@dwp/govuk-casa 8.1.0 → 8.2.2

package/dist/lib/configure.js

@@ -3,16 +3,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
 const express_session_1 = require("express-session");
 const path_1 = require("path");
 const module_1 = require("module");
 const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const path_to_regexp_1 = require("path-to-regexp");
 const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
+const utils_js_1 = require("./utils.js");
 const configuration_ingestor_js_1 = __importDefault(require("./configuration-ingestor.js"));
 const nunjucks_js_1 = __importDefault(require("./nunjucks.js"));
 const static_js_1 = __importDefault(require("../routes/static.js"));
 const ancillary_js_1 = __importDefault(require("../routes/ancillary.js"));
 const journey_js_1 = __importDefault(require("../routes/journey.js"));
+const strip_proxy_path_js_1 = __importDefault(require("../middleware/strip-proxy-path.js"));
 const pre_js_1 = __importDefault(require("../middleware/pre.js"));
 const post_js_1 = __importDefault(require("../middleware/post.js"));
 const session_js_1 = __importDefault(require("../middleware/session.js"));
@@ -21,35 +25,17 @@ const data_js_1 = __importDefault(require("../middleware/data.js"));
 const body_parser_js_1 = __importDefault(require("../middleware/body-parser.js"));
 const csrf_js_1 = __importDefault(require("../middleware/csrf.js"));
 /**
- * @typedef {import('express').RequestHandler} ExpressRequestHandler
+ * @typedef {import('../casa').ConfigurationOptions} ConfigurationOptions
  */
 /**
- * @typedef {import('./index').MutableRouter} MutableRouter
+ * @typedef {import('../casa').ConfigurationOptions} ConfigureResult
  */
 /**
- * @typedef {import('./configuration-ingestor').ConfigurationOptions} ConfigurationOptions
- */
-/**
- * @typedef {object} ConfigureResult Result of a call to configure() function
- * @property {nunjucks.Environment} nunjucksEnv Nunjucks environment
- * @property {MutableRouter} staticRouter Router handling all static assets
- * @property {MutableRouter} ancillaryRouter Router handling ancillary routes
- * @property {MutableRouter} journeyRouter Router handling all waypoint requests
- * @property {ExpressRequestHandler[]} preMiddleware Middleware mounted before anything else
- * @property {ExpressRequestHandler[]} postMiddleware Middleware mounted after everything else
- * @property {ExpressRequestHandler[]} csrfMiddleware CSRF get/set middleware (useful for forms)
- * @property {ExpressRequestHandler} sessionMiddleware Session middleware
- * @property {ExpressRequestHandler[]} cookieParserMiddleware Cookie-parsing middleware
- * @property {ExpressRequestHandler[]} i18nMiddleware I18n preparation middleware
- * @property {ExpressRequestHandler} bodyParserMiddleware Body parsing middleware
- * @property {Function} mount Function used to mount all CASA artifacts onto an ExpressJS app
+ * @typedef {import('../casa').Mounter} Mounter
  */
 /**
  * Configure some middleware for use in creating a new CASA app.
  *
- * `mountUrl` is used to ensure the CSS content uses the correct reference to
- * static assets in the `govuk-frontend` module.
- *
  * @param {ConfigurationOptions} config Configuration options
  * @returns {ConfigureResult} Result
  */
@@ -61,7 +47,7 @@ function configure(config = {}) {
         plugin.configure(config);
     });
     // Extract config
-    const { mountUrl = '/', views = [], session = {
+    const { mountUrl, views = [], session = {
         secret: 'secret',
         name: 'casasession',
         secure: false,
@@ -82,7 +68,6 @@ function configure(config = {}) {
     // Prepare a Nunjucks environment for rendering all templates.
     // Resolve priority: userland templates > CASA templates > GOVUK templates > Plugin templates
     const nunjucksEnv = (0, nunjucks_js_1.default)({
-        mountUrl,
         views: [
             ...views,
             (0, path_1.resolve)(dirname_cjs_1.default, '../../views'),
@@ -93,7 +78,7 @@ function configure(config = {}) {
     // These _must_ be added to the ExpressJS application at the start and end
     // of all other middleware respectively.
     const preMiddleware = (0, pre_js_1.default)({ helmetConfigurator });
-    const postMiddleware = (0, post_js_1.default)({ mountUrl });
+    const postMiddleware = (0, post_js_1.default)();
     // Prepare common middleware mounted prior to the ancillaryRouter
     const cookieParserMiddleware = (0, cookie_parser_1.default)(session.secret);
     const sessionMiddleware = (0, session_js_1.default)({
@@ -104,7 +89,6 @@ function configure(config = {}) {
         ttl: session.ttl,
         cookieSameSite: session.cookieSameSite,
         cookiePath: session.cookiePath,
-        mountUrl,
         store: (_b = session.store) !== null && _b !== void 0 ? _b : new express_session_1.MemoryStore(),
     });
     const i18nMiddleware = (0, i18n_js_1.default)({
@@ -117,7 +101,6 @@ function configure(config = {}) {
     });
     const dataMiddleware = (0, data_js_1.default)({
         plan,
-        mountUrl,
         events,
     });
     // Prepare form middleware and its constiuent parts
@@ -125,9 +108,7 @@ function configure(config = {}) {
     const bodyParserMiddleware = (0, body_parser_js_1.default)();
     const csrfMiddleware = (0, csrf_js_1.default)();
     // Setup router to serve up bundled static assets
-    const staticRouter = (0, static_js_1.default)({
-        mountUrl,
-    });
+    const staticRouter = (0, static_js_1.default)();
     // Setup ancillary router default stand-alone pages.
     const ancillaryRouter = (0, ancillary_js_1.default)({
         sessionTtl: session.ttl,
@@ -138,25 +119,63 @@ function configure(config = {}) {
         pages,
         plan,
         csrfMiddleware,
-        mountUrl,
     });
     // Mount function
     // This will mount all of these routes and middleware in the correct order on
     // the given ExpressJS app.
     // Once this is called, you will not be able to modify any of the routers as
     // they will be "sealed".
-    const mount = (app) => {
+    /**
+     * Mounting function.
+     *
+     * @type {Mounter} mount
+     */
+    const mount = (app, { route = '/' } = {}) => {
         nunjucksEnv.express(app);
         app.set('view engine', 'njk');
+        // If a `mountUrl` has been defined, then we're potentially in "proxy mode",
+        // in which we strip the proxy path prefix from the incoming request URLs.
+        if (mountUrl) {
+            app.use((0, strip_proxy_path_js_1.default)({ mountUrl }));
+        }
+        // Attach a handler to redirect requests for `/` to the first waypoint in
+        // the plan
+        if (plan) {
+            const re = (0, path_to_regexp_1.pathToRegexp)(`${route}`.replace(/\/+/g, '/'));
+            app.use(re, (req, res) => {
+                const reqUrl = new URL(req.url, 'https://placeholder.test/');
+                const reqPath = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}${reqUrl.pathname}${plan.getWaypoints()[0]}`);
+                let reqParams = reqUrl.searchParams.toString();
+                reqParams = reqParams ? `?${reqParams}` : '';
+                res.redirect(302, `${reqPath}${reqParams}`);
+            });
+        }
+        // Service static assets from the `app` rather than the `router`. The router
+        // may contain paramaterised path segments which would mean serving static
+        // assets over a dynamic URL each time, thus causing lots of cache misses on
+        // the browser.
+        const sealedStaticRouter = staticRouter.seal();
         app.use(preMiddleware);
-        app.use(staticRouter.seal());
-        app.use(sessionMiddleware); // A session is useful to all pages, so always mounted
-        app.use(i18nMiddleware);
-        app.use(bodyParserMiddleware);
-        app.use(dataMiddleware);
-        app.use(ancillaryRouter.seal());
-        app.use(journeyRouter.seal());
-        app.use(postMiddleware);
+        app.use(sealedStaticRouter);
+        const router = (0, express_1.Router)({
+            // Required so that any parameters in the URL are propagated to middleware
+            mergeParams: true,
+        });
+        router.use(preMiddleware);
+        // !!! DEPRECATE in v9 !!! For performance reasons, static assets will
+        // always be handled via the `app` middleware rather than `router`.
+        // Anywhere `mountUrl` is used in templates to service static assets must be
+        // changed to use `staticMountUrl`.
+        // TASK: remove this line below
+        router.use(sealedStaticRouter);
+        router.use(sessionMiddleware);
+        router.use(i18nMiddleware);
+        router.use(bodyParserMiddleware);
+        router.use(dataMiddleware);
+        router.use(ancillaryRouter.seal());
+        router.use(journeyRouter.seal());
+        router.use(postMiddleware);
+        app.use(route, router);
         return app;
     };
     // Prepare configuration result

package/dist/lib/nunjucks.d.ts

@@ -1,6 +1,5 @@
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -9,12 +8,8 @@
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-export default function nunjucksConfig({ mountUrl, views, }: NunjucksOptions): Environment;
+export default function nunjucksConfig({ views, }: NunjucksOptions): Environment;
 export type NunjucksOptions = {
-    /**
-     * )
-     */
-    mountUrl?: string | undefined;
     /**
      * Template file directories (optional, default [])
      */

package/dist/lib/nunjucks.js

@@ -11,7 +11,6 @@ const CasaTemplateLoader_js_1 = __importDefault(require("./CasaTemplateLoader.js
 const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
 /**
  * @typedef {object} NunjucksOptions
- * @property {string} [mountUrl=/] Mount URL (optional, default /)
  * @property {string[]} [views=[]] Template file directories (optional, default [])
  */
 /**
@@ -20,7 +19,7 @@ const nunjucks_filters_js_1 = require("./nunjucks-filters.js");
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-function nunjucksConfig({ mountUrl = '/', views = [], }) {
+function nunjucksConfig({ views = [], }) {
     // Prepare a single Nunjucks environment for all responses to use. Note that
     // we cannot prepare response-specific global functions/filters if we use a
     // single environment, but the performance gains of doing so are significant.
@@ -38,7 +37,6 @@ function nunjucksConfig({ mountUrl = '/', views = [], }) {
     env.modifyBlock = loader.modifyBlock.bind(loader);
     // Globals
     // These can't be modified once set. But they can be overridden by res.locals.
-    env.addGlobal('assetPath', `${mountUrl}govuk/assets`); // Required by govuk-frontend layout template
     env.addGlobal('casaVersion', JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../package.json'))).version);
     env.addGlobal('mergeObjects', nunjucks_filters_js_1.mergeObjects);
     env.addGlobal('includes', nunjucks_filters_js_1.includes);

package/dist/lib/utils.d.ts

@@ -1,11 +1,5 @@
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
- */
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 /**
  * Test is a value can be stringifed (numbers or strings)
@@ -40,6 +34,7 @@ export function isEmpty(val: any): boolean;
  */
 export function resolveMiddlewareHooks(hookName: string, path: string, hooks?: Hook[]): Function[];
 export function validateWaypoint(waypoint: any): void;
+export function validateUrlPath(path: any): string;
 export function validateView(view: any): void;
 export function validateHookName(hookName: any): void;
 export function validateHookPath(path: any): void;
@@ -51,6 +46,14 @@ export function validateHookPath(path: any): void;
  * @throws {Error} if proposed key is an invalid keyword
  */
 export function notProto(key: string): string;
-export type GlobalHook = import('./configuration-ingestor').GlobalHook;
-export type PageHook = import('./configuration-ingestor').PageHook;
-export type Hook = GlobalHook | PageHook;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+export function stripProxyFromUrlPath(req: import('express').Request): string;
+export type Hook = import('../casa').GlobalHook | import('../casa').PageHook;

package/dist/lib/utils.js

@@ -1,15 +1,9 @@
 "use strict";
 /**
- * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
+ * @typedef {import('../casa').GlobalHook | import('../casa').PageHook} Hook
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
-/**
- * @typedef {import('./configuration-ingestor').PageHook} PageHook
- */
-/**
- * @typedef {GlobalHook | PageHook} Hook
- */
+exports.stripProxyFromUrlPath = exports.notProto = exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateUrlPath = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
 /**
  * Test is a value can be stringifed (numbers or strings)
  *
@@ -81,6 +75,19 @@ function validateWaypoint(waypoint) {
     }
 }
 exports.validateWaypoint = validateWaypoint;
+function validateUrlPath(path) {
+    if (typeof path !== 'string') {
+        throw new TypeError('URL path must be a string');
+    }
+    if (path.match(/[^/a-z0-9_-]/)) {
+        throw new SyntaxError('URL path must contain only a-z, 0-9, -, _ and / characters');
+    }
+    if (path.match(/\/{2,}/)) {
+        throw new SyntaxError('URL path must not contain consecutive /');
+    }
+    return path;
+}
+exports.validateUrlPath = validateUrlPath;
 function validateView(view) {
     if (typeof view !== 'string') {
         throw new TypeError('View must be a string');
@@ -125,3 +132,28 @@ function notProto(key) {
     return key;
 }
 exports.notProto = notProto;
+/**
+ * Remove any path segments from the URL that are present in the `mountpath`,
+ * but not in the `baseUrl`. Those segments are considered to be part of an
+ * internal proxying arrangement, and should not be used by CASA.
+ *
+ * @param {import('express').Request} req Express request
+ * @throws {Error} When multiple mountpaths are present
+ * @returns {string} URL path with any proxy prefixes removed
+ */
+function stripProxyFromUrlPath(req) {
+    if (typeof req.app.mountpath !== 'string') {
+        throw new Error('CASA does not currently support multiple mountpaths');
+    }
+    let stripped = '/';
+    const mountPathParts = req.app.mountpath.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    const baseUrlParts = req.baseUrl.replace(/^\/+/, '').replace(/\/+$/, '').split('/');
+    for (let i = 0, l = mountPathParts.length; i < l; i++) {
+        /* eslint-disable-next-line security/detect-object-injection */
+        if (baseUrlParts.length && mountPathParts[i] === baseUrlParts[0]) {
+            stripped = `${stripped}${baseUrlParts.shift()}/`;
+        }
+    }
+    return stripped;
+}
+exports.stripProxyFromUrlPath = stripProxyFromUrlPath;

package/dist/lib/waypoint-url.js

@@ -32,8 +32,14 @@ function waypointUrl({ waypoint = '', mountUrl = '/', journeyContext, edit = fal
     else {
         url.pathname = `${mountUrl}${waypoint}`;
     }
-    // Attach context id for non-default contexts
-    if (journeyContext && !journeyContext.isDefault() && journeyContext.identity.id) {
+    // Attach context ID as query parameter for non-default contexts.
+    // To avoid messy URLs with duplicated content, this parameter will _not_ be
+    // added if the context ID already appears in the url path, i.e. to avoid
+    // `/path/1234-abcd/waypoint?contextid=1234-abcd` scenarios
+    if (journeyContext
+        && !journeyContext.isDefault()
+        && journeyContext.identity.id
+        && !mountUrl.includes(journeyContext.identity.id)) {
         url.searchParams.append('contextid', journeyContext.identity.id);
     }
     // Attach edit mode flag

package/dist/middleware/body-parser.js

@@ -6,7 +6,7 @@ const rProto = /__proto__/i;
 const rPrototype = /prototype[='"[\]]/i;
 const rConstructor = /constructor[='"[\]]/i;
 function verifyBody(req, res, buf, encoding) {
-    const body = decodeURI(buf.toString(encoding));
+    const body = decodeURI(buf.toString(encoding)).replace(/[\s\u200B-\u200D\uFEFF]/g, '');
     if (rProto.test(body)) {
         throw new Error('Request body verification failed (__proto__)');
     }

package/dist/middleware/data.d.ts

@@ -1,5 +1,4 @@
-export default function dataMiddleware({ plan, mountUrl, events, }: {
+export default function dataMiddleware({ plan, events, }: {
     plan: any;
-    mountUrl: any;
     events: any;
 }): ((req: any, res: any, next: any) => void)[];

package/dist/middleware/data.js

@@ -7,6 +7,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const lodash_1 = __importDefault(require("lodash"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const utils_js_1 = require("../lib/utils.js");
 const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const { has } = lodash_1.default;
 const editOrigin = (req) => {
@@ -18,7 +19,7 @@ const editOrigin = (req) => {
     }
     return '';
 };
-function dataMiddleware({ plan, mountUrl, events, }) {
+function dataMiddleware({ plan, events, }) {
     return [
         (req, res, next) => {
             /* ------------------------------------------------ Request decorations */
@@ -34,16 +35,25 @@ function dataMiddleware({ plan, mountUrl, events, }) {
             // Grab chosen language from session
             req.casa.journeyContext.nav.language = req.session.language;
             /* ------------------------------------------------- Template variables */
+            // Figure out the mount URL of the current request
+            const mountUrl = (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`.replace(/\/+/g, '/'));
+            // For browser performance reasons, CASA's static assets are potentially
+            // delivered over a different route to the `mountUrl` if this CASA app has
+            // been mounted on a parameterised route.
+            const staticMountUrl = (0, utils_js_1.validateUrlPath)(`${(0, utils_js_1.stripProxyFromUrlPath)(req)}`.replace(/\/+/g, '/'));
             // CASA and userland templates
             res.locals.casa = {
                 mountUrl,
+                staticMountUrl,
                 editMode: req.casa.editMode,
                 editOrigin: req.casa.editOrigin,
             };
             res.locals.locale = req.language;
             // Used by govuk-frontend template
-            // - req.language is provided by i18n-http-middleware
+            //   htmlLang = req.language is provided by i18n-http-middleware
+            //   assetPath = used for linking to static assets in the govuk-frontend module
             res.locals.htmlLang = req.language;
+            res.locals.assetPath = `${staticMountUrl}govuk/assets`;
             // Function for building URLs. This will be curried with the `mountUrl`,
             // `journeyContext`, `edit` and `editOrigin` for convenience. This means
             // the template author does not have to be concerned about the current

package/dist/middleware/post.d.ts

@@ -1,3 +1 @@
-export default function postMiddleware({ mountUrl, }: {
-    mountUrl: any;
-}): ((err: any, req: any, res: any, next: any) => any)[];
+export default function postMiddleware(): ((err: any, req: any, res: any, next: any) => any)[];

package/dist/middleware/post.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // 2 middleware: one as a fallback 404 handler, one to handle thrown errors
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:post');
-function postMiddleware({ mountUrl, }) {
+function postMiddleware() {
     return [
         (req, res) => {
             res.status(404).render('casa/errors/404.njk');
@@ -20,7 +20,7 @@ function postMiddleware({ mountUrl, }) {
             let TEMPLATE = 'casa/errors/500.njk';
             if (!res.locals.t) {
                 res.locals.t = () => ('');
-                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl });
+                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl: `${req.baseUrl}/` });
                 TEMPLATE = 'casa/errors/static.njk';
             }
             // CSRF token is invalid in some way

package/dist/middleware/pre.d.ts

@@ -2,4 +2,4 @@ declare function _default({ helmetConfigurator, }?: {
     helmetConfigurator: HelmetConfigurator;
 }): Function[];
 export default _default;
-export type HelmetConfigurator = import('../lib/configuration-ingestor').HelmetConfigurator;
+export type HelmetConfigurator = import('../casa').HelmetConfigurator;

package/dist/middleware/pre.js

@@ -5,10 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
-const GA_DOMAIN = 'www.google-analytics.com';
+const GA_DOMAIN = '*.google-analytics.com';
+const GA_ANALYTICS_DOMAIN = '*.analytics.google.com';
 const GTM_DOMAIN = 'www.googletagmanager.com';
 /**
- * @typedef {import('../lib/configuration-ingestor').HelmetConfigurator} HelmetConfigurator
+ * @typedef {import('../casa').HelmetConfigurator} HelmetConfigurator
  */
 /**
  * Pre middleware.
@@ -54,8 +55,8 @@ exports.default = ({ helmetConfigurator = (config) => (config), } = {}) => [
             directives: {
                 'default-src': ["'none'"],
                 'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'img-src': ["'self'", GA_DOMAIN],
-                'connect-src': ["'self'", GA_DOMAIN],
+                'img-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
+                'connect-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
                 'frame-src': ["'self'", GTM_DOMAIN],
                 'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],

package/dist/middleware/progress-journey.d.ts

@@ -1,6 +1,5 @@
-declare function _default({ waypoint, plan, mountUrl, }: {
+declare function _default({ waypoint, plan, }: {
     waypoint: any;
     plan: any;
-    mountUrl: any;
 }): ((req: any, res: any, next: any) => void)[];
 export default _default;

package/dist/middleware/progress-journey.js

@@ -20,7 +20,7 @@ const saveAndRedirect = (session, journeyContext, url, res, next) => {
         res.redirect(302, url);
     });
 };
-exports.default = ({ waypoint, plan, mountUrl, }) => [
+exports.default = ({ waypoint, plan, }) => [
     (req, res, next) => {
         // Determine the next available waypoint after the current one
         const traversed = plan.traverse(req.casa.journeyContext);
@@ -68,7 +68,7 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         // Construct the next url
         const nextUrl = (0, waypoint_url_js_1.default)({
             waypoint: nextWaypoint,
-            mountUrl,
+            mountUrl: `${req.baseUrl}/`,
             journeyContext: req.casa.journeyContext,
             edit: req.casa.editMode,
             editOrigin: req.casa.editOrigin,

package/dist/middleware/session.d.ts

@@ -1,10 +1,9 @@
-export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, cookiePath, store, }: {
+export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, cookieSameSite, cookiePath, store, }: {
     cookieParserMiddleware: any;
     secret: any;
     name: any;
     secure: any;
     ttl: any;
-    mountUrl?: string | undefined;
     cookieSameSite?: boolean | undefined;
     cookiePath?: string | undefined;
     store?: any;

package/dist/middleware/session.js

@@ -31,8 +31,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // interrupting their journey.
 const express_session_1 = __importStar(require("express-session"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const utils_js_1 = require("../lib/utils.js");
 const log = (0, logger_js_1.default)('middleware:session');
-const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
+const sessionExpiryMiddleware = (ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
     var _a;
     const lastModified = getCookie(req);
     const age = Math.floor(Date.now() * 0.001) - lastModified;
@@ -50,7 +51,7 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
                 touchCookie(res);
                 if (req.method === 'POST') {
                     log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
-                    res.redirect(302, mountUrl);
+                    res.redirect(302, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`));
                 }
                 else {
                     next();
@@ -73,7 +74,8 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
                     referrer: req.originalUrl,
                     lang: language,
                 });
-                res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+                /* eslint-disable-next-line prefer-template */
+                res.redirect(302, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/session-timeout`) + `?${params.toString()}`);
             }
         });
     }
@@ -87,7 +89,7 @@ const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCo
 // - set the session cookie
 // - parse request cookies
 // - handle expiry of server-side session
-function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
+function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
     const commonCookieOptions = {
         httpOnly: true,
         path: cookiePath,
@@ -126,7 +128,7 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
             store,
         }),
         cookieParserMiddleware,
-        sessionExpiryMiddleware(mountUrl, ttl, getCookie, touchCookie, removeCookie),
+        sessionExpiryMiddleware(ttl, getCookie, touchCookie, removeCookie),
     ];
 }
 exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.d.ts

@@ -1,5 +1,4 @@
-declare function _default({ waypoint, mountUrl, }: {
+declare function _default({ waypoint, }: {
     waypoint: any;
-    mountUrl: any;
 }): ((req: any, res: any, next: any) => any)[];
 export default _default;

package/dist/middleware/skip-waypoint.js

@@ -10,7 +10,7 @@ const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const { has } = lodash_1.default;
 const log = (0, logger_js_1.default)('middleware:skip-waypoint');
-exports.default = ({ waypoint, mountUrl, }) => [
+exports.default = ({ waypoint, }) => [
     (req, res, next) => {
         if (!has(req.query, 'skipto')) {
             return next();
@@ -24,7 +24,7 @@ exports.default = ({ waypoint, mountUrl, }) => [
         });
         JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
         const redirectUrl = (0, waypoint_url_js_1.default)({
-            mountUrl,
+            mountUrl: `${req.baseUrl}/`,
             waypoint: skipTo,
             edit: req.casa.editMode,
             editOrigin: req.casa.editOrigin,

package/dist/middleware/steer-journey.d.ts

@@ -1,7 +1,6 @@
-declare function _default({ waypoint, plan, mountUrl, }: {
+declare function _default({ waypoint, plan, }: {
     waypoint: string;
     plan: Plan;
-    mountUrl: string;
 }): void;
 export default _default;
 export type Plan = typeof import("../lib/Plan");

package/dist/middleware/steer-journey.js

@@ -18,11 +18,11 @@ const log = (0, logger_js_1.default)('middleware:steer-journey');
  * @param {object} obj Options
  * @param {string} obj.waypoint Current waypoint
  * @param {Plan} obj.plan CASA Plan
- * @param {string} obj.mountUrl Mount URL
  * @returns {void}
  */
-exports.default = ({ waypoint, plan, mountUrl, }) => [
+exports.default = ({ waypoint, plan, }) => [
     (req, res, next) => {
+        const mountUrl = `${req.baseUrl}/`;
         // If the requested waypoint doesn't exist in the traversed journey, send
         // the user back to the last good waypoint.
         const traversed = plan.traverse(req.casa.journeyContext);

package/dist/middleware/strip-proxy-path.d.ts

@@ -0,0 +1,4 @@
+declare function _default({ mountUrl, }: {
+    mountUrl?: string | undefined;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;