@lionrapid/core 0.1.3-beta.0 → 0.1.4-beta.2

package/dist/browser/lionrapid.editor.js

@@ -174,6 +174,58 @@ var LionRapidEditor = (() => {
   cursor: not-allowed;
 }
 
+/* Workflow action buttons (Phase 3) */
+.lr-workflow-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin: 12px 0 4px;
+  padding: 8px 0 0;
+  border-top: 1px solid #e5e7eb;
+}
+
+.lr-wf-btn {
+  font-size: 12px;
+  font-weight: 500;
+  padding: 5px 10px;
+  border-radius: 4px;
+  border: 1px solid transparent;
+  cursor: pointer;
+  transition: background-color 0.1s;
+}
+
+.lr-wf-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.lr-wf-primary {
+  background: #2563eb;
+  color: white;
+  border-color: #2563eb;
+}
+.lr-wf-primary:hover:not(:disabled) {
+  background: #1d4ed8;
+}
+
+.lr-wf-secondary {
+  background: white;
+  color: #374151;
+  border-color: #d1d5db;
+}
+.lr-wf-secondary:hover:not(:disabled) {
+  background: #f3f4f6;
+}
+
+.lr-wf-danger {
+  background: white;
+  color: #b91c1c;
+  border-color: #fca5a5;
+}
+.lr-wf-danger:hover:not(:disabled) {
+  background: #fef2f2;
+}
+
 /* Snapshot viewer sandbox wrapper */
 #__lr_snapshot_root {
   isolation: isolate;
@@ -449,6 +501,27 @@ var LionRapidEditor = (() => {
 }
 `;
 
+  // src/content/safe-href.ts
+  var SAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+  var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
+  function safeHref(href) {
+    if (!href) return "#";
+    const trimmed = href.trim();
+    if (!trimmed) return "#";
+    if (trimmed.startsWith("//")) {
+      return "#";
+    }
+    if (trimmed.startsWith("/") || trimmed.startsWith("?") || trimmed.startsWith("#") || trimmed.startsWith("./") || trimmed.startsWith("../")) {
+      return trimmed;
+    }
+    const schemeMatch = SAFE_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+      const scheme = schemeMatch[0].toLowerCase();
+      return ALLOWED_SCHEMES.has(scheme) ? trimmed : "#";
+    }
+    return trimmed;
+  }
+
   // src/content/style-mapper/DefaultStyleMapper.ts
   var DefaultStyleMapper = class {
     constructor() {
@@ -534,7 +607,7 @@ var LionRapidEditor = (() => {
         if (style.startsWith("hyperlink:")) {
           return {
             element: "a",
-            attrs: { href: style.slice("hyperlink:".length) }
+            attrs: { href: safeHref(style.slice("hyperlink:".length)) }
           };
         }
       }
@@ -1274,7 +1347,7 @@ var LionRapidEditor = (() => {
   // src/browser/editor/sidebar.ts
   var htmlSerializer2 = new HTMLSerializer();
   var Sidebar = class {
-    constructor(shadowRoot, api, locale, namespace, defaultLocale, onBlockClick) {
+    constructor(shadowRoot, api, locale, namespace, defaultLocale, onBlockClick, userRole = "") {
       __publicField(this, "el");
       __publicField(this, "bodyEl");
       __publicField(this, "statusEl");
@@ -1290,11 +1363,13 @@ var LionRapidEditor = (() => {
       __publicField(this, "onProgressUpdate", null);
       __publicField(this, "lastFetchTime", 0);
       __publicField(this, "lastFlushTime", 0);
+      __publicField(this, "userRole");
       this.api = api;
       this.locale = locale;
       this.namespace = namespace;
       this.defaultLocale = defaultLocale;
       this.onBlockClick = onBlockClick;
+      this.userRole = userRole;
       this.blockExtractor = new BlockExtractor();
       this.el = document.createElement("div");
       this.el.className = "lr-sidebar";
@@ -1448,6 +1523,9 @@ var LionRapidEditor = (() => {
         }
         return previewEl;
       });
+      if (!isSourceLocale) {
+        this.renderWorkflowActions(key, status);
+      }
       if (!isLocked) {
         textarea.addEventListener("input", () => {
           const text = textarea.value;
@@ -1470,6 +1548,69 @@ var LionRapidEditor = (() => {
         setTimeout(() => textarea.focus(), 100);
       }
     }
+    /**
+     * Render Confirm/Reject/Mark-Ready/Unmark-Ready buttons under the preview.
+     * Visibility:
+     *   - Confirm: shown when row is not locked and not already ready
+     *   - Reject:  shown when row is not locked and not already ready (server
+     *              returns 400 if stage_index is already 0)
+     *   - Unconfirm: shown when isConfirmed
+     *   - Mark Ready: PM/admin only, hidden when already ready
+     *   - Unmark Ready: PM/admin only, only when ready
+     * After any successful click we re-fetch status for this key so the UI
+     * reflects the new state and the unaffected buttons hide/show themselves.
+     */
+    renderWorkflowActions(key, status) {
+      const isPM = this.userRole === "project_manager" || this.userRole === "admin";
+      const isReady = !!status?.isReady;
+      const isLocked = !!status?.isLocked;
+      const isConfirmed = !!status?.isConfirmed;
+      const composite = `${this.locale}:${this.namespace}:${key}`;
+      const wrap = document.createElement("div");
+      wrap.className = "lr-workflow-actions";
+      const addBtn = (label, action, variant = "secondary") => {
+        const btn = document.createElement("button");
+        btn.className = `lr-wf-btn lr-wf-${variant}`;
+        btn.textContent = label;
+        btn.addEventListener("click", async () => {
+          btn.disabled = true;
+          const result = await this.api.transitionTarget(composite, action);
+          btn.disabled = false;
+          if (result) {
+            await this.refreshStatusForKey(key);
+          }
+        });
+        wrap.appendChild(btn);
+      };
+      if (!isLocked && !isReady) {
+        addBtn("Confirm", "confirm", "primary");
+        addBtn("Reject", "reject", "danger");
+      }
+      if (isConfirmed && !isLocked && !isReady) {
+        addBtn("Unconfirm", "unconfirm");
+      }
+      if (isPM) {
+        if (!isReady) {
+          addBtn("Mark Ready", "mark-ready", "primary");
+        } else {
+          addBtn("Unmark Ready", "unmark-ready", "danger");
+        }
+      }
+      if (wrap.children.length > 0) {
+        this.bodyEl.appendChild(wrap);
+      }
+    }
+    /** Re-fetch status for one key and re-render the current view. */
+    async refreshStatusForKey(key) {
+      const fresh = await this.api.fetchStatus([key], this.locale, this.namespace);
+      for (const [k, s] of Object.entries(fresh)) {
+        this.statusMap.set(k, s);
+      }
+      if (this.current) {
+        this.renderContent(this.current);
+      }
+      this.emitProgress();
+    }
     addField(label, contentFn) {
       const field = document.createElement("div");
       field.className = "lr-field";
@@ -1930,10 +2071,118 @@ var LionRapidEditor = (() => {
         return false;
       }
     }
+    /**
+     * Workflow transitions (Phase 3). Per-key endpoints on the integrations API
+     * that mirror the dashboard's row-level transitions but are addressable by
+     * composite editor key (locale:namespace:auto_xxx).
+     *
+     * Returns the parsed JSON on success, or null on failure (caller usually
+     * shows a toast / re-fetches status).
+     */
+    async transitionTarget(composite, action) {
+      try {
+        const response = await fetch(
+          `${this.apiBase}/api/integrations/targets/${encodeURIComponent(composite)}/${action}`,
+          {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${this.sessionToken}` }
+          }
+        );
+        if (response.status === 401) {
+          this.handleSessionExpired();
+          return null;
+        }
+        if (!response.ok) {
+          this.onStatus("error", `${action} failed: HTTP ${response.status}`);
+          return null;
+        }
+        return await response.json();
+      } catch (err) {
+        this.onStatus("error", `${action} failed: ${err.message}`);
+        return null;
+      }
+    }
   };
 
-  // src/browser/editor/snapshot-capture.ts
+  // src/browser/editor/pii-redactor.ts
   var REDACTED = "[REDACTED]";
+  var EMAIL_RE = /[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi;
+  var PHONE_RE = /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{3}\)|\d{3})[\s.-]\d{3}[\s.-]\d{4}/g;
+  var SSN_RE = /\b\d{3}[\s-]\d{2}[\s-]\d{4}\b/g;
+  var IPV4_RE = /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g;
+  var URL_RE = /\b(?:https?:\/\/|www\.)[^\s<>"']+/gi;
+  var CC_CANDIDATE_RE = /\b\d(?:[ -]?\d){12,18}\b/g;
+  function luhnValid(digits) {
+    if (digits.length < 13 || digits.length > 19) return false;
+    let sum = 0;
+    let alt = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+      let n = digits.charCodeAt(i) - 48;
+      if (n < 0 || n > 9) return false;
+      if (alt) {
+        n *= 2;
+        if (n > 9) n -= 9;
+      }
+      sum += n;
+      alt = !alt;
+    }
+    return sum % 10 === 0;
+  }
+  function ipv4Valid(match) {
+    const parts = match.split(".");
+    if (parts.length !== 4) return false;
+    for (const p of parts) {
+      const n = Number(p);
+      if (!Number.isInteger(n) || n < 0 || n > 255) return false;
+    }
+    return true;
+  }
+  function redactString(text) {
+    if (!text) return text;
+    let out = text;
+    out = out.replace(URL_RE, REDACTED);
+    out = out.replace(EMAIL_RE, REDACTED);
+    out = out.replace(PHONE_RE, REDACTED);
+    out = out.replace(SSN_RE, REDACTED);
+    out = out.replace(IPV4_RE, (m) => ipv4Valid(m) ? REDACTED : m);
+    out = out.replace(CC_CANDIDATE_RE, (m) => {
+      const digits = m.replace(/[\s-]/g, "");
+      return luhnValid(digits) ? REDACTED : m;
+    });
+    return out;
+  }
+  var SKIP_TAGS3 = /* @__PURE__ */ new Set(["CODE", "PRE", "STYLE", "TEXTAREA"]);
+  function redactTextNodes(root) {
+    const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+    const toUpdate = [];
+    let node = walker.nextNode();
+    while (node) {
+      if (!isInSkippedSubtree(node)) {
+        const original = node.nodeValue || "";
+        const replaced = redactString(original);
+        if (replaced !== original) {
+          toUpdate.push({ node, value: replaced });
+        }
+      }
+      node = walker.nextNode();
+    }
+    for (const { node: textNode, value } of toUpdate) {
+      textNode.nodeValue = value;
+    }
+  }
+  function isInSkippedSubtree(node) {
+    let cur = node.parentNode;
+    while (cur && cur.nodeType === Node.ELEMENT_NODE) {
+      const el = cur;
+      if (SKIP_TAGS3.has(el.tagName)) return true;
+      if (el.hasAttribute("data-no-redact")) return true;
+      cur = el.parentNode;
+    }
+    return false;
+  }
+
+  // src/browser/editor/snapshot-capture.ts
+  var REDACTED2 = "[REDACTED]";
   function captureSnapshot() {
     const clone = document.documentElement.cloneNode(true);
     const textEntries = extractTextEntries(clone);
@@ -2001,7 +2250,7 @@ var LionRapidEditor = (() => {
     const sensitive = root.querySelectorAll("[data-pii], [data-sensitive]");
     for (let i = 0; i < sensitive.length; i++) {
       const el = sensitive[i];
-      el.textContent = REDACTED;
+      el.textContent = REDACTED2;
       const attrs = Array.from(el.attributes);
       for (const attr of attrs) {
         if (attr.name !== "class" && attr.name !== "id" && attr.name !== "style") {
@@ -2024,24 +2273,7 @@ var LionRapidEditor = (() => {
     }
   }
   function redactTextNodePII(root) {
-    const filter = new ExcludeFilter(
-      { emails: true, urls: true, numbers: true, phones: true },
-      1
-      // minTextLength=1 so single-char filler still passes through
-    );
-    const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
-    const nodesToRedact = [];
-    let node = walker.nextNode();
-    while (node) {
-      const trimmed = (node.nodeValue || "").trim();
-      if (trimmed.length >= 5 && filter.shouldExclude(trimmed)) {
-        nodesToRedact.push(node);
-      }
-      node = walker.nextNode();
-    }
-    for (const textNode of nodesToRedact) {
-      textNode.nodeValue = REDACTED;
-    }
+    redactTextNodes(root);
   }
   function stripSensitiveMetaAndHeaders(root) {
     const sensitiveMetas = root.querySelectorAll(
@@ -2062,7 +2294,7 @@ var LionRapidEditor = (() => {
         let changed = false;
         for (const param of TOKEN_PARAMS) {
           if (url.searchParams.has(param)) {
-            url.searchParams.set(param, REDACTED);
+            url.searchParams.set(param, REDACTED2);
             changed = true;
           }
         }
@@ -2306,7 +2538,7 @@ var LionRapidEditor = (() => {
       sidebar.open(resolved);
       inspector.clearHighlight();
     };
-    const sidebar = new Sidebar(shadow, api, currentLocale, namespace, defaultLocale, handleBlockSelect);
+    const sidebar = new Sidebar(shadow, api, currentLocale, namespace, defaultLocale, handleBlockSelect, role);
     const inspector = new Inspector(shadow, handleBlockSelect, inspectorRoot, snapshotKeyMap);
     const toolbar = new Toolbar(
       shadow,