@inneropen/marvin-sdk 2.0.0-next.13 → 2.0.0-next.15

package/dist/platform.js

@@ -1,8 +1,9 @@
 import {
   HttpClient,
+  MarvinValidationError,
   SessionAuth,
   init_core
-} from "./chunk-DYC2BEA4.js";
+} from "./chunk-WJC4X7TB.js";
 
 // src/platform/client.ts
 init_core();
@@ -23,7 +24,8 @@ var EntriesModule = class {
    * Get a single entry by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}`);
   }
   /**
    * Create a new entry
@@ -35,26 +37,31 @@ var EntriesModule = class {
    * Update an entry
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/entries/${id}`, data);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.patch(`/api/platform/entries/${validId}`, data);
   }
   /**
    * Delete an entry
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.delete(`/api/platform/entries/${validId}`);
   }
   /**
    * Get collections that this entry belongs to
    */
   async listCollections(entryId) {
-    return this.http.get(`/api/platform/entries/${entryId}/collections`);
+    const validId = this.http.validatePathParam(entryId, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}/collections`);
   }
   /**
    * Add entry to a collection
    */
   async addToCollection(entryId, collectionId) {
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
     return this.http.post(
-      `/api/platform/entries/${entryId}/collections/${collectionId}`,
+      `/api/platform/entries/${validEntryId}/collections/${validCollectionId}`,
       {}
     );
   }
@@ -62,7 +69,9 @@ var EntriesModule = class {
    * Remove entry from a collection
    */
   async removeFromCollection(entryId, collectionId) {
-    return this.http.delete(`/api/platform/entries/${entryId}/collections/${collectionId}`);
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
+    return this.http.delete(`/api/platform/entries/${validEntryId}/collections/${validCollectionId}`);
   }
 };
 
@@ -82,7 +91,8 @@ var CollectionsModule = class {
    * Get a single collection by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/collections/${validId}`);
   }
   /**
    * Create a new collection
@@ -94,25 +104,29 @@ var CollectionsModule = class {
    * Update a collection
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/collections/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/collections/${validId}`, data);
   }
   /**
    * Delete a collection
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.delete(`/api/platform/collections/${validId}`);
   }
   /**
    * Get entries in a collection
    */
   async getEntries(id) {
-    return this.http.get(`/api/platform/collections/${id}/entries`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.get(`/api/platform/collections/${validId}/entries`);
   }
   /**
    * Reorder entries in a collection
    */
   async reorderEntries(id, entries) {
-    return this.http.patch(`/api/platform/collections/${id}/entries/order`, { entries });
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.patch(`/api/platform/collections/${validId}/entries/order`, { entries });
   }
 };
 
@@ -132,7 +146,8 @@ var ResourcesModule = class {
    * Get a single resource by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/resources/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/resources/${validId}`);
   }
   /**
    * Create a new resource
@@ -144,7 +159,8 @@ var ResourcesModule = class {
    * Update a resource
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/resources/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/resources/${validId}`, data);
   }
   /**
    * Delete a resource
@@ -161,11 +177,53 @@ var ResourcesModule = class {
 };
 
 // src/platform/assets.ts
+init_core();
 var AssetsModule = class {
   constructor(http) {
     this.http = http;
   }
   http;
+  /**
+   * Validate file before upload
+   */
+  validateFile(file, options) {
+    const maxSize = options?.maxFileSize || 100 * 1024 * 1024;
+    const allowedTypes = options?.allowedMimeTypes;
+    if (file.size === 0) {
+      throw new MarvinValidationError("File is empty");
+    }
+    if (file.size > maxSize) {
+      const maxMB = Math.round(maxSize / (1024 * 1024));
+      const fileMB = Math.round(file.size / (1024 * 1024));
+      throw new MarvinValidationError(
+        `File size (${fileMB}MB) exceeds maximum allowed size of ${maxMB}MB`
+      );
+    }
+    if (allowedTypes && allowedTypes.length > 0) {
+      if (file instanceof File && file.type) {
+        const isAllowed = allowedTypes.some((allowed) => {
+          if (allowed.endsWith("/*")) {
+            const prefix = allowed.slice(0, -2);
+            return file.type.startsWith(prefix);
+          }
+          return file.type === allowed;
+        });
+        if (!isAllowed) {
+          throw new MarvinValidationError(
+            `File type "${file.type}" is not allowed. Allowed types: ${allowedTypes.join(", ")}`
+          );
+        }
+      }
+    }
+    if (file instanceof File) {
+      if (!file.name || file.name.trim().length === 0) {
+        throw new MarvinValidationError("File must have a valid name");
+      }
+      if (file.name.includes("..") || file.name.includes("/") || file.name.includes("\\")) {
+        throw new MarvinValidationError("Invalid filename: cannot contain path separators");
+      }
+    }
+  }
   /**
    * List all assets
    */
@@ -176,16 +234,31 @@ var AssetsModule = class {
    * Get a single asset by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/assets/${validId}`);
   }
   /**
    * Upload a new asset file
    *
    * @param file - The file to upload (File or Blob)
    * @param metadata - Asset metadata (slug, name, altText, description, metadata)
+   * @param options - Upload options (file size limits, allowed types)
    * @returns The created asset with extracted metadata
+   *
+   * @example
+   * ```typescript
+   * // Upload with default limits (100MB, all types)
+   * const asset = await assets.upload(file, { slug: 'my-image', name: 'My Image' });
+   *
+   * // Upload with restrictions
+   * const asset = await assets.upload(file,
+   *   { slug: 'avatar', name: 'Avatar' },
+   *   { maxFileSize: 5 * 1024 * 1024, allowedMimeTypes: ['image/*'] }
+   * );
+   * ```
    */
-  async upload(file, metadata) {
+  async upload(file, metadata, options) {
+    this.validateFile(file, options);
     const formData = new FormData();
     formData.append("file", file);
     formData.append("slug", metadata.slug);
@@ -205,13 +278,24 @@ var AssetsModule = class {
    * Update an asset (editable fields only: slug, name, altText, description, metadata)
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/assets/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/assets/${validId}`, data);
   }
   /**
    * Delete an asset (removes file from storage and database)
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "asset ID");
+    return this.http.delete(`/api/platform/assets/${validId}`);
+  }
+  /**
+   * Get download URL for an asset file
+   * Use this to create download links or fetch the file directly
+   */
+  getDownloadUrl(id, baseUrl) {
+    const validId = this.http.validatePathParam(id, "asset ID");
+    const base = baseUrl || (typeof window !== "undefined" && window.location ? window.location.origin : "");
+    return `${base}/api/platform/assets/${validId}/file`;
   }
 };
 
@@ -231,7 +315,8 @@ var APIClientsModule = class {
    * Get a single API client by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/api-clients/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/api-clients/${validId}`);
   }
   /**
    * Create a new API client (returns client with token)
@@ -243,7 +328,8 @@ var APIClientsModule = class {
    * Update an API client
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/api-clients/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/api-clients/${validId}`, data);
   }
   /**
    * Delete an API client
@@ -454,11 +540,23 @@ var InvitesModule = class {
   }
   /**
    * Generate invitation URL from a token
-   * Uses MARVIN_FRONTEND_URL for the base URL, falls back to MARVIN_API_URL with common port mappings
+   *
+   * @param token - Invitation token
+   * @param baseUrl - Base URL for the frontend (required in browser environments)
+   * @returns Full invitation URL
+   *
+   * @example
+   * ```typescript
+   * // Node.js (can use env vars)
+   * const url = invites.getInvitationUrl(token);
+   *
+   * // Browser (must provide baseUrl)
+   * const url = invites.getInvitationUrl(token, 'https://app.example.com');
+   * ```
    */
   getInvitationUrl(token, baseUrl) {
     let base = baseUrl;
-    if (!base) {
+    if (!base && typeof process !== "undefined" && process.env) {
       base = process.env.MARVIN_FRONTEND_URL;
       if (!base && process.env.MARVIN_API_URL) {
         const apiUrl = process.env.MARVIN_API_URL;
@@ -470,11 +568,17 @@ var InvitesModule = class {
           base = apiUrl;
         }
       }
-      if (!base) {
-        base = "http://localhost:4321";
+    }
+    if (!base) {
+      if (typeof window !== "undefined" && window.location) {
+        base = window.location.origin;
+      } else {
+        throw new Error(
+          'baseUrl is required when not in Node.js environment. Pass the frontend URL as second argument: getInvitationUrl(token, "https://app.example.com")'
+        );
       }
     }
-    return `${base}/register?token=${token}`;
+    return `${base}/register?token=${encodeURIComponent(token)}`;
   }
 };
 
@@ -523,11 +627,63 @@ var NotificationsModule = class {
 };
 
 // src/platform/webhooks.ts
+init_core();
 var WebhooksModule = class {
   constructor(http) {
     this.http = http;
   }
   http;
+  /**
+   * Validate webhook URL to prevent SSRF attacks
+   */
+  validateWebhookUrl(url) {
+    if (!url || typeof url !== "string") {
+      throw new MarvinValidationError("Webhook URL is required and must be a string");
+    }
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new MarvinValidationError("Invalid webhook URL format. Expected: https://example.com/webhook");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new MarvinValidationError(
+        `Webhook URL must use HTTP or HTTPS protocol. Got: ${parsed.protocol}`
+      );
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    const blockedHosts = [
+      "localhost",
+      "127.0.0.1",
+      "0.0.0.0",
+      "::1",
+      "169.254.169.254",
+      // AWS metadata service
+      "[::]"
+    ];
+    if (blockedHosts.some((blocked) => hostname === blocked || hostname.includes(blocked))) {
+      throw new MarvinValidationError(
+        "Webhook URL cannot target localhost or internal network addresses"
+      );
+    }
+    const ipv4Regex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+    const match = hostname.match(ipv4Regex);
+    if (match) {
+      const octets = match.slice(1).map(Number);
+      if (octets[0] === 10) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (10.x.x.x)");
+      }
+      if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (172.16-31.x.x)");
+      }
+      if (octets[0] === 192 && octets[1] === 168) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (192.168.x.x)");
+      }
+    }
+    if (url.length > 2048) {
+      throw new MarvinValidationError("Webhook URL exceeds maximum length of 2048 characters");
+    }
+  }
   /**
    * List all webhooks for the current workspace
    */
@@ -539,31 +695,43 @@ var WebhooksModule = class {
    * Get a webhook by ID
    */
   async get(id) {
-    return this.http.get(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.get(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Create a new webhook
+   * Validates URL to prevent SSRF attacks
    */
   async create(data) {
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
     return this.http.post("/api/groups/webhooks", data);
   }
   /**
    * Update a webhook
+   * Validates URL if provided to prevent SSRF attacks
    */
   async update(id, data) {
-    return this.http.put(`/api/groups/webhooks/${id}`, data);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
+    return this.http.put(`/api/groups/webhooks/${validId}`, data);
   }
   /**
    * Delete a webhook
    */
   async delete(id) {
-    await this.http.delete(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    await this.http.delete(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Test a webhook
    */
   async test(id) {
-    return this.http.post(`/api/groups/webhooks/${id}/test`, {});
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.post(`/api/groups/webhooks/${validId}/test`, {});
   }
   /**
    * Rerun failed webhooks
@@ -655,6 +823,7 @@ var AdminSystemModule = class {
   }
   /**
    * Update email settings
+   * Note: Password field is write-only and will not be returned in response
    */
   async updateEmailSettings(data) {
     return this.http.put("/api/admin/email", data);
@@ -1005,7 +1174,8 @@ var ScheduledTasksModule = class {
    * Get a scheduled task by ID or slug
    */
   async get(idOrSlug) {
-    return this.http.get(`/api/platform/scheduled-tasks/${idOrSlug}`);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.get(`/api/platform/scheduled-tasks/${validIdOrSlug}`);
   }
   /**
    * Create a new scheduled task
@@ -1017,7 +1187,8 @@ var ScheduledTasksModule = class {
    * Update a scheduled task
    */
   async update(idOrSlug, data) {
-    return this.http.patch(`/api/platform/scheduled-tasks/${idOrSlug}`, data);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.patch(`/api/platform/scheduled-tasks/${validIdOrSlug}`, data);
   }
   /**
    * Delete a scheduled task
@@ -1058,11 +1229,40 @@ var ScheduledTasksModule = class {
 };
 
 // src/platform/forms.ts
+init_core();
 var FormsModule = class {
   constructor(http) {
     this.http = http;
   }
   http;
+  /**
+   * Validate form submission data
+   * - Prevents XSS by checking for script tags
+   * - Validates data is a proper object
+   * - Checks for reasonable size limits
+   */
+  validateFormData(data) {
+    if (!data || typeof data !== "object") {
+      throw new MarvinValidationError("Form data must be a valid object");
+    }
+    const jsonString = JSON.stringify(data);
+    const sizeInBytes = new Blob([jsonString]).size;
+    if (sizeInBytes > 1024 * 1024) {
+      throw new MarvinValidationError("Form data exceeds maximum size of 1MB");
+    }
+    const checkForScripts = (value) => {
+      if (typeof value === "string") {
+        if (/<script[\s\S]*?>[\s\S]*?<\/script>/gi.test(value)) {
+          throw new MarvinValidationError("Form data contains potentially malicious content");
+        }
+      } else if (Array.isArray(value)) {
+        value.forEach(checkForScripts);
+      } else if (value && typeof value === "object") {
+        Object.values(value).forEach(checkForScripts);
+      }
+    };
+    Object.values(data).forEach(checkForScripts);
+  }
   /**
    * List all forms
    */
@@ -1073,7 +1273,8 @@ var FormsModule = class {
    * Get a single form by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/forms/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/forms/${validId}`);
   }
   /**
    * Create a new form
@@ -1085,7 +1286,8 @@ var FormsModule = class {
    * Update a form
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/forms/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/forms/${validId}`, data);
   }
   /**
    * Delete a form
@@ -1107,15 +1309,25 @@ var FormsModule = class {
   }
   /**
    * Submit data to a published form (Publishing API - public access)
+   * Validates data before submission to prevent XSS and malicious content
    */
   async submitForm(slug, data) {
-    return this.http.post(`/api/publish/forms/${slug}/submit`, {
+    const validSlug = this.http.validatePathParam(slug, "form slug");
+    this.validateFormData(data);
+    return this.http.post(`/api/publish/forms/${validSlug}/submit`, {
       dataJson: data
     });
   }
 };
 
 // src/platform/client.ts
+function createPlatformConfigFromEnv(overrides) {
+  return {
+    apiUrl: overrides?.apiUrl || process.env.MARVIN_API_URL || "http://localhost:8080",
+    userToken: overrides?.userToken || process.env.MARVIN_USER_TOKEN,
+    credentials: overrides?.credentials || "include"
+  };
+}
 var PlatformClient = class extends HttpClient {
   entries;
   collections;
@@ -1142,7 +1354,7 @@ var PlatformClient = class extends HttpClient {
   adminMaintenance;
   constructor(config) {
     const httpConfig = {
-      baseUrl: config.apiUrl,
+      baseUrl: config.apiUrl || "http://localhost:8080",
       auth: new SessionAuth(config.userToken),
       credentials: config.credentials || "include"
     };
@@ -1172,7 +1384,8 @@ var PlatformClient = class extends HttpClient {
   }
 };
 function createPlatformClient(config) {
-  return new PlatformClient(config);
+  const finalConfig = createPlatformConfigFromEnv(config);
+  return new PlatformClient(finalConfig);
 }
 export {
   APIClientsModule,
@@ -1198,5 +1411,6 @@ export {
   WebhooksModule,
   WorkspaceMembersModule,
   WorkspacesModule,
-  createPlatformClient
+  createPlatformClient,
+  createPlatformConfigFromEnv
 };