@dwp/govuk-casa 8.1.0 → 8.2.2

package/dist/middleware/strip-proxy-path.js

@@ -0,0 +1,52 @@
+"use strict";
+// Strip any "proxy path" prefix present on the request URL
+//
+// The default "mountUrl" will be match whatever path that the CASA app
+// instance will be mounted onto. So if you mount on `/a/b/c` then all
+// URLs generated for the browser will be prefixed with `/a/b/c`.
+//
+// Defining a `mountUrl` will change that behaviour into a "proxy mode".
+// This mode assumes you have a forwarding proxy that will alter
+// the incoming request paths from `mountUrl` to the original path you
+// have mounted this CASA app instance onto.
+//
+// For example, if you mount the app on `/a/b/c/x`, but want the browser
+// URLs to just use the `/x` prefix, then pass a `mountUrl` of `/x`.
+//
+// See docs in `docs/guides/setup-behind-a-proxy.md`
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('casa:middleware:strip-proxy-path');
+exports.default = ({ mountUrl = '/', }) => [
+    (req, res, next) => {
+        // Assume everything before `mountUrl` is the proxy path prefix and remove it
+        const originalBaseUrl = req.baseUrl;
+        req.baseUrl = mountUrl.replace(/\/$/, '');
+        // If the app has been mounted directly on the specific `mountUrl`, then
+        // there's nothing we need to do and can let this request pass-through.
+        if (req.baseUrl === originalBaseUrl) {
+            next();
+        }
+        else if (req.__CASA_BASE_URL_REWRITTEN__) {
+            delete req.__CASA_BASE_URL_REWRITTEN__;
+            next();
+        }
+        else {
+            // Strip the proxy path prefix from the original URL so that
+            // subsequnt middleware sees the URL path as though proxy wasn't there.
+            // req.url will already have the proxy prefix and mountUrl removed.
+            /* eslint-disable security/detect-non-literal-regexp */
+            log.trace(`req.originalUrl before proxy stripping: ${req.originalUrl}`);
+            req.originalUrl = req.originalUrl.replace(new RegExp(`^/.+?${mountUrl}`), mountUrl);
+            log.trace(`req.originalUrl after proxy stripping: ${req.originalUrl}`);
+            /* eslint-enable security/detect-non-literal-regexp */
+            // Issuing this call will re-run this same middleware, so we use this
+            // `__CASA_BASE_URL_REWRITTEN__` flag to prevent recursion.
+            req.__CASA_BASE_URL_REWRITTEN__ = true;
+            req.app.handle(req, res, next);
+        }
+    },
+];

package/dist/middleware/validate-fields.d.ts

@@ -1,7 +1,6 @@
-declare function _default({ waypoint, fields, mountUrl, plan, }: {
+declare function _default({ waypoint, fields, plan, }: {
     waypoint: any;
     fields?: any[] | undefined;
-    mountUrl: any;
     plan: any;
 }): ((req: any, res: any, next: any) => any)[];
 export default _default;

package/dist/middleware/validate-fields.js

@@ -16,9 +16,10 @@ const updateContext = ({ waypoint, errors = null, journeyContext, session, }) =>
     // Save to session
     JourneyContext_js_1.default.putContext(session, journeyContext);
 };
-exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
+exports.default = ({ waypoint, fields = [], plan, }) => [
     (req, res, next) => {
         var _a, _b;
+        const mountUrl = `${req.baseUrl}/`;
         let errors = [];
         for (let i = 0, l = fields.length; i < l; i++) {
             /* eslint-disable security/detect-object-injection */

package/dist/routes/journey.d.ts

@@ -1,8 +1,7 @@
-export default function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, }: {
+export default function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, }: {
     globalHooks: any;
     pages: any;
     plan: any;
     csrfMiddleware: any;
-    mountUrl: any;
 }): MutableRouter;
 import MutableRouter from "../lib/MutableRouter.js";

package/dist/routes/journey.js

@@ -29,13 +29,14 @@ const renderMiddlewareFactory = (view, contextFactory) => [
         });
     },
 ];
-function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, }) {
+function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, }) {
     // Router
     const router = new MutableRouter_js_1.default();
     // Special "_" route which handles redirecting the user between sub-apps
     // /app1/_/?refmount=app2&route=prev
     router.all('/_', (req, res) => {
         var _a, _b;
+        const mountUrl = `${req.baseUrl}/`;
         const refmount = (_a = req.query) === null || _a === void 0 ? void 0 : _a.refmount;
         const route = (_b = req.query) === null || _b === void 0 ? void 0 : _b.route;
         log.trace(`App root ${mountUrl}: refmount = ${refmount}, route = ${route}`);
@@ -75,7 +76,6 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
     ];
     pages.forEach((page) => {
         const { waypoint, view, hooks: pageHooks = [], fields } = page;
-        const formUrl = (0, waypoint_url_js_1.default)({ mountUrl, waypoint });
         const waypointPath = `/${waypoint}`;
         let commonWaypointMiddleware = [
             (req, res, next) => {
@@ -88,17 +88,17 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
             log.info(`Configuring "${waypoint}" as a skippable waypoint`);
             commonWaypointMiddleware = [
                 ...commonWaypointMiddleware,
-                ...(0, skip_waypoint_js_1.default)({ mountUrl, waypoint }),
+                ...(0, skip_waypoint_js_1.default)({ waypoint }),
             ];
         }
-        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => ({
-            formUrl,
+        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => ({
+            formUrl: (0, waypoint_url_js_1.default)({ mountUrl: `${req.baseUrl}/`, waypoint }),
             formData: req.casa.journeyContext.getDataForPage(waypoint),
         })));
-        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, sanitise_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postsanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.pregather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, gather_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postgather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prevalidate', waypointPath, [...globalHooks, ...pageHooks]), ...(0, validate_fields_js_1.default)({ waypoint, fields, mountUrl, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postvalidate', waypointPath, [...globalHooks, ...pageHooks]), 
+        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presteer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.poststeer', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.presanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, sanitise_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postsanitise', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.pregather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, gather_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postgather', waypointPath, [...globalHooks, ...pageHooks]), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prevalidate', waypointPath, [...globalHooks, ...pageHooks]), ...(0, validate_fields_js_1.default)({ waypoint, fields, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.postvalidate', waypointPath, [...globalHooks, ...pageHooks]), 
         // If there were validation errors, jump out of this route and into the
         // next, where the errors will be rendered
-        (req, res, next) => (req.casa.journeyContext.hasValidationErrorsForPage(waypoint) ? next('route') : next()), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.preredirect', waypointPath, [...globalHooks, ...pageHooks]), ...(0, progress_journey_js_1.default)({ waypoint, plan, mountUrl }));
+        (req, res, next) => (req.casa.journeyContext.hasValidationErrorsForPage(waypoint) ? next('route') : next()), ...(0, utils_js_1.resolveMiddlewareHooks)('journey.preredirect', waypointPath, [...globalHooks, ...pageHooks]), ...(0, progress_journey_js_1.default)({ waypoint, plan }));
         router.post(waypointPath, ...(0, utils_js_1.resolveMiddlewareHooks)('journey.prerender', waypointPath, [...globalHooks, ...pageHooks]), renderMiddlewareFactory(view, (req) => {
             var _a;
             const errors = (_a = req.casa.journeyContext.getValidationErrorsForPageByField(waypoint)) !== null && _a !== void 0 ? _a : Object.create(null);
@@ -114,7 +114,7 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
                 href: errors[k][0].fieldHref, /* eslint-disable-line security/detect-object-injection */
             }));
             return {
-                formUrl,
+                formUrl: (0, waypoint_url_js_1.default)({ mountUrl: `${req.baseUrl}/`, waypoint }),
                 formData: req.body,
                 formErrors: Object.keys(errors).length ? errors : null,
                 formErrorsGovukArray: govukErrors.length ? govukErrors : null,

package/dist/routes/static.d.ts

@@ -1,6 +1,5 @@
 /**
  * @typedef {object} StaticOptions Options to configure static router
- * @property {string} [mountUrl=/] URL prefix for govuk-frontend static assets (optional, default /)
  * @property {number} [maxAge=3600000] Cache TTL for all assets (optional, default 1 hour)
  */
 /**
@@ -9,15 +8,11 @@
  * @param {StaticOptions} options Options
  * @returns {MutableRouter} ExpressJS Router instance
  */
-export default function staticRouter({ mountUrl, maxAge, }: StaticOptions): MutableRouter;
+export default function staticRouter({ maxAge, }?: StaticOptions): MutableRouter;
 /**
  * Options to configure static router
  */
 export type StaticOptions = {
-    /**
-     * )
-     */
-    mountUrl?: string | undefined;
     /**
      * Cache TTL for all assets (optional, default 1 hour)
      */

package/dist/routes/static.js

@@ -10,11 +10,11 @@ const path_1 = require("path");
 const module_1 = require("module");
 const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
 const MutableRouter_js_1 = __importDefault(require("../lib/MutableRouter.js"));
+const utils_js_1 = require("../lib/utils.js");
 const { static: ExpressStatic } = express_1.default; // CommonJS
 const oneDay = 86400000;
 /**
  * @typedef {object} StaticOptions Options to configure static router
- * @property {string} [mountUrl=/] URL prefix for govuk-frontend static assets (optional, default /)
  * @property {number} [maxAge=3600000] Cache TTL for all assets (optional, default 1 hour)
  */
 /**
@@ -23,7 +23,7 @@ const oneDay = 86400000;
  * @param {StaticOptions} options Options
  * @returns {MutableRouter} ExpressJS Router instance
  */
-function staticRouter({ mountUrl = '/', maxAge = 3600000, }) {
+function staticRouter({ maxAge = 3600000, } = {}) {
     const router = new MutableRouter_js_1.default();
     const notFoundHandler = (req, res, next) => {
         // Fall through to a general purpose error handler
@@ -52,16 +52,16 @@ function staticRouter({ mountUrl = '/', maxAge = 3600000, }) {
     // The CASA CSS source contains the placeholder `~~~CASA_MOUNT_URL~~~` which
     // must be replaced with the dynamic `mountUrl` to ensure govuk-frontend
     // assets are served from the correct location.
-    const casaCss = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa.css'), { encoding: 'utf8' }).replace(/~~~CASA_MOUNT_URL~~~/g, mountUrl);
-    const casaCssIe8 = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa-ie8.css'), { encoding: 'utf8' }).replace(/~~~CASA_MOUNT_URL~~~/g, mountUrl);
+    const casaCss = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa.css'), { encoding: 'utf8' });
+    const casaCssIe8 = (0, fs_1.readFileSync)((0, path_1.resolve)(dirname_cjs_1.default, '../../dist/assets/css/casa-ie8.css'), { encoding: 'utf8' });
     // The static middleware will only server GET/HEAD requests, so we can mount
     // the middleware using `use()` rather than resorting to `get()`
     const govukFrontendDirectory = (0, path_1.resolve)((0, module_1.createRequire)(dirname_cjs_1.default).resolve('govuk-frontend'), '../../');
     router.use('/govuk/assets/js/all.js', ExpressStatic(`${govukFrontendDirectory}/govuk/all.js`, staticConfig));
     router.use('/govuk/assets', ExpressStatic(`${govukFrontendDirectory}/govuk/assets`, staticConfig));
     router.use('/govuk/assets', notFoundHandler);
-    router.use('/casa/assets/css/casa.css', setHeaders, (req, res) => res.send(casaCss));
-    router.use('/casa/assets/css/casa-ie8.css', setHeaders, (req, res) => res.send(casaCssIe8));
+    router.get('/casa/assets/css/casa.css', setHeaders, (req, res) => res.send(casaCss.replace(/~~~CASA_MOUNT_URL~~~/g, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`))));
+    router.get('/casa/assets/css/casa-ie8.css', setHeaders, (req, res) => res.send(casaCssIe8.replace(/~~~CASA_MOUNT_URL~~~/g, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`))));
     router.use('/casa/assets', notFoundHandler);
     return router;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "8.1.0",
+  "version": "8.2.2",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
   "repository": {
     "type": "git",
@@ -43,50 +43,52 @@
   "dependencies": {
     "cookie-parser": "1.4.6",
     "csurf": "1.11.0",
-    "debug": "4.3.3",
+    "debug": "4.3.4",
     "deepmerge": "4.2.2",
-    "express": "4.17.3",
-    "express-session": "1.17.2",
+    "express": "4.18.1",
+    "express-session": "1.17.3",
     "govuk-frontend": "4.0.1",
     "graphlib": "2.1.8",
     "helmet": "5.0.2",
-    "i18next": "21.6.14",
+    "i18next": "21.8.2",
     "i18next-http-middleware": "3.2.0",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "luxon": "2.3.1",
+    "luxon": "2.4.0",
     "nunjucks": "3.2.3",
+    "path-to-regexp": "6.2.1",
     "uuid": "8.3.2",
     "validator": "13.7.0"
   },
   "devDependencies": {
-    "@babel/core": "7.17.5",
+    "@babel/core": "7.17.12",
     "@babel/eslint-parser": "7.17.0",
-    "@babel/preset-env": "7.16.11",
-    "@commitlint/config-conventional": "16.2.1",
+    "@babel/preset-env": "7.17.12",
+    "@commitlint/config-conventional": "17.0.0",
     "@dwp/casa-spiderplan": "2.4.0",
     "@dwp/casa-spiderplan-a11y-plugin": "0.1.4",
     "@dwp/casa-spiderplan-zap-plugin": "0.1.1",
     "@dwp/eslint-config-base": "6.0.0",
     "@types/express": "4.17.13",
-    "@types/node": "17.0.21",
+    "@types/node": "17.0.34",
     "@types/nunjucks": "3.2.1",
     "babel-eslint": "10.1.0",
-    "c8": "7.11.0",
+    "c8": "7.11.3",
     "chai": "4.3.6",
-    "commitlint": "16.2.1",
-    "eslint": "8.10.0",
+    "cheerio": "1.0.0-rc.10",
+    "commitlint": "17.0.0",
+    "eslint": "8.15.0",
     "eslint-plugin-no-unsafe-regex": "1.0.0",
-    "eslint-plugin-security": "1.4.0",
-    "eslint-plugin-sonarjs": "0.12.0",
-    "fast-check": "2.22.0",
-    "husky": "7.0.4",
-    "mocha": "9.2.1",
-    "sass": "1.49.9",
-    "sinon": "13.0.1",
+    "eslint-plugin-security": "1.5.0",
+    "eslint-plugin-sonarjs": "0.13.0",
+    "fast-check": "2.25.0",
+    "husky": "8.0.1",
+    "mocha": "10.0.0",
+    "sass": "1.51.0",
+    "sinon": "14.0.0",
     "sinon-chai": "3.7.0",
-    "standard-version": "9.3.2",
-    "supertest": "6.2.2",
-    "typescript": "4.6.2"
+    "standard-version": "9.5.0",
+    "supertest": "6.2.3",
+    "typescript": "4.6.4"
   }
 }

package/views/casa/components/journey-form/README.md

@@ -4,6 +4,8 @@ Component to wrap your form inputs in a `<form>` that contains all the required
 
 A "Continue" button (and "Cancel" link if in edit mode) will also be added.
 
+- [1.3.5: Identify Input Purpose](https://www.w3.org/WAI/WCAG21/Understanding/identify-input-purpose.html)
+- [<form>: The Form element - autocomplete](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#attr-autocomplete)
 ## Example usage
 
 ```nunjucks
@@ -49,6 +51,7 @@ Note that the submit button is configured to prevent double-clicks and avoid dup
 | Name | Type | Required | Description |
 |------|------|----------|-------------|
 | `formUrl` | string | Yes | The form's "action", available in a `formUrl` template variable |
+| `autoComplete` | string | No | Allows you to override the autocomplete paramater  - the default value is 'off'
 | `csrfToken` | string | Yes | Token used to protect form from CSRF (available to user's templates via the global `casa.csrfToken` variable) |
 | `inEditMode` | boolean | No | Toggle edit-mode of the form (available to page templates using default GET/POST handlers via the local `inEditMode` variable) |
 | `editOriginUrl` | string | No | Absolute URL to the page from which the edit request came (defaults to `review`) (available to user's templates using default GET/POST handlers via the local `editOriginUrl` variable) |

package/views/casa/components/journey-form/template.njk

@@ -1,6 +1,6 @@
 {% from "govuk/components/button/macro.njk" import govukButton %}
 
-<form action="{{ params.formUrl }}" method="post" autocomplete="off" novalidate class="casa-journey-form">
+<form action="{{ params.formUrl }}" method="post" autocomplete="{{ params.autoComplete | default('off', true) }}" novalidate class="casa-journey-form">
   <input type="hidden" name="_csrf" value="{{ params.csrfToken }}" />
   {% if params.inEditMode %}<input type="hidden" name="edit" value="true" />{% endif %}
   {% if params.inEditMode and params.editOriginUrl %}<input type="hidden" name="editorigin" value="{{ params.editOriginUrl }}" />{% endif %}

package/views/casa/partials/scripts.njk

@@ -1,5 +1,5 @@
 <!-- CASA -->
-<script src="{{ casa.mountUrl }}govuk/assets/js/all.js?{{ casaVersion }}"></script>
+<script src="{{ casa.staticMountUrl }}govuk/assets/js/all.js?{{ casaVersion }}"></script>
 <script nonce="{{ cspNonce }}">
 window.GOVUKFrontend.initAll();
 if (window.history.replaceState) {

package/views/casa/partials/styles.njk

@@ -1,6 +1,6 @@
 <!-- CASA -->
-<!--[if gt IE 8]><!--><link href="{{ casa.mountUrl }}casa/assets/css/casa.css?{{ casaVersion }}" rel="stylesheet" /><!--<![endif]-->
+<!--[if gt IE 8]><!--><link href="{{ casa.staticMountUrl }}casa/assets/css/casa.css?{{ casaVersion }}" rel="stylesheet" /><!--<![endif]-->
 <!--[if lte IE 8]>
-<link href="{{ casa.mountUrl }}casa/assets/css/casa-ie8.css?{{ casaVersion }}" rel="stylesheet" />
+<link href="{{ casa.staticMountUrl }}casa/assets/css/casa-ie8.css?{{ casaVersion }}" rel="stylesheet" />
 <![endif]-->
 <!-- /CASA -->