@@ -1,6 +1,5 @@
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -9,12 +8,8 @@
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-export default function nunjucksConfig({ mountUrl, views, }: NunjucksOptions): Environment;
+export default function nunjucksConfig({ views, }: NunjucksOptions): Environment;
 export type NunjucksOptions = {
-    /**
-     * )
-     */
-    mountUrl?: string | undefined;
     /**
      * Template file directories (optional, default [])
      */

package/dist/lib/nunjucks.js

@@ -11,7 +11,6 @@ const CasaTemplateLoader_js_1 = __importDefault(require("./CasaTemplateLoader.js
 const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -20,7 +19,7 @@ const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-function nunjucksConfig({ mountUrl = '/', views = [], }) {
+function nunjucksConfig({ views = [], }) {
     // Prepare a single Nunjucks environment for all responses to use. Note that
     // we cannot prepare response-specific global functions/filters if we use a
     // single environment, but the performance gains of doing so are significant.
@@ -38,7 +37,6 @@ function nunjucksConfig({ mountUrl = '/', views = [], }) {
     env.modifyBlock = loader.modifyBlock.bind(loader);
     // Globals
     // These can't be modified once set. But they can be overridden by res.locals.
-    env.addGlobal('assetPath', `${mountUrl}govuk/assets`); // Required by govuk-frontend layout template
     env.addGlobal('casaVersion', JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../package.json'))).version);
     env.addGlobal('mergeObjects', nunjucks_filters_js_1.mergeObjects);
     env.addGlobal('includes', nunjucks_filters_js_1.includes);

package/dist/lib/utils.d.ts

@@ -1,11 +1,5 @@
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
- */
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 /**
  * Test is a value can be stringifed (numbers or strings)
@@ -40,6 +34,7 @@ export function isEmpty(val: any): boolean;
  */
 export function resolveMiddlewareHooks(hookName: string, path: string, hooks?: Hook[]): Function[];
 export function validateWaypoint(waypoint: any): void;
+export function validateUrlPath(path: any): string;
 export function validateView(view: any): void;
 export function validateHookName(hookName: any): void;
 export function validateHookPath(path: any): void;
@@ -51,6 +46,14 @@ export function validateHookPath(path: any): void;
  * @throws {Error} if proposed key is an invalid keyword
  */
 export function notProto(key: string): string;
-export type GlobalHook = import('./configuration-ingestor').GlobalHook;
-export type PageHook = import('./configuration-ingestor').PageHook;
-export type Hook = GlobalHook | PageHook;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+export function stripProxyFromUrlPath(req: import('express').Request): string;
+export type Hook = import('../casa').GlobalHook | import('../casa').PageHook;

package/dist/lib/utils.js

@@ -1,15 +1,9 @@
 "use strict";
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
- */
+exports.stripProxyFromUrlPath = exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateUrlPath = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
 /**
  * Test is a value can be stringifed (numbers or strings)
  *
@@ -81,6 +75,19 @@ function validateWaypoint(waypoint) {
     }
 }
 exports.validateWaypoint = validateWaypoint;
+function validateUrlPath(path) {
+    if (typeof path !== 'string') {
+        throw new TypeError('URL path must be a string');
+    }
+    if (path.match(/[^/a-z0-9_-]/)) {
+        throw new SyntaxError('URL path must contain only a-z, 0-9, -, _ and / characters');
+    }
+    if (path.match(/\/{2,}/)) {
+        throw new SyntaxError('URL path must not contain consecutive /');
+    }
+    return path;
+}
+exports.validateUrlPath = validateUrlPath;
 function validateView(view) {
     if (typeof view !== 'string') {
         throw new TypeError('View must be a string');
@@ -125,3 +132,28 @@ function notProto(key) {
     return key;
 }
 exports.notProto = notProto;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+function stripProxyFromUrlPath(req) {
+    if (typeof req.app.mountpath !== 'string') {
+        throw new Error('CASA does not currently support multiple mountpaths');
+    }
+    let stripped = '/';
+    const mountPathParts = req.app.mountpath.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    const baseUrlParts = req.baseUrl.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    for (let i = 0, l = mountPathParts.length; i < l; i++) {
+        /* eslint-disable-next-line security/detect-object-injection */
+        if (baseUrlParts.length && mountPathParts[i] === baseUrlParts[0]) {
+            stripped = `${stripped}${baseUrlParts.shift()}/`;
+        }
+    }
+    return stripped;
+}
+exports.stripProxyFromUrlPath = stripProxyFromUrlPath;

package/dist/lib/waypoint-url.js

@@ -32,8 +32,14 @@ function waypointUrl({ waypoint = '', mountUrl = '/', journeyContext, edit = fal
     else {
         url.pathname = `${mountUrl}${waypoint}`;
     }
-    // Attach context id for non-default contexts
-    if (journeyContext && !journeyContext.isDefault() && journeyContext.identity.id) {
+    // Attach context ID as query parameter for non-default contexts.
+    // To avoid messy URLs with duplicated content, this parameter will _not_ be
+    // added if the context ID already appears in the url path, i.e. to avoid
+    // `/path/1234-abcd/waypoint?contextid=1234-abcd` scenarios
+    if (journeyContext
+        && !journeyContext.isDefault()
+        && journeyContext.identity.id
+        && !mountUrl.includes(journeyContext.identity.id)) {
         url.searchParams.append('contextid', journeyContext.identity.id);
     }
     // Attach edit mode flag

package/dist/middleware/body-parser.js

@@ -6,7 +6,7 @@ const rProto = /__proto__/i;
 const rPrototype = /prototype[='"[\]]/i;
 const rConstructor = /constructor[='"[\]]/i;
 function verifyBody(req, res, buf, encoding) {
-    const body = decodeURI(buf.toString(encoding));
+    const body = decodeURI(buf.toString(encoding)).replace(/[\s\u200B-\u200D\uFEFF]/g, '');
     if (rProto.test(body)) {
         throw new Error('Request body verification failed (__proto__)');
     }