@elliemae/pui-cli 9.0.0-next.6 → 9.0.0-next.61

package/dist/esm/testing/extended/axe-core/toHaveNoViolations.js

@@ -0,0 +1,22 @@
+import { getMessageAndPass } from "./getMessageAndPass.js";
+import { shouldIgnoreNodeViolation } from "./shouldIgnoreNodeViolation.js";
+const toHaveNoViolations = {
+  toHaveNoViolations(results) {
+    const { violations } = results;
+    const finalViolations = [];
+    violations.forEach((violation) => {
+      const { nodes } = violation;
+      const newNodes = [];
+      nodes.forEach((node) => {
+        if (!shouldIgnoreNodeViolation(node, violation)) newNodes.push(node);
+      });
+      if (newNodes.length > 0) {
+        finalViolations.push({ ...violation, nodes: newNodes });
+      }
+    });
+    return { actual: violations, ...getMessageAndPass(finalViolations) };
+  }
+};
+export {
+  toHaveNoViolations
+};

package/dist/esm/testing/jest.config.cjs

@@ -6,10 +6,8 @@ const { findMonoRepoRoot } = require('../monorepo/utils.cjs');
 
 let isReactModule = true;
 try {
-  /* eslint-disable global-require, import/no-unresolved */
   require('react');
   require('styled-components');
-  /* eslint-enable global-require, import/no-unresolved */
 } catch (err) {
   isReactModule = false;
 }
@@ -57,11 +55,14 @@ const jestConfig = {
   coverageReporters: ['lcov', 'html', 'text-summary'],
   moduleDirectories: ['node_modules', 'app', 'lib'],
   moduleNameMapper: {
+    d3: '<rootDir>/node_modules/d3/dist/d3.min.js',
+    '^d3-(.*)$': '<rootDir>/node_modules/d3-$1/dist/d3-$1.min.js',
     '.*\\webpack-hmr(.[t|j]s)?$': getMockFilePath('webpack-hmr.js'),
     '.*\\.(css|scss)$': getMockFilePath('cssModule.js'),
     '.*\\.(jpg|jpeg|png|gif|eot|otf|webp|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga|ico)$':
       getMockFilePath('image.js'),
     '.*\\.svg(?:\\?[a-zA-Z]+)?$': getMockFilePath('svg.js'),
+    '.*iframe\\.html(?:\\?[a-zA-Z]+)?$': getMockFilePath('iframe.js'),
     '.*\\.html(?:\\?[a-zA-Z]+)?$': getMockFilePath('html.js'),
     '@elliemae/pui-user-monitoring': getMockFilePath('pui-user-monitoring.js'),
     '@elliemae/pui-app-loader': getMockFilePath('pui-app-loader.js'),
@@ -73,7 +74,7 @@ const jestConfig = {
   },
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
   setupFilesAfterEnv: [path.resolve(__dirname, './setup-tests.js')],
-  setupFiles: ['raf/polyfill', 'whatwg-fetch'],
+  setupFiles: ['raf/polyfill', path.resolve(__dirname, './jest.polyfills.cjs')],
   testRegex: '(app|lib).*/tests/.*\\.test\\.[jt]sx?$',
   snapshotSerializers: [],
   testResultsProcessor: 'jest-sonar-reporter',
@@ -91,13 +92,15 @@ const jestConfig = {
   testEnvironmentOptions: {
     url: `http://localhost:3111${basePath}`,
     resources: 'usable',
+    customExportConditions: [''],
   },
-  testEnvironment: 'jsdom',
+  testEnvironment: path.resolve(__dirname, './ExtendedJSDomEnv.cjs'),
   watchPlugins: [
     'jest-watch-typeahead/filename',
     'jest-watch-typeahead/testname',
   ],
   testTimeout: 5000,
+  prettierPath: null,
 };
 
 if (isReactModule && jestConfig.setupFilesAfterEnv)

package/dist/esm/testing/jest.polyfills.cjs

@@ -0,0 +1,30 @@
+/**
+ * The block below contains polyfills for Node.js globals
+ * required for Jest to function when running JSDOM tests.
+ * These HAVE to be require's and HAVE to be in this exact
+ * order, since "undici" depends on the "TextEncoder" global API.
+ *
+ * Consider migrating to a more modern test runner if
+ * you don't want to deal with this.
+ */
+const { TextDecoder, TextEncoder } = require('node:util');
+const { ReadableStream } = require('node:stream/web');
+
+Object.defineProperties(globalThis, {
+  TextDecoder: { value: TextDecoder },
+  TextEncoder: { value: TextEncoder },
+  ReadableStream: { value: ReadableStream },
+});
+
+const { Blob, File } = require('node:buffer');
+const { fetch, Headers, FormData, Request, Response } = require('undici');
+
+Object.defineProperties(globalThis, {
+  fetch: { value: fetch, writable: true },
+  Blob: { value: Blob },
+  File: { value: File },
+  Headers: { value: Headers },
+  FormData: { value: FormData },
+  Request: { value: Request },
+  Response: { value: Response },
+});

package/dist/esm/testing/mocks/iframe.js

@@ -0,0 +1,4 @@
+var iframe_default = "./iframe.html";
+export {
+  iframe_default as default
+};

package/dist/esm/testing/mocks/svg.js

@@ -1,4 +1,3 @@
-import * as React from "react";
 var svg_default = "SvgrURL";
 const ReactComponent = "div";
 export {

package/dist/esm/testing/resolver.cjs

@@ -32,7 +32,6 @@ module.exports = (request, options) => {
   }
   const resolution = resolutions.find(({ matcher }) => matcher.test(request));
   if (resolution) {
-    // eslint-disable-next-line no-restricted-syntax
     for (const extension of resolution.extensions) {
       try {
         return resolver(

package/dist/esm/testing/setup-tests.js

@@ -1,8 +1,7 @@
-import "core-js/stable";
 import "regenerator-runtime/runtime";
-import "@testing-library/jest-dom/extend-expect";
-import jestAxe from "jest-axe";
+import "@testing-library/jest-dom/jest-globals";
 import ResizeObserver from "resize-observer-polyfill";
+import { toHaveNoViolations } from "./extended/axe-core";
 import { addMatchMedia } from "./mocks/matchMedia.js";
 import { logger } from "./mocks/pui-diagnostics.js";
 const originalError = console.error;
@@ -24,23 +23,19 @@ console.error = (...args) => {
     return false;
   return originalError(...args);
 };
-if (expect)
-  expect.extend(jestAxe.toHaveNoViolations);
+if (expect) expect.extend(toHaveNoViolations);
 const addElementToBody = (element) => {
   const documentEle = (window || {}).document;
-  if (!documentEle)
-    return null;
+  if (!documentEle) return null;
   const bodyEle = documentEle.body;
   const newEle = documentEle.createElement(...element);
-  if (!newEle)
-    return null;
+  if (!newEle) return null;
   bodyEle.appendChild(newEle);
   return newEle;
 };
 const addRootElement = (id) => {
   const rootEle = addElementToBody("div");
-  if (rootEle)
-    rootEle.id = id;
+  if (rootEle) rootEle.id = id;
 };
 addRootElement("root");
 addMatchMedia();
@@ -49,3 +44,26 @@ window.emui = {
   logger: logger(),
   _BASE_PATH: new URL(document.baseURI).pathname
 };
+let showCorejsWarn = false;
+afterAll(() => {
+  if (showCorejsWarn) {
+    console.warn(
+      `IMPORTANT: Try importing core-js/stable in your failed test files and retrying.
+Some tests might have failed because of it`
+    );
+  }
+});
+const originalTest = global.test;
+global.it = (name, fn, timeout = void 0) => {
+  const fnWrapper = async () => {
+    try {
+      await fn();
+    } catch (error) {
+      showCorejsWarn = true;
+      throw error;
+    }
+  };
+  originalTest(name, fnWrapper, timeout);
+};
+global.it.skip = originalTest.skip;
+global.it.only = originalTest.only;

package/dist/esm/testing/vitest.config.js

@@ -1,27 +1,24 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { defineConfig, configDefaults } from "vitest/config";
 import react from "@vitejs/plugin-react";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
+import tsconfigPaths from "vite-tsconfig-paths";
 const vitestConfig = defineConfig({
-  plugins: [react()],
+  // @ts-expect-error - `react` and `tsconfigPaths` are not part of the default config
+  plugins: [react(), tsconfigPaths()],
   test: {
     globals: true,
     root: process.cwd(),
-    environment: "jsdom",
-    setupFiles: [path.resolve(__dirname, "./setup-test-env.js")],
+    environment: "happy-dom",
     include: ["./{app,lib}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}"],
     exclude: [...configDefaults.exclude, ".idea", ".git", ".cache", "e2e"],
-    // watchIgnore: [
-    //   '.*\\/node_modules\\/.*',
-    //   '.*\\/build\\/.*',
-    //   '.*\\/dist\\/.*',
-    // ],
     coverage: {
       reportsDirectory: "./reports/coverage"
     },
     deps: {
-      inline: [/app.config.json/]
+      optimizer: {
+        web: {
+          include: ["app.config.json", "@elliemae/pui-app-sdk"]
+        }
+      }
     }
   }
 });

package/dist/esm/transpile/.swcrc

@@ -4,8 +4,9 @@
       "syntax": "typescript",
       "jsx": true,
       "tsx": true,
+      "decorators": true,
       "dynamicImport": true
     },
-    "target": "es2020"
+    "target": "es2022"
   }
 }

package/dist/esm/transpile/esbuild.js

@@ -1,15 +1,40 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import fg from "fast-glob";
-import { build } from "esbuild";
 import { writeFile, copyFile, readFile, mkdir } from "node:fs/promises";
 import browserslistToEsbuild from "browserslist-to-esbuild";
+import fg from "fast-glob";
+import { build } from "esbuild";
 import lodashTransformer from "esbuild-plugin-lodash";
+const readPkgJson = async () => {
+  const pkgJsonPath = path.join(process.cwd(), "package.json");
+  const pkgJson = JSON.parse(await readFile(pkgJsonPath, "utf8"));
+  return pkgJson;
+};
+const writePkgJson = async (pkgJson) => {
+  const pkgJsonPath = path.join(process.cwd(), "package.json");
+  await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2));
+};
+const removeModuleType = async () => {
+  const pkgJson = await readPkgJson();
+  const prevModuleType = pkgJson.type;
+  if (pkgJson.type) {
+    delete pkgJson.type;
+    await writePkgJson(pkgJson);
+  }
+  return prevModuleType;
+};
+const restoreModuleType = async (typeValue) => {
+  if (typeValue) {
+    const pkgJson = await readPkgJson();
+    pkgJson.type = typeValue;
+    await writePkgJson(pkgJson);
+  }
+};
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const TARGETS = {
   browserslist: browserslistToEsbuild(),
-  web: "es2020",
-  node: "node18"
+  web: "es2022",
+  node: "node20"
 };
 const ESBUILD_FORMAT = {
   CJS: "cjs",
@@ -77,16 +102,24 @@ const esBuild = async ({
   if (!esmOnly) {
     const cjsOutdir = `${outdir}/cjs`;
     const commonJSEntryPoints = await fg(inputFiles);
-    await build({
-      entryPoints: commonJSEntryPoints,
-      ...getCommonConfig({ injectReactShim }),
+    const typeValue = await removeModuleType();
+    try {
+      await build({
+        entryPoints: commonJSEntryPoints,
+        ...getCommonConfig({ injectReactShim }),
+        outdir: cjsOutdir,
+        format: ESBUILD_FORMAT.CJS,
+        target,
+        plugins: [lodashTransformer()]
+      });
+    } finally {
+      await restoreModuleType(typeValue);
+    }
+    await copyFiles({ srcdir, outdir: cjsOutdir });
+    await createPackageJson({
       outdir: cjsOutdir,
-      format: ESBUILD_FORMAT.CJS,
-      target,
-      plugins: [lodashTransformer()]
+      type: NODE_MODULE_TYPES.CJS
     });
-    await copyFiles({ srcdir, outdir: cjsOutdir });
-    await createPackageJson({ outdir: cjsOutdir, type: NODE_MODULE_TYPES.CJS });
   }
   const esmOutdir = esmOnly ? outdir : `${outdir}/esm`;
   const entryPoints = await fg(

package/dist/esm/update-notifier.js

@@ -1,6 +1,6 @@
-import updateNotifier from "update-notifier";
 import path from "node:path";
 import fs from "node:fs/promises";
+import updateNotifier from "update-notifier";
 const notifyUpdates = async () => {
   const pkgFile = await fs.readFile(path.join(process.cwd(), "./package.json"));
   const pkg = JSON.parse(pkgFile);

package/dist/esm/utils.cjs

@@ -14,7 +14,7 @@ exports.getAppConfig = () => {
 
   if (!fs.existsSync(appConfigPath)) return '{}';
   const appConfig = fs.readFileSync(appConfigPath);
-  return appConfig || '{}';
+  return appConfig ?? '{}';
 };
 
 exports.isApp = isApp;

package/dist/esm/utils.js

@@ -1,20 +1,21 @@
 import fs from "node:fs";
 import path from "node:path";
-const basePath = (process.env.BASE_PATH || "/").replace(/\/?$/, "/");
+const basePath = (process.env.BASE_PATH ?? "/").replace(/\/?$/, "/");
 const isApp = () => fs.existsSync(path.join(process.cwd(), "app"));
+const isHttps = () => process.env.HTTPS === "true";
 const getAppConfig = () => {
   const appConfigPath = path.join(
     process.cwd(),
     isApp() ? "app" : "lib",
     "app.config.json"
   );
-  if (!fs.existsSync(appConfigPath))
-    return "{}";
+  if (!fs.existsSync(appConfigPath)) return "{}";
   const appConfig = fs.readFileSync(appConfigPath);
   return appConfig || "{}";
 };
 export {
   basePath,
   getAppConfig,
-  isApp
+  isApp,
+  isHttps
 };

package/dist/esm/webpack/csp-plugin.js

@@ -0,0 +1,49 @@
+import HtmlWebpackPlugin from "html-webpack-plugin";
+import { CSP } from "./csp.js";
+const defaultOptions = {
+  enableUnsafeEval: false
+};
+class CspPlugin {
+  #options = defaultOptions;
+  /**
+   * @param {object} options Additional options for this module.
+   */
+  constructor(options) {
+    this.#options = { ...this.#options, ...options ?? {} };
+  }
+  /**
+   * Processes HtmlWebpackPlugin's html data by adding the CSP
+   * @param _compilation
+   * @param htmlPluginData
+   * @param htmlPluginData.html
+   * @param compileCb
+   * @returns {*}
+   */
+  processCsp(_compilation, htmlPluginData, compileCb) {
+    const cspModule = new CSP(htmlPluginData.html);
+    cspModule.refactorSourcedScriptsForHashBasedCsp();
+    const scriptHashes = cspModule.hashAllInlineScripts();
+    const { enableUnsafeEval } = this.#options;
+    const strictCsp = CSP.getStrictCsp(scriptHashes, {
+      enableUnsafeEval
+    });
+    cspModule.addMetaTag(strictCsp);
+    htmlPluginData.html = cspModule.serializeDom();
+    return compileCb(null, htmlPluginData);
+  }
+  /**
+   * Hooks into webpack to collect assets and hash them, build the policy, and add it into our HTML template
+   * @param compiler
+   */
+  apply(compiler) {
+    compiler.hooks.compilation.tap("CspPlugin", (compilation) => {
+      HtmlWebpackPlugin.getCompilationHooks(compilation).beforeEmit.tapAsync(
+        "CspPlugin",
+        this.processCsp.bind(this, compilation)
+      );
+    });
+  }
+}
+export {
+  CspPlugin
+};

package/dist/esm/webpack/csp.js

@@ -0,0 +1,128 @@
+import * as crypto from "node:crypto";
+import * as cheerio from "cheerio";
+class CSP {
+  static HASH_FUNCTION = "sha256";
+  static INLINE_SCRIPT_SELECTOR = "script:not([src])";
+  static SOURCED_SCRIPT_SELECTOR = "script[src]";
+  $;
+  constructor(html) {
+    this.$ = cheerio.load(html);
+  }
+  serializeDom() {
+    return this.$.root().html() ?? "";
+  }
+  /**
+   * Returns a strict Content Security Policy for mittigating XSS.
+   * For more details read csp.withgoogle.com.
+   * If you modify this CSP, make sure it has not become trivially bypassable by
+   * checking the policy using csp-evaluator.withgoogle.com.
+   * @param hashes A list of sha-256 hashes of trusted inline scripts.
+   * @param cspOptions
+   * @param enableTrustedTypes If Trusted Types should be enabled for scripts.
+   * @param enableBrowserFallbacks If fallbacks for older browsers should be
+   *   added. This is will not weaken the policy as modern browsers will ignore
+   *   the fallbacks.
+   * @param enableUnsafeEval If you cannot remove all uses of eval(), you can
+   *   still set a strict CSP, but you will have to use the 'unsafe-eval'
+   *   keyword which will make your policy slightly less secure.
+   * @param cspOptions.enableBrowserFallbacks
+   * @param cspOptions.enableTrustedTypes
+   * @param cspOptions.enableUnsafeEval
+   * @returns A strict Content Security Policy string.
+   */
+  static getStrictCsp(hashes, cspOptions = {
+    enableUnsafeEval: false
+  }) {
+    const strictCspTemplate = {
+      // 'strict-dynamic' allows hashed scripts to create new scripts.
+      "script-src": [`'strict-dynamic'`, ...hashes ?? []],
+      // Restricts `object-src` to disable dangerous plugins like Flash.
+      "object-src": [`'none'`],
+      // Restricts `base-uri` to block the injection of `<base>` tags. This
+      // prevents attackers from changing the locations of scripts loaded from
+      // relative URLs.
+      "base-uri": [`'self'`]
+    };
+    if (cspOptions.enableUnsafeEval) {
+      strictCspTemplate["script-src"].push(`'unsafe-eval'`);
+    }
+    return Object.entries(strictCspTemplate).map(([directive, values]) => `${directive} ${values.join(" ")};`).join("");
+  }
+  /**
+   * Enables a CSP via a meta tag at the beginning of the document.
+   * Warning: It's recommended to set CSP as HTTP response header instead of
+   * using a meta tag. Injections before the meta tag will not be covered by CSP
+   * and meta tags don't support CSP in report-only mode.
+   * @param csp A Content Security Policy string.
+   */
+  addMetaTag(csp) {
+    let metaTag = this.$('meta[http-equiv="Content-Security-Policy"]');
+    if (!metaTag.length) {
+      metaTag = cheerio.load('<meta http-equiv="Content-Security-Policy">')(
+        "meta"
+      );
+      metaTag.prependTo(this.$("head"));
+    }
+    metaTag.attr("content", csp);
+  }
+  /**
+   * Replaces all sourced scripts with a single inline script that can be hashed
+   */
+  refactorSourcedScriptsForHashBasedCsp() {
+    const scriptInfoList = this.$(CSP.SOURCED_SCRIPT_SELECTOR).map((_i, script) => {
+      const src = this.$(script).attr("src") ?? "";
+      const type = this.$(script).attr("type") ?? "";
+      this.$(script).remove();
+      return { src, type };
+    }).toArray().filter((info) => info.src);
+    const loaderScript = CSP.createLoaderScript(scriptInfoList);
+    if (!loaderScript) {
+      return;
+    }
+    const newScript = cheerio.load("<script>")("script");
+    newScript.text(loaderScript);
+    newScript.appendTo(this.$("body"));
+  }
+  /**
+   * Returns a list of hashes of all inline scripts found in the HTML document.
+   * @returns A list of sha-256 hashes of inline scripts.
+   */
+  hashAllInlineScripts() {
+    return this.$(CSP.INLINE_SCRIPT_SELECTOR).map((_i, elem) => CSP.hashInlineScript(this.$(elem).html() ?? "")).get();
+  }
+  /**
+   * Returns JS code for dynamically loading sourced (external) scripts.
+   * @param scriptInfoList A list of objects containing src and type for scripts that should be loaded
+   * @returns JS code for loading scripts.
+   */
+  static createLoaderScript(scriptInfoList) {
+    if (!scriptInfoList.length) {
+      return void 0;
+    }
+    return `
+    var scripts = ${JSON.stringify(scriptInfoList)};
+    scripts.forEach(function(scriptInfo) {
+      var s = document.createElement('script');
+      s.src = scriptInfo.src;
+      if (scriptInfo.type) {
+        s.type = scriptInfo.type;
+      }
+      s.async = false; // preserve execution order.
+      document.body.appendChild(s);
+    });
+    `;
+  }
+  /**
+   * Calculates a CSP compatible hash of an inline script.
+   * @param scriptText Text between opening and closing script tag. Has to
+   *     include whitespaces and newlines!
+   * @returns A sha-256 hash of the script.
+   */
+  static hashInlineScript(scriptText) {
+    const hash = crypto.createHash(CSP.HASH_FUNCTION).update(scriptText, "utf-8").digest("base64");
+    return `'${CSP.HASH_FUNCTION}-${hash}'`;
+  }
+}
+export {
+  CSP
+};