@dwp/govuk-casa 8.1.0 → 8.2.0

package/dist/middleware/data.d.ts

@@ -1,5 +1,4 @@
-export default function dataMiddleware({ plan, mountUrl, events, }: {
+export default function dataMiddleware({ plan, events, }: {
     plan: any;
-    mountUrl: any;
     events: any;
 }): ((req: any, res: any, next: any) => void)[];

package/dist/middleware/data.js

@@ -7,6 +7,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const lodash_1 = __importDefault(require("lodash"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const utils_js_1 = require("../lib/utils.js");
 const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const { has } = lodash_1.default;
 const editOrigin = (req) => {
@@ -18,7 +19,7 @@ const editOrigin = (req) => {
     }
     return '';
 };
-function dataMiddleware({ plan, mountUrl, events, }) {
+function dataMiddleware({ plan, events, }) {
     return [
         (req, res, next) => {
             /* ------------------------------------------------ Request decorations */
@@ -34,16 +35,25 @@ function dataMiddleware({ plan, mountUrl, events, }) {
             // Grab chosen language from session
             req.casa.journeyContext.nav.language = req.session.language;
             /* ------------------------------------------------- Template variables */
+            // Figure out the mount URL of the current request
+            const mountUrl = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`.replace(/\/+/g, '/'));
+            // For browser performance reasons, CASA's static assets are potentially
+            // delivered over a different route to the `mountUrl` if this CASA app has
+            // been mounted on a parameterised route.
+            const staticMountUrl = (0, utils_js_1.validateUrlPath)(`${(0, utils_js_1.stripProxyFromUrlPath)(req)}`.replace(/\/+/g, '/'));
             // CASA and userland templates
             res.locals.casa = {
                 mountUrl,
+                staticMountUrl,
                 editMode: req.casa.editMode,
                 editOrigin: req.casa.editOrigin,
             };
             res.locals.locale = req.language;
             // Used by govuk-frontend template
-            // - req.language is provided by i18n-http-middleware
+            //   htmlLang = req.language is provided by i18n-http-middleware
+            //   assetPath = used for linking to static assets in the govuk-frontend module
             res.locals.htmlLang = req.language;
+            res.locals.assetPath = `${staticMountUrl}govuk/assets`;
             // Function for building URLs. This will be curried with the `mountUrl`,
             // `journeyContext`, `edit` and `editOrigin` for convenience. This means
             // the template author does not have to be concerned about the current

package/dist/middleware/post.d.ts

@@ -1,3 +1 @@
-export default function postMiddleware({ mountUrl, }: {
-    mountUrl: any;
-}): ((err: any, req: any, res: any, next: any) => any)[];
+export default function postMiddleware(): ((err: any, req: any, res: any, next: any) => any)[];

package/dist/middleware/post.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // 2 middleware: one as a fallback 404 handler, one to handle thrown errors
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:post');
-function postMiddleware({ mountUrl, }) {
+function postMiddleware() {
     return [
         (req, res) => {
             res.status(404).render('casa/errors/404.njk');
@@ -20,7 +20,7 @@ function postMiddleware({ mountUrl, }) {
             let TEMPLATE = 'casa/errors/500.njk';
             if (!res.locals.t) {
                 res.locals.t = () => ('');
-                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl });
+                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl: `${req.baseUrl}/` });
                 TEMPLATE = 'casa/errors/static.njk';
             }
             // CSRF token is invalid in some way

package/dist/middleware/pre.d.ts

@@ -2,4 +2,4 @@ declare function _default({ helmetConfigurator, }?: {
     helmetConfigurator: HelmetConfigurator;
 }): Function[];
 export default _default;
-export type HelmetConfigurator = import('../lib/configuration-ingestor').HelmetConfigurator;
+export type HelmetConfigurator = import('../casa').HelmetConfigurator;

package/dist/middleware/pre.js

@@ -5,10 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
-const GA_DOMAIN = 'www.google-analytics.com';
+const GA_DOMAIN = '*.google-analytics.com';
+const GA_ANALYTICS_DOMAIN = '*.analytics.google.com';
 const GTM_DOMAIN = 'www.googletagmanager.com';
 /**
- * @typedef {import('../lib/configuration-ingestor').HelmetConfigurator} HelmetConfigurator
+ * @typedef {import('../casa').HelmetConfigurator} HelmetConfigurator
  */
 /**
  * Pre middleware.
@@ -54,8 +55,8 @@ exports.default = ({ helmetConfigurator = (config) => (config), } = {}) => [
             directives: {
                 'default-src': ["'none'"],
                 'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'img-src': ["'self'", GA_DOMAIN],
-                'connect-src': ["'self'", GA_DOMAIN],
+                'img-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
+                'connect-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
                 'frame-src': ["'self'", GTM_DOMAIN],
                 'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],

package/dist/middleware/progress-journey.d.ts

@@ -1,6 +1,5 @@
-declare function _default({ waypoint, plan, mountUrl, }: {
+declare function _default({ waypoint, plan, }: {
     waypoint: any;
     plan: any;
-    mountUrl: any;
 }): ((req: any, res: any, next: any) => void)[];
 export default _default;

package/dist/middleware/progress-journey.js

@@ -20,7 +20,7 @@ const saveAndRedirect = (session, journeyContext, url, res, next) => {
         res.redirect(302, url);
     });
 };
-exports.default = ({ waypoint, plan, mountUrl, }) => [
+exports.default = ({ waypoint, plan, }) => [
     (req, res, next) => {
         // Determine the next available waypoint after the current one
         const traversed = plan.traverse(req.casa.journeyContext);
@@ -68,7 +68,7 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         // Construct the next url
         const nextUrl = (0, waypoint_url_js_1.default)({
             waypoint: nextWaypoint,
-            mountUrl,
+            mountUrl: `${req.baseUrl}/`,
             journeyContext: req.casa.journeyContext,
             edit: req.casa.editMode,
             editOrigin: req.casa.editOrigin,

package/dist/middleware/session.d.ts

@@ -1,10 +1,9 @@
-export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, cookiePath, store, }: {
+export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, cookieSameSite, cookiePath, store, }: {
     cookieParserMiddleware: any;
     secret: any;
     name: any;
     secure: any;
     ttl: any;
-    mountUrl?: string | undefined;
     cookieSameSite?: boolean | undefined;
     cookiePath?: string | undefined;
     store?: any;

package/dist/middleware/session.js

@@ -31,8 +31,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // interrupting their journey.
 const express_session_1 = __importStar(require("express-session"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const utils_js_1 = require("../lib/utils.js");
 const log = (0, logger_js_1.default)('middleware:session');
-const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
+const sessionExpiryMiddleware = (ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
     var _a;
     const lastModified = getCookie(req);
     const age = Math.floor(Date.now() * 0.001) - lastModified;
@@ -50,7 +51,7 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
                 touchCookie(res);
                 if (req.method === 'POST') {
                     log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
-                    res.redirect(302, mountUrl);
+                    res.redirect(302, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`));
                 }
                 else {
                     next();
@@ -73,7 +74,8 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
                     referrer: req.originalUrl,
                     lang: language,
                 });
-                res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+                /* eslint-disable-next-line prefer-template */
+                res.redirect(302, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/session-timeout`) + `?${params.toString()}`);
             }
         });
     }
@@ -87,7 +89,7 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
 // - set the session cookie
 // - parse request cookies
 // - handle expiry of server-side session
-function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
+function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
     const commonCookieOptions = {
         httpOnly: true,
         path: cookiePath,
@@ -126,7 +128,7 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
             store,
         }),
         cookieParserMiddleware,
-        sessionExpiryMiddleware(mountUrl, ttl, getCookie, touchCookie, removeCookie),
+        sessionExpiryMiddleware(ttl, getCookie, touchCookie, removeCookie),
     ];
 }
 exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.d.ts

@@ -1,5 +1,4 @@
-declare function _default({ waypoint, mountUrl, }: {
+declare function _default({ waypoint, }: {
     waypoint: any;
-    mountUrl: any;
 }): ((req: any, res: any, next: any) => any)[];
 export default _default;

package/dist/middleware/skip-waypoint.js

@@ -10,7 +10,7 @@ const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const { has } = lodash_1.default;
 const log = (0, logger_js_1.default)('middleware:skip-waypoint');
-exports.default = ({ waypoint, mountUrl, }) => [
+exports.default = ({ waypoint, }) => [
     (req, res, next) => {
         if (!has(req.query, 'skipto')) {
             return next();
@@ -24,7 +24,7 @@ exports.default = ({ waypoint, mountUrl, }) => [
         });
         JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
         const redirectUrl = (0, waypoint_url_js_1.default)({
-            mountUrl,
+            mountUrl: `${req.baseUrl}/`,
             waypoint: skipTo,
             edit: req.casa.editMode,
             editOrigin: req.casa.editOrigin,

package/dist/middleware/steer-journey.d.ts

@@ -1,7 +1,6 @@
-declare function _default({ waypoint, plan, mountUrl, }: {
+declare function _default({ waypoint, plan, }: {
     waypoint: string;
     plan: Plan;
-    mountUrl: string;
 }): void;
 export default _default;
 export type Plan = typeof import("../lib/Plan");

package/dist/middleware/steer-journey.js

@@ -18,11 +18,11 @@ const log = (0, logger_js_1.default)('middleware:steer-journey');
  * @param {object} obj Options
  * @param {string} obj.waypoint Current waypoint
  * @param {Plan} obj.plan CASA Plan
- * @param {string} obj.mountUrl Mount URL
  * @returns {void}
  */
-exports.default = ({ waypoint, plan, mountUrl, }) => [
+exports.default = ({ waypoint, plan, }) => [
     (req, res, next) => {
+        const mountUrl = `${req.baseUrl}/`;
         // If the requested waypoint doesn't exist in the traversed journey, send
         // the user back to the last good waypoint.
         const traversed = plan.traverse(req.casa.journeyContext);

package/dist/middleware/validate-fields.d.ts

@@ -1,7 +1,6 @@
-declare function _default({ waypoint, fields, mountUrl, plan, }: {
+declare function _default({ waypoint, fields, plan, }: {
     waypoint: any;
     fields?: any[] | undefined;
-    mountUrl: any;
     plan: any;
 }): ((req: any, res: any, next: any) => any)[];
 export default _default;

package/dist/middleware/validate-fields.js

@@ -16,9 +16,10 @@ const updateContext = ({ waypoint, errors = null, journeyContext, session, }) =>
     // Save to session
     JourneyContext_js_1.default.putContext(session, journeyContext);
 };
-exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
+exports.default = ({ waypoint, fields = [], plan, }) => [
     (req, res, next) => {
         var _a, _b;
+        const mountUrl = `${req.baseUrl}/`;
         let errors = [];
         for (let i = 0, l = fields.length; i < l; i++) {
             /* eslint-disable security/detect-object-injection */

package/dist/routes/journey.d.ts

@@ -1,8 +1,7 @@
-export default function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, }: {
+export default function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, }: {
     globalHooks: any;
     pages: any;
     plan: any;
     csrfMiddleware: any;
-    mountUrl: any;
 }): MutableRouter;
 import MutableRouter from "../lib/MutableRouter.js";

package/dist/routes/journey.js

@@ -29,13 +29,14 @@ const renderMiddlewareFactory = (view, contextFactory) => [
         });
     },
 ];
-function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, }) {
+function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, }) {
     // Router
     const router = new MutableRouter_js_1.default();
     // Special "_" route which handles redirecting the user between sub-apps
     // /app1/_/?refmount=app2&route=prev
     router.all('/_', (req, res) => {
         var _a, _b;
+        const mountUrl = `${req.baseUrl}/`;
         const refmount = (_a = req.query) === null || _a === void 0 ? void 0 : _a.refmount;
         const route = (_b = req.query) === null || _b === void 0 ? void 0 : _b.route;
         log.trace(`App root ${mountUrl}: refmount = ${refmount}, route = ${route}`);
@@ -75,7 +76,6 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
     ];
     pages.forEach((page) => {
         const { waypoint, view, hooks: pageHooks = [], fields } = page;
-        const formUrl = (0, waypoint_url_js_1.default)({ mountUrl, waypoint });
         const waypointPath = `/${waypoint}`;
         let commonWaypointMiddleware = [
             (req, res, next) => {
@@ -88,17 +88,17 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
             log.info(`Configuring "${waypoint}" as a skippable waypoint`);
             commonWaypointMiddleware = [
                 ...commonWaypointMiddleware,
-                ...(0, skip_waypoint_js_1.default)({ mountUrl, waypoint }),
+                ...(0, skip_waypoint_js_1.default)({ waypoint }),
             ];
         }
-        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => ({
-            formUrl,
+        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => ({
+            formUrl: (0, waypoint_url_js_1.default)({ mountUrl: `${req.baseUrl}/`, waypoint }),
             formData: req.casa.journeyContext.getDataForPage(waypoint),
         })));
-        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, sanitise_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postsanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.pregather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, gather_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postgather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prevalidate', waypointPath, [...globalHooks, ...pageHooks]), ...(0, validate_fields_js_1.default)({ waypoint, fields, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postvalidate', waypointPath, [...globalHooks, ...pageHooks]), 
+        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, sanitise_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postsanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.pregather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, gather_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postgather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prevalidate', waypointPath, [...globalHooks, ...pageHooks]), ...(0, validate_fields_js_1.default)({ waypoint, fields, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postvalidate', waypointPath, [...globalHooks, ...pageHooks]), 
         // If there were validation errors, jump out of this route and into the
         // next, where the errors will be rendered
-        (req, res, next) => (req.casa.journeyContext.hasValidationErrorsForPage(waypoint) ? next('route') : next()), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.preredirect', waypointPath, [...globalHooks, ...pageHooks]), ...(0, progress_journey_js_1.default)({ waypoint, plan, mountUrl }));
+        (req, res, next) => (req.casa.journeyContext.hasValidationErrorsForPage(waypoint) ? next('route') : next()), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.preredirect', waypointPath, [...globalHooks, ...pageHooks]), ...(0, progress_journey_js_1.default)({ waypoint, plan }));
         router.post(waypointPath, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => {
             var _a;
             const errors = (_a = req.casa.journeyContext.getValidationErrorsForPageByField(waypoint)) !== null && _a !== void 0 ? _a : Object.create(null);
@@ -114,7 +114,7 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
                 href: errors[k][0].fieldHref, /* eslint-disable-line security/detect-object-injection */
             }));
             return {
-                formUrl,
+                formUrl: (0, waypoint_url_js_1.default)({ mountUrl: `${req.baseUrl}/`, waypoint }),
                 formData: req.body,
                 formErrors: Object.keys(errors).length ? errors : null,
                 formErrorsGovukArray: govukErrors.length ? govukErrors : null,

package/dist/routes/static.d.ts

@@ -1,6 +1,5 @@
 /**
  * @typedef {object} StaticOptions Options to configure static router
- * @property {string} [mountUrl=/] URL prefix for govuk-frontend static assets (optional, default /)
  * @property {number} [maxAge=3600000] Cache TTL for all assets (optional, default 1 hour)
  */
 /**
@@ -9,15 +8,11 @@
  * @param {StaticOptions} options Options
  * @returns {MutableRouter} ExpressJS Router instance
  */
-export default function staticRouter({ mountUrl, maxAge, }: StaticOptions): MutableRouter;
+export default function staticRouter({ maxAge, }?: StaticOptions): MutableRouter;
 /**
  * Options to configure static router
  */
 export type StaticOptions = {
-    /**
-     * )
-     */
-    mountUrl?: string | undefined;
     /**
      * Cache TTL for all assets (optional, default 1 hour)
      */

package/dist/routes/static.js

@@ -10,11 +10,11 @@ const path_1 = require("path");
 const module_1 = require("module");
 const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
 const MutableRouter_js_1 = __importDefault(require("../lib/MutableRouter.js"));
+const utils_js_1 = require("../lib/utils.js");
 const { static: ExpressStatic } = express_1.default; // CommonJS
 const oneDay = 86400000;
 /**
  * @typedef {object} StaticOptions Options to configure static router
- * @property {string} [mountUrl=/] URL prefix for govuk-frontend static assets (optional, default /)
  * @property {number} [maxAge=3600000] Cache TTL for all assets (optional, default 1 hour)
  */
 /**
@@ -23,7 +23,7 @@ const oneDay = 86400000;
  * @param {StaticOptions} options Options
  * @returns {MutableRouter} ExpressJS Router instance
  */
-function staticRouter({ mountUrl = '/', maxAge = 3600000, }) {
+function staticRouter({ maxAge = 3600000, } = {}) {
     const router = new MutableRouter_js_1.default();
     const notFoundHandler = (req, res, next) => {
         // Fall through to a general purpose error handler
@@ -52,16 +52,16 @@ function staticRouter({ mountUrl = '/', maxAge = 3600000, }) {
     // The CASA CSS source contains the placeholder `~~~CASA_MOUNT_URL~~~` which
     // must be replaced with the dynamic `mountUrl` to ensure govuk-frontend
     // assets are served from the correct location.
-    const casaCss = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa.css'), { encoding: 'utf8' }).replace(/~~~CASA_MOUNT_URL~~~/g, mountUrl);
-    const casaCssIe8 = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa-ie8.css'), { encoding: 'utf8' }).replace(/~~~CASA_MOUNT_URL~~~/g, mountUrl);
+    const casaCss = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa.css'), { encoding: 'utf8' });
+    const casaCssIe8 = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa-ie8.css'), { encoding: 'utf8' });
     // The static middleware will only server GET/HEAD requests, so we can mount
     // the middleware using `use()` rather than resorting to `get()`
     const govukFrontendDirectory = (0, path_1.resolve)((0, module_1.createRequire)(dirname_cjs_1.default).resolve('govuk-frontend'), '../../');
     router.use('/govuk/assets/js/all.js', ExpressStatic(`${govukFrontendDirectory}/govuk/all.js`, staticConfig));
     router.use('/govuk/assets', ExpressStatic(`${govukFrontendDirectory}/govuk/assets`, staticConfig));
     router.use('/govuk/assets', notFoundHandler);
-    router.use('/casa/assets/css/casa.css', setHeaders, (req, res) => res.send(casaCss));
-    router.use('/casa/assets/css/casa-ie8.css', setHeaders, (req, res) => res.send(casaCssIe8));
+    router.get('/casa/assets/css/casa.css', setHeaders, (req, res) => res.send(casaCss.replace(/~~~CASA_MOUNT_URL~~~/g, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`))));
+    router.get('/casa/assets/css/casa-ie8.css', setHeaders, (req, res) => res.send(casaCssIe8.replace(/~~~CASA_MOUNT_URL~~~/g, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`))));
     router.use('/casa/assets', notFoundHandler);
     return router;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
   "repository": {
     "type": "git",
@@ -43,50 +43,52 @@
   "dependencies": {
     "cookie-parser": "1.4.6",
     "csurf": "1.11.0",
-    "debug": "4.3.3",
+    "debug": "4.3.4",
     "deepmerge": "4.2.2",
-    "express": "4.17.3",
-    "express-session": "1.17.2",
+    "express": "4.18.1",
+    "express-session": "1.17.3",
     "govuk-frontend": "4.0.1",
     "graphlib": "2.1.8",
     "helmet": "5.0.2",
-    "i18next": "21.6.14",
+    "i18next": "21.8.2",
     "i18next-http-middleware": "3.2.0",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "luxon": "2.3.1",
+    "luxon": "2.4.0",
     "nunjucks": "3.2.3",
+    "path-to-regexp": "6.2.1",
     "uuid": "8.3.2",
     "validator": "13.7.0"
   },
   "devDependencies": {
-    "@babel/core": "7.17.5",
+    "@babel/core": "7.17.12",
     "@babel/eslint-parser": "7.17.0",
-    "@babel/preset-env": "7.16.11",
-    "@commitlint/config-conventional": "16.2.1",
+    "@babel/preset-env": "7.17.12",
+    "@commitlint/config-conventional": "17.0.0",
     "@dwp/casa-spiderplan": "2.4.0",
     "@dwp/casa-spiderplan-a11y-plugin": "0.1.4",
     "@dwp/casa-spiderplan-zap-plugin": "0.1.1",
     "@dwp/eslint-config-base": "6.0.0",
     "@types/express": "4.17.13",
-    "@types/node": "17.0.21",
+    "@types/node": "17.0.34",
     "@types/nunjucks": "3.2.1",
     "babel-eslint": "10.1.0",
-    "c8": "7.11.0",
+    "c8": "7.11.3",
     "chai": "4.3.6",
-    "commitlint": "16.2.1",
-    "eslint": "8.10.0",
+    "cheerio": "1.0.0-rc.10",
+    "commitlint": "17.0.0",
+    "eslint": "8.15.0",
     "eslint-plugin-no-unsafe-regex": "1.0.0",
-    "eslint-plugin-security": "1.4.0",
-    "eslint-plugin-sonarjs": "0.12.0",
-    "fast-check": "2.22.0",
-    "husky": "7.0.4",
-    "mocha": "9.2.1",
-    "sass": "1.49.9",
-    "sinon": "13.0.1",
+    "eslint-plugin-security": "1.5.0",
+    "eslint-plugin-sonarjs": "0.13.0",
+    "fast-check": "2.25.0",
+    "husky": "8.0.1",
+    "mocha": "10.0.0",
+    "sass": "1.51.0",
+    "sinon": "14.0.0",
     "sinon-chai": "3.7.0",
-    "standard-version": "9.3.2",
-    "supertest": "6.2.2",
-    "typescript": "4.6.2"
+    "standard-version": "9.5.0",
+    "supertest": "6.2.3",
+    "typescript": "4.6.4"
   }
 }

package/views/casa/components/journey-form/README.md

@@ -4,6 +4,8 @@ Component to wrap your form inputs in a `<form>` that contains all the required
 
 A "Continue" button (and "Cancel" link if in edit mode) will also be added.
 
+- [1.3.5: Identify Input Purpose](https://www.w3.org/WAI/WCAG21/Understanding/identify-input-purpose.html)
+- [<form>: The Form element - autocomplete](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#attr-autocomplete)
 ## Example usage
 
 ```nunjucks
@@ -49,6 +51,7 @@ Note that the submit button is configured to prevent double-clicks and avoid dup
 | Name | Type | Required | Description |
 |------|------|----------|-------------|
 | `formUrl` | string | Yes | The form's "action", available in a `formUrl` template variable |
+| `autoComplete` | string | No | Allows you to override the autocomplete paramater  - the default value is 'off'
 | `csrfToken` | string | Yes | Token used to protect form from CSRF (available to user's templates via the global `casa.csrfToken` variable) |
 | `inEditMode` | boolean | No | Toggle edit-mode of the form (available to page templates using default GET/POST handlers via the local `inEditMode` variable) |
 | `editOriginUrl` | string | No | Absolute URL to the page from which the edit request came (defaults to `review`) (available to user's templates using default GET/POST handlers via the local `editOriginUrl` variable) |

package/views/casa/components/journey-form/template.njk

@@ -1,6 +1,6 @@
 {% from "govuk/components/button/macro.njk" import govukButton %}
 
-<form action="{{ params.formUrl }}" method="post" autocomplete="off" novalidate class="casa-journey-form">
+<form action="{{ params.formUrl }}" method="post" autocomplete="{{ params.autoComplete | default('off', true) }}" novalidate class="casa-journey-form">
   <input type="hidden" name="_csrf" value="{{ params.csrfToken }}" />
   {% if params.inEditMode %}<input type="hidden" name="edit" value="true" />{% endif %}
   {% if params.inEditMode and params.editOriginUrl %}<input type="hidden" name="editorigin" value="{{ params.editOriginUrl }}" />{% endif %}

package/views/casa/partials/scripts.njk

@@ -1,5 +1,5 @@
 <!-- CASA -->
-<script src="{{ casa.mountUrl }}govuk/assets/js/all.js?{{ casaVersion }}"></script>
+<script src="{{ casa.staticMountUrl }}govuk/assets/js/all.js?{{ casaVersion }}"></script>
 <script nonce="{{ cspNonce }}">
 window.GOVUKFrontend.initAll();
 if (window.history.replaceState) {

package/views/casa/partials/styles.njk

@@ -1,6 +1,6 @@
 <!-- CASA -->
-<!--[if gt IE 8]><!--><link href="{{ casa.mountUrl }}casa/assets/css/casa.css?{{ casaVersion }}" rel="stylesheet" /><!--<![endif]-->
+<!--[if gt IE 8]><!--><link href="{{ casa.staticMountUrl }}casa/assets/css/casa.css?{{ casaVersion }}" rel="stylesheet" /><!--<![endif]-->
 <!--[if lte IE 8]>
-<link href="{{ casa.mountUrl }}casa/assets/css/casa-ie8.css?{{ casaVersion }}" rel="stylesheet" />
+<link href="{{ casa.staticMountUrl }}casa/assets/css/casa-ie8.css?{{ casaVersion }}" rel="stylesheet" />
 <![endif]-->
 <!-- /CASA -->