@dwp/govuk-casa 9.7.0 → 10.0.0

package/src/lib/nunjucks-filters.js

@@ -1,82 +1,72 @@
-import merge from "deepmerge";
+import deepmerge from "@fastify/deepmerge";
 import { DateTime } from "luxon";
 import nunjucks from "nunjucks";
+import isPlainObject from "is-plain-obj";
+import NullObject from "./NullObject.js";
 
-const { all: deepmergeAll } = merge;
-
-// Arrays will be merged such that elements at the same index will be merged
-// into each other
-// ref: https://www.npmjs.com/package/deepmerge
-
-const combineMerge = (target, source, options) => {
-  const destination = target.slice();
-
-  for (let index = 0; index < source.length; index++) {
-    // ESLint disabled as `index` is only an integer
-    /* eslint-disable security/detect-object-injection */
-    const item = source[index];
-
-    if (typeof destination[index] === "undefined") {
-      destination[index] = options.cloneUnlessOtherwiseSpecified(item, options);
-    } else if (options.isMergeableObject(item)) {
-      destination[index] = merge(target[index], item, options);
-    } else if (target.indexOf(item) === -1) {
-      destination.push(item);
-    }
-    /* eslint-enable security/detect-object-injection */
-  }
-  return destination;
-};
-
-// Allows objects to be deepmerged and retain their type, without becoming [object Object]
-// ref: https://github.com/jonschlinkert/is-plain-object/blob/master/is-plain-object.js
-
-/**
- * @param {any} o Value to test
- * @returns {boolean} True if an object
- */
-function isObject(o) {
-  return Object.prototype.toString.call(o) === "[object Object]";
-}
+const merge = deepmerge({
+  all: true,
+  onlyDefinedProperties: true,
+  isMergeableObject: isMergable,
+  mergeArray(options) {
+    const deepmerge = options.deepmerge;
+    const clone = options.clone;
+    return function (target, source) {
+      let i = 0;
+      const tl = target.length;
+      const sl = source.length;
+      const il = Math.max(tl, sl);
+      const result = new Array(il);
+      /* eslint-disable security/detect-object-injection */
+      for (i = 0; i < il; ++i) {
+        const targetItem = target[i];
+        const sourceItem = source[i];
+        if (i < sl) {
+          result[i] = deepmerge(targetItem, sourceItem);
+        } else {
+          result[i] = clone(targetItem);
+        }
+      }
+      /* eslint-enable security/detect-object-injection */
+      return result;
+    };
+  },
+});
 
 /**
- * @param {any} o Value to test
- * @returns {boolean} True if a plain object or array
+ * Returns true if object is mergable (plain object or Array)
+ *
+ * @param {object} object Input object
+ * @returns {boolean} Is mergable
  */
-function isPlainObjectOrArray(o) {
-  if (Array.isArray(o)) {
-    return true;
-  }
-  if (isObject(o) === false) {
-    return false;
-  }
-  const ctor = o.constructor;
-  if (ctor === undefined) {
-    return true;
-  }
-  const prot = ctor.prototype;
-  if (isObject(prot) === false) {
-    return false;
-  }
-  return Object.hasOwn(prot, "isPrototypeOf");
+function isMergable(object) {
+  return Array.isArray(object) || isPlainObject(object);
 }
 
 /**
- * @param {...any} objects Objects to merge
+ * Merge multiple objects into one object
+ *
+ * @memberof NunjucksFilters
+ * @param {...(object | Array)} objects Objects to merge
  * @returns {object} Merged object
  */
 function mergeObjects(...objects) {
-  return deepmergeAll([Object.create(null), ...objects], {
-    arrayMerge: combineMerge,
-    isMergeableObject: isPlainObjectOrArray,
-  });
+  const merged = merge(new NullObject(), ...objects);
+  if (merged === null) {
+    for (const object of objects) {
+      if (!isMergable(object)) {
+        throw new TypeError(`Cannot convert ${typeof object} to object`);
+      }
+    }
+  }
+  return merged;
 }
 
 /**
  * Determine whether a value exists in a list.
  *
  * @memberof NunjucksFilters
- * @param {any[]} source List of items to search
+ * @param {Array} source List of items to search
  * @param {any} search Item to search within the `source`
  * @returns {boolean} True if the search item was found
  */

package/src/lib/nunjucks.js

@@ -1,7 +1,5 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
 import { Environment } from "nunjucks";
-import dirname from "./dirname.cjs";
+import packageInfo from "../../package.json" with { type: "json" };
 import CasaTemplateLoader from "./CasaTemplateLoader.js";
 import {
   mergeObjects,
@@ -20,11 +18,10 @@ import {
  * Create a Nunjucks environment.
  *
  * @param {NunjucksOptions} options Nunjucks options
- * @param {boolean} govukRebrand GovukRebrand flag
  * @returns {Environment} Nunjucks Environment instance
  * @access private
  */
-export default function nunjucksConfig({ views = [], govukRebrand }) {
+export default function nunjucksConfig({ views = [] }) {
   // Prepare a single Nunjucks environment for all responses to use. Note that
   // we cannot prepare response-specific global functions/filters if we use a
   // single environment, but the performance gains of doing so are significant.
@@ -45,13 +42,7 @@ export default function nunjucksConfig({ views = [], govukRebrand }) {
 
   // Globals
   // These can't be modified once set. But they can be overridden by res.locals.
-  env.addGlobal(
-    "casaVersion",
-    /* eslint-disable-next-line security/detect-non-literal-fs-filename */
-    JSON.parse(readFileSync(resolve(dirname, "../../package.json"))).version,
-  );
-
-  env.addGlobal("govukRebrand", govukRebrand);
+  env.addGlobal("casaVersion", packageInfo.version);
   env.addGlobal("mergeObjects", mergeObjects);
   env.addGlobal("includes", includes);
   env.addGlobal("formatDateObject", formatDateObject);

package/src/lib/utils.js

@@ -44,7 +44,8 @@ export function isStringable(value) {
  * @param {string} hookName Hook name (including scope prefix)
  * @param {string} path URL path to match (relative to mountUrl)
  * @param {Hook[]} hooks Hooks to be applied at the page level
- * @returns {Function[]} An array of middleware that should be applied
+ * @returns {import("express").RequestHandler[]} An array of middleware that
+ *   should be applied
  * @access private
  */
 export function resolveMiddlewareHooks(hookName, path, hooks = []) {

package/src/lib/validators/dateObject.js

@@ -1,11 +1,10 @@
+import isPlainObject from "is-plain-obj";
 import { DateTime } from "luxon";
-import lodash from "lodash";
+import NullObject from "../NullObject.js";
 import ValidationError from "../ValidationError.js";
 import ValidatorFactory from "../ValidatorFactory.js";
 import { stringifyInput, stripWhitespace } from "../utils.js";
 
-const { isPlainObject } = lodash;
-
 /**
  * @typedef {import("../../casa").ErrorMessageConfig} ErrorMessageConfig
  * @access private
@@ -172,7 +171,7 @@ export default class DateObject extends ValidatorFactory {
             mm: stripWhitespace(stringifyInput(value.mm)),
             yyyy: stripWhitespace(stringifyInput(value.yyyy)),
           }
-        : Object.create(null);
+        : new NullObject();
     }
     return undefined;
   }

package/src/lib/validators/postalAddressObject.js

@@ -1,10 +1,9 @@
-import lodash from "lodash";
+import isPlainObject from "is-plain-obj";
+import NullObject from "../NullObject.js";
 import ValidationError from "../ValidationError.js";
 import ValidatorFactory from "../ValidatorFactory.js";
 import { stringifyInput } from "../utils.js";
 
-const { isPlainObject } = lodash; // CommonjS
-
 /**
  * @typedef {import("../../casa").ErrorMessageConfig} ErrorMessageConfig
  * @access private
@@ -91,7 +90,7 @@ export default class PostalAddressObject extends ValidatorFactory {
         : err;
 
     // Work out required/optional parts based on config
-    const reqF = Object.create(null);
+    const reqF = new NullObject();
     const reqC = cfg.requiredFields;
     reqF.address1 = reqC.indexOf("address1") > -1;
     reqF.address2 = reqC.indexOf("address2") > -1;
@@ -140,7 +139,7 @@ export default class PostalAddressObject extends ValidatorFactory {
         if (condMissingOrRegexMismatch || condExceedStrlen) {
           valid = false;
           errorMsgs.push(
-            Object.assign(Object.create(null), objectifyError(attr[3]), {
+            Object.assign(new NullObject(), objectifyError(attr[3]), {
               fieldKeySuffix: `[${k}]`,
             }),
           );
@@ -163,7 +162,7 @@ export default class PostalAddressObject extends ValidatorFactory {
   sanitise(value) {
     // Only objects are supported
     if (!isPlainObject(value)) {
-      return Object.create(null);
+      return new NullObject();
     }
 
     // Prune unrecognised attributes, and coerce to Strings
@@ -179,6 +178,6 @@ export default class PostalAddressObject extends ValidatorFactory {
         .filter(([k]) => validKeys.includes(k))
         .map(([k, v]) => [k, stringifyInput(v)]),
     );
-    return Object.assign(Object.create(null), pruned);
+    return Object.assign(new NullObject(), pruned);
   }
 }

package/src/lib/validators/required.js

@@ -1,10 +1,8 @@
-import lodash from "lodash";
+import isPlainObject from "is-plain-obj";
 import { isEmpty, isStringable, stringifyInput } from "../utils.js";
 import ValidatorFactory from "../ValidatorFactory.js";
 import ValidationError from "../ValidationError.js";
 
-const { isPlainObject } = lodash; // CommonJS
-
 /**
  * @typedef {import("../../casa").ErrorMessageConfig} ErrorMessageConfig
  * @access private

package/src/lib/waypoint-url.js

@@ -1,3 +1,5 @@
+import NullObject from "./NullObject.js";
+
 /**
  * @typedef {import("./index").JourneyContext} JourneyContext
  * @access private
@@ -14,7 +16,7 @@ const reUrlProtocolExtract = /^url:\/\/(.+)$/i;
  * @access private
  */
 const sanitiseWaypoint = (w) =>
-  w.replace(/[^/a-z0-9_-]/gi, "").replace(/\/+/g, "/");
+  w.replace(/[^/a-z0-9_-]+/gi, "").replace(/\/+/g, "/");
 
 /**
  * Sanitise a waypoint string, with allowed URL parameters: contextid =
@@ -25,32 +27,26 @@ const sanitiseWaypoint = (w) =>
  * @access private
  */
 const sanitiseWaypointWithAllowedParams = (w) => {
-  // Extract URL params
-  const parts = w.split("?");
-  if (parts.length !== 2) {
+  const queryIndex = w.indexOf("?");
+  if (queryIndex === -1 || queryIndex !== w.lastIndexOf("?")) {
     return sanitiseWaypoint(w);
   }
-  const [waypoint, rawParams] = parts;
-  const urlSearchParams = new URLSearchParams(rawParams);
-
-  // Strip all but those parameters allowed
-  const validatedUrlSearchParams = new URLSearchParams();
-  for (const pk of ["contextid"]) {
-    if (urlSearchParams.has(pk)) {
-      validatedUrlSearchParams.set(pk, urlSearchParams.get(pk));
-    }
+
+  const waypoint = w.substring(0, queryIndex);
+  const urlSearchParams = new URLSearchParams(w.substring(queryIndex + 1));
+
+  let query = "";
+  if (urlSearchParams.has("contextid")) {
+    query += `?contextid=${encodeURIComponent(urlSearchParams.get("contextid"))}`;
   }
 
-  return `${sanitiseWaypoint(waypoint)}?${validatedUrlSearchParams.toString()}`.replace(
-    /\?$/,
-    "",
-  );
+  return `${sanitiseWaypoint(waypoint)}${query}`;
 };
 
 /**
  * Generate a URL pointing at a particular waypoint.
  *
- * @memberof module:@dwp/govuk-casa
+ * @memberof module:"@dwp/govuk-casa"
  * @example
  *   // generates: /path/details?edit&editorigin=%2Fsomewhere%2Felse
  *   waypointUrl({
@@ -80,7 +76,7 @@ export default function waypointUrl(
     editOrigin,
     skipTo,
     routeName = "next",
-  } = Object.create(null),
+  } = new NullObject(),
 ) {
   const url = new URL("https://placeholder.test");
 

package/src/middleware/csrf.js

@@ -16,7 +16,7 @@ import { csrfSync } from "csrf-sync";
  */
 export default function csrfMiddleware() {
   const { csrfSynchronisedProtection } = csrfSync({
-    getTokenFromRequest: (req) => req.body._csrf,
+    getTokenFromRequest: (req) => req.body?._csrf,
   });
   return [
     csrfSynchronisedProtection,

package/src/middleware/data.js

@@ -22,8 +22,14 @@ import waypointUrl from "../lib/waypoint-url.js";
  * @access private
  */
 
+/**
+ * Get edit orgin
+ *
+ * @param {import("express").Request} req Express request
+ * @returns {string} Currently set edit origin
+ */
 const editOrigin = (req) => {
-  if (Object.hasOwn(req.query, "editorigin")) {
+  if (req.query && Object.hasOwn(req.query, "editorigin")) {
     return waypointUrl({ waypoint: req.query.editorigin });
   }
   if (req.body && Object.hasOwn(req.body, "editorigin")) {
@@ -43,16 +49,9 @@ const editOrigin = (req) => {
  * @param {Plan} opts.plan CASA Plan
  * @param {ContextEventHandler[]} opts.events Event handlers
  * @param {ContextIdGenerator} opts.contextIdGenerator Content ID generator
- * @param {boolean} ops.govukRebrand Govuk rebrand feature flag
- * @param opts.govukRebrand
  * @returns {RequestHandler[]} Middleware functions
  */
-export default function dataMiddleware({
-  plan,
-  events,
-  contextIdGenerator,
-  govukRebrand,
-}) {
+export default function dataMiddleware({ plan, events, contextIdGenerator }) {
   return [
     (req, res, next) => {
       /* ------------------------------------------------ Request decorations */
@@ -73,9 +72,11 @@ export default function dataMiddleware({
 
         // Edit mode
         editMode:
-          (Object.hasOwn(req.query, "edit") &&
+          (req.query &&
+            Object.hasOwn(req.query, "edit") &&
             Object.hasOwn(req.query, "editorigin")) ||
-          (Object.hasOwn(req.body, "edit") &&
+          (req.body &&
+            Object.hasOwn(req.body, "edit") &&
             Object.hasOwn(req.body, "editorigin")),
         editOrigin: editOrigin(req),
       };
@@ -131,8 +132,7 @@ export default function dataMiddleware({
       //   htmlLang = req.language is provided by i18n-http-middleware
       //   assetPath = used for linking to static assets in the govuk-frontend module
       res.locals.htmlLang = req.language;
-      const rebrandAssetPath = govukRebrand ? "/rebrand" : "";
-      res.locals.assetPath = `${staticMountUrl}govuk/assets${rebrandAssetPath}`;
+      res.locals.assetPath = `${staticMountUrl}govuk/assets`;
 
       // Function for building URLs. This will be curried with the `mountUrl`,
       // `journeyContext`, `edit` and `editOrigin` for convenience. This means

package/src/middleware/gather-fields.js

@@ -4,6 +4,7 @@
 // - Remove validation date of JourneyContext so it can re-evaluted
 
 import JourneyContext from "../lib/JourneyContext.js";
+import NullObject from "../lib/NullObject.js";
 import { REQUEST_PHASE_GATHER } from "../lib/constants.js";
 
 /**
@@ -11,6 +12,11 @@ import { REQUEST_PHASE_GATHER } from "../lib/constants.js";
  * @access private
  */
 
+/**
+ * @typedef {import("express").RequestHandler} RequestHandler
+ * @access private
+ */
+
 /**
  * Gather the field data from `req.body` into the current JourneyContext
  *
@@ -21,7 +27,7 @@ import { REQUEST_PHASE_GATHER } from "../lib/constants.js";
  * @param {object} obj Options
  * @param {string} obj.waypoint Waypoint
  * @param {PageField[]} [obj.fields] Fields. Default is `[]`
- * @returns {Array} Array of middleware
+ * @returns {RequestHandler[]} Array of middleware
  */
 export default ({ waypoint, fields = [] }) => [
   (req, res, next) => {
@@ -35,7 +41,7 @@ export default ({ waypoint, fields = [] }) => [
     // Ignore data for any non-persistent fields
     // ESLint disabled as `fields`, `i` and `name` are dev-controlled
     /* eslint-disable security/detect-object-injection */
-    const persistentBody = Object.create(null);
+    const persistentBody = new NullObject();
     for (let i = 0, l = fields.length; i < l; i++) {
       if (
         fields[i].meta.persist &&

package/src/middleware/i18n.js

@@ -2,9 +2,10 @@ import { createInstance } from "i18next";
 import { LanguageDetector, handle } from "i18next-http-middleware";
 import { resolve, basename } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import deepmerge from "deepmerge";
+import deepmerge from "@fastify/deepmerge";
 import { load as jsYamlLoad } from "js-yaml";
 import logger from "../lib/logger.js";
+import NullObject from "../lib/NullObject.js";
 
 /**
  * @typedef {import("express").RequestHandler} RequestHandler
@@ -13,6 +14,8 @@ import logger from "../lib/logger.js";
 
 const log = logger("middleware:i18n");
 
+const merge = deepmerge({ onlyDefinedProperties: true });
+
 const loadJson = (file) => {
   // Strip out newlines (this is a legacy feature which we're keeping for
   // backwards compatibility).
@@ -35,13 +38,13 @@ const extract = (file) => {
 };
 
 const loadResources = (languages, directories) => {
-  const store = Object.create(null);
+  const store = new NullObject();
 
   for (const language of languages) {
     // ESLint disabled as `store`, `language` and `ns` are all dev-controlled,
     // and this function is only called once, at boot-time.
     /* eslint-disable security/detect-object-injection */
-    store[language] = Object.create(null);
+    store[language] = new NullObject();
 
     for (const basedir of directories) {
       const dir = resolve(basedir, language);
@@ -56,10 +59,10 @@ const loadResources = (languages, directories) => {
         const { ns, data } = extract(resolve(dir, file));
 
         if (store[language][ns] === undefined) {
-          store[language][ns] = Object.create(null);
+          store[language][ns] = new NullObject();
         }
 
-        store[language][ns] = deepmerge(store[language][ns], data);
+        store[language][ns] = merge(store[language][ns], data);
       }
     }
     /* eslint-enable security/detect-object-injection */
@@ -115,7 +118,7 @@ export default function i18nMiddleware({
       if (!req.session.language) {
         req.session.language = languages[0];
       }
-      if (req?.query.lang && languages.includes(req.query.lang)) {
+      if (req.query?.lang && languages.includes(req.query.lang)) {
         req.session.language = String(req.query.lang);
       }
       next();

package/src/middleware/pre.js

@@ -33,7 +33,7 @@ function casaCspNonce(req, res) {
  * @param {object} opts Options
  * @param {HelmetConfigurator} opts.helmetConfigurator Function to customise
  *   Helmet configuration
- * @returns {Function[]} List of middleware
+ * @returns {import("express").RequestHandler[]} List of middleware
  */
 export default ({ helmetConfigurator = (config) => config } = {}) => [
   // Only allow certain request methods

package/src/middleware/progress-journey.js

@@ -25,6 +25,14 @@ const saveAndRedirect = (session, journeyContext, url, res, next) => {
   });
 };
 
+/**
+ * Get "progress journey" middleware for a given waypoint
+ *
+ * @param {object} opts Options
+ * @param {string} opts.waypoint Waypoint
+ * @param {Plan} opts.plan CASA Plan
+ * @returns {import("express").RequestHandler[]} Middleware functions
+ */
 export default ({ waypoint, plan }) => [
   (req, res, next) => {
     // Determine the next available waypoint after the current one

package/src/middleware/sanitise-fields.js

@@ -4,7 +4,16 @@
 
 import fieldFactory from "../lib/field.js";
 import JourneyContext from "../lib/JourneyContext.js";
+import NullObject from "../lib/NullObject.js";
 
+/**
+ * Get "sanitise fields" middleware for a given waypoint
+ *
+ * @param {object} opts Options
+ * @param {string} opts.waypoint Waypoint
+ * @param {PageField[]} opts.fields Fields to sanitise
+ * @returns {import("express").RequestHandler[]} Middleware functions
+ */
 export default ({ waypoint, fields = [] }) => {
   // Add some common, transient fields to ensure they survive beyond this sanitisation process
   fields.push(
@@ -35,9 +44,10 @@ export default ({ waypoint, fields = [] }) => {
       // those that do not have an entry in `fields`)
       // EsLint disabled as `fields`, `i` & `name` are only controlled by dev
       /* eslint-disable security/detect-object-injection */
-      const prunedBody = Object.create(null);
+      const prunedBody = new NullObject();
       for (let i = 0, l = fields.length; i < l; i++) {
         if (
+          req.body &&
           Object.hasOwn(req.body, fields[i].name) &&
           req.body[fields[i].name] !== undefined
         ) {
@@ -54,7 +64,7 @@ export default ({ waypoint, fields = [] }) => {
 
       // Second, prune any fields that do not pass the validation conditional,
       // and process those that do.
-      const sanitisedBody = Object.create(null);
+      const sanitisedBody = new NullObject();
       for (let i = 0, l = fields.length; i < l; i++) {
         const field =
           fields[i]; /* eslint-disable-line security/detect-object-injection */
@@ -78,3 +88,8 @@ export default ({ waypoint, fields = [] }) => {
     },
   ];
 };
+
+/**
+ * @typedef {import("../casa").PageField} PageField
+ * @access private
+ */