@mhosaic/feedback 0.14.0 → 0.15.1

package/dist/{chunk-A4MBOFRR.mjs → chunk-3YLD2AJI.mjs}

@@ -1,6 +1,6 @@
 import {
   scrubCredentials
-} from "./chunk-DKE6ELJ4.mjs";
+} from "./chunk-FGA63IEZ.mjs";
 
 // src/api/client.ts
 var SCALAR_FIELDS = [
@@ -12,6 +12,23 @@ var SCALAR_FIELDS = [
   "user_agent",
   "capture_method"
 ];
+function assertSafeEndpoint(endpoint) {
+  let parsed;
+  try {
+    parsed = new URL(endpoint);
+  } catch {
+    throw new Error(
+      `[mhosaic-feedback] \`endpoint\` is not a valid URL: ${endpoint}`
+    );
+  }
+  if (parsed.protocol === "https:") return;
+  if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]")) {
+    return;
+  }
+  throw new Error(
+    `[mhosaic-feedback] \`endpoint\` must use https:// (got ${parsed.protocol}//${parsed.hostname}). http:// is only allowed for localhost in dev.`
+  );
+}
 function createApiClient(options) {
   const endpoint = (options.endpoint ?? "").replace(/\/+$/, "");
   if (!endpoint) {
@@ -19,6 +36,7 @@ function createApiClient(options) {
       '[mhosaic-feedback] `endpoint` is required (e.g. "https://feedback.example.com").'
     );
   }
+  assertSafeEndpoint(endpoint);
   const fetcher = options.fetch ?? globalThis.fetch;
   async function submitReport(input) {
     let payload = input;
@@ -872,6 +890,20 @@ function truncateUrl(url, maxLength = 80) {
   const keepEnd = maxLength - 1 - keepStart;
   return `${url.slice(0, keepStart)}\u2026${url.slice(url.length - keepEnd)}`;
 }
+function safeExternalHref(url) {
+  if (!url) return void 0;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return void 0;
+  }
+  if (parsed.protocol === "https:") return parsed.toString();
+  if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]")) {
+    return parsed.toString();
+  }
+  return void 0;
+}
 
 // src/widget/ReportDetailView.tsx
 import { Fragment, jsx as jsx2, jsxs as jsxs2 } from "preact/jsx-runtime";
@@ -980,16 +1012,19 @@ function ReportDetailView({
     /* @__PURE__ */ jsxs2("div", { class: "report-detail-body", children: [
       /* @__PURE__ */ jsx2(ContextBlock, { detail, strings }),
       /* @__PURE__ */ jsx2("p", { class: "report-detail-description", children: detail.description }),
-      detail.screenshot_url && /* @__PURE__ */ jsx2(
-        "a",
-        {
-          class: "report-detail-screenshot",
-          href: detail.screenshot_url,
-          target: "_blank",
-          rel: "noopener noreferrer",
-          children: /* @__PURE__ */ jsx2("img", { src: detail.screenshot_url, alt: "", loading: "lazy" })
-        }
-      ),
+      detail.screenshot_url && (() => {
+        const safeHref = safeExternalHref(detail.screenshot_url);
+        return safeHref ? /* @__PURE__ */ jsx2(
+          "a",
+          {
+            class: "report-detail-screenshot",
+            href: safeHref,
+            target: "_blank",
+            rel: "noopener noreferrer",
+            children: /* @__PURE__ */ jsx2("img", { src: detail.screenshot_url, alt: "", loading: "lazy" })
+          }
+        ) : /* @__PURE__ */ jsx2("div", { class: "report-detail-screenshot", children: /* @__PURE__ */ jsx2("img", { src: detail.screenshot_url, alt: "", loading: "lazy" }) });
+      })(),
       /* @__PURE__ */ jsx2("h3", { class: "report-detail-section", children: strings["detail.thread"] }),
       detail.comments.length === 0 ? /* @__PURE__ */ jsx2("p", { class: "report-detail-empty", children: strings["detail.no_replies"] }) : /* @__PURE__ */ jsx2("ul", { class: "report-comments", children: detail.comments.map((c) => /* @__PURE__ */ jsx2("li", { children: /* @__PURE__ */ jsx2(CommentBubble, { comment: c, strings }) })) }),
       detail.status_history && detail.status_history.length > 0 && /* @__PURE__ */ jsx2(StatusHistorySection, { rows: detail.status_history, strings }),
@@ -1048,19 +1083,22 @@ function ContextBlock({ detail, strings }) {
       /* @__PURE__ */ jsx2("span", { class: "report-detail-context-label", children: strings["detail.context.submitted_at"] }),
       /* @__PURE__ */ jsx2("span", { children: formatSubmittedAt(detail.created_at) })
     ] }),
-    detail.page_url && /* @__PURE__ */ jsxs2("div", { class: "report-detail-context-line", title: detail.page_url, children: [
-      /* @__PURE__ */ jsx2("span", { class: "report-detail-context-label", children: strings["detail.context.page"] }),
-      /* @__PURE__ */ jsx2(
-        "a",
-        {
-          class: "report-detail-context-url",
-          href: detail.page_url,
-          target: "_blank",
-          rel: "noopener noreferrer",
-          children: truncateUrl(detail.page_url, 64)
-        }
-      )
-    ] })
+    detail.page_url && (() => {
+      const safeHref = safeExternalHref(detail.page_url);
+      return /* @__PURE__ */ jsxs2("div", { class: "report-detail-context-line", title: detail.page_url, children: [
+        /* @__PURE__ */ jsx2("span", { class: "report-detail-context-label", children: strings["detail.context.page"] }),
+        safeHref ? /* @__PURE__ */ jsx2(
+          "a",
+          {
+            class: "report-detail-context-url",
+            href: safeHref,
+            target: "_blank",
+            rel: "noopener noreferrer",
+            children: truncateUrl(detail.page_url, 64)
+          }
+        ) : /* @__PURE__ */ jsx2("span", { class: "report-detail-context-url", children: truncateUrl(detail.page_url, 64) })
+      ] });
+    })()
   ] });
 }
 function formatSubmittedAt(iso) {
@@ -3934,9 +3972,16 @@ var WIDGET_STYLES = `
  * Width/height/max-* are animated together; padding too, since the
  * board's denser layout needs less of the modal's default padding. */
 .modal.is-expanded {
-  width: min(1280px, calc(100vw - var(--mfb-space-5)));
-  max-height: calc(100vh - var(--mfb-space-5));
-  height: calc(100vh - var(--mfb-space-5));
+  /* Margin around the expanded board view. --mfb-space-7 (48px) matches
+   * the breathing room of the default modal \u2014 24px top + 24px bottom +
+   * 24px on each side \u2014 so the panel reads as "near-fullscreen with a
+   * visible frame" instead of "the whole viewport, content cut off".
+   * Was --mfb-space-5 (24px total = 12px each side), which felt
+   * claustrophobic and tricked users into expecting more vertical
+   * scroll under the viewport edge. */
+  width: min(1280px, calc(100vw - var(--mfb-space-7)));
+  max-height: calc(100vh - var(--mfb-space-7));
+  height: calc(100vh - var(--mfb-space-7));
   padding: var(--mfb-space-5);
   transition:
     width 320ms cubic-bezier(0.22, 1, 0.36, 1),
@@ -3950,6 +3995,10 @@ var WIDGET_STYLES = `
 .backdrop.is-expanded { /* hook for any backdrop-level overrides */ }
 
 @media (max-width: 640px) {
+  /* On mobile the sheet still snaps to the bottom edge and stretches
+   * almost the full viewport \u2014 24px gap from the top is enough to
+   * convey "this is a panel, not a takeover", but we don't pull margin
+   * off the sides where users expect the sheet to fill the viewport. */
   .modal.is-expanded {
     width: 100vw;
     height: calc(100vh - var(--mfb-space-5));
@@ -4583,7 +4632,10 @@ function createFeedback(config) {
   async function buildAndSubmit(values) {
     const manualScreenshot = values.synthetic ? void 0 : values.screenshot;
     const technical_context = capture.snapshot();
-    if (user) technical_context.user = user;
+    if (user) {
+      const { userHash: _hash, exp: _exp, ...safeUser } = user;
+      technical_context.user = safeUser;
+    }
     if (metadata && Object.keys(metadata).length > 0) {
       technical_context.metadata = { ...metadata };
     }
@@ -4598,8 +4650,8 @@ function createFeedback(config) {
       capture_method: captureMethod,
       technical_context
     };
-    if ("0.14.0") {
-      payload.widget_version = "0.14.0";
+    if ("0.15.1") {
+      payload.widget_version = "0.15.1";
     }
     if (manualScreenshot) payload.screenshot = manualScreenshot;
     if (values.synthetic) payload.synthetic = true;
@@ -4685,4 +4737,4 @@ function createFeedback(config) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-A4MBOFRR.mjs.map
+//# sourceMappingURL=chunk-3YLD2AJI.mjs.map