@mhosaic/feedback 0.16.2 → 0.18.0

package/dist/chunk-4QOIFIT5.mjs

@@ -0,0 +1,50 @@
+// src/capture/urlSanitizer.ts
+var SENSITIVE_NAME = /token|key|password|secret|auth|session|sig|credential|bearer|cookie/i;
+var SENSITIVE_VALUE_PATTERNS = [
+  // JWT: three base64url segments separated by dots, header begins with eyJ.
+  /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+  // Mhosaic feedback keys (the project's own format).
+  /^(?:sk|pk)_proj_[A-Za-z0-9_-]{16,}$/,
+  // GitHub PATs (ghp/gho/ghu/ghs/ghr prefixes, 36+ chars).
+  /^gh[pousr]_[A-Za-z0-9]{30,}$/,
+  // Stripe live/test secret keys.
+  /^(?:sk|pk|rk|whsec)_(?:live|test)_[A-Za-z0-9]{16,}$/,
+  // AWS access key id.
+  /^AKIA[0-9A-Z]{12,}$/,
+  // Slack bot tokens.
+  /^xox[abprso]-[A-Za-z0-9-]{12,}$/,
+  // Generic high-entropy: hex 40+ chars (SHA-1, SHA-256) or long alnum 32+.
+  /^[a-f0-9]{40,}$/i,
+  // Long opaque base64-ish string (common for OAuth codes & session ids).
+  /^[A-Za-z0-9_-]{40,}$/
+];
+function looksLikeCredential(value) {
+  return SENSITIVE_VALUE_PATTERNS.some((re) => re.test(value));
+}
+function sanitizeUrl(url) {
+  try {
+    const isAbsolute = /^https?:\/\//i.test(url);
+    const isRootRelative = url.startsWith("/");
+    if (!isAbsolute && !isRootRelative) return url;
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    const u = new URL(url, base);
+    const clean = new URLSearchParams();
+    u.searchParams.forEach((value, name) => {
+      if (SENSITIVE_NAME.test(name) || looksLikeCredential(value)) {
+        clean.set(name, "[redacted]");
+      } else {
+        clean.set(name, value);
+      }
+    });
+    u.search = clean.toString();
+    u.hash = u.hash ? "#[redacted]" : "";
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+
+export {
+  sanitizeUrl
+};
+//# sourceMappingURL=chunk-4QOIFIT5.mjs.map

package/dist/chunk-4QOIFIT5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capture/urlSanitizer.ts"],"sourcesContent":["/**\n * URL sanitizer for captured network request URLs.\n *\n * Two layers of defense:\n *\n * 1) Param NAME match — anything whose name suggests a credential is\n *    redacted unconditionally (token, key, password, secret, auth, etc.).\n *\n * 2) Param VALUE shape match — even when the name is innocent (\"id\",\n *    \"redirect_uri\", \"context\"), if the VALUE looks like a JWT, a\n *    Bearer token, an mhosaic-feedback API key, or a long opaque hex/b64\n *    string we redact it. This catches the realistic case where a backend\n *    routes credentials through generic-named params or where a careless\n *    developer puts a token in a URL fragment for \"convenience.\"\n *\n * The path portion is preserved as-is — its purpose is operator-side\n * \"which page was this report filed from\", and stripping it would\n * destroy that signal. Hosts that route secrets through path segments\n * (uncommon) should mark those routes for the widget to skip via the\n * sanitizeUrl hook in createFeedback().\n */\n\nconst SENSITIVE_NAME = /token|key|password|secret|auth|session|sig|credential|bearer|cookie/i\n\nconst SENSITIVE_VALUE_PATTERNS: RegExp[] = [\n  // JWT: three base64url segments separated by dots, header begins with eyJ.\n  /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/,\n  // Mhosaic feedback keys (the project's own format).\n  /^(?:sk|pk)_proj_[A-Za-z0-9_-]{16,}$/,\n  // GitHub PATs (ghp/gho/ghu/ghs/ghr prefixes, 36+ chars).\n  /^gh[pousr]_[A-Za-z0-9]{30,}$/,\n  // Stripe live/test secret keys.\n  /^(?:sk|pk|rk|whsec)_(?:live|test)_[A-Za-z0-9]{16,}$/,\n  // AWS access key id.\n  /^AKIA[0-9A-Z]{12,}$/,\n  // Slack bot tokens.\n  /^xox[abprso]-[A-Za-z0-9-]{12,}$/,\n  // Generic high-entropy: hex 40+ chars (SHA-1, SHA-256) or long alnum 32+.\n  /^[a-f0-9]{40,}$/i,\n  // Long opaque base64-ish string (common for OAuth codes & session ids).\n  /^[A-Za-z0-9_-]{40,}$/,\n]\n\nfunction looksLikeCredential(value: string): boolean {\n  return SENSITIVE_VALUE_PATTERNS.some((re) => re.test(value))\n}\n\nexport function sanitizeUrl(url: string): string {\n  try {\n    // Accept absolute URLs or root-relative paths; reject everything else\n    const isAbsolute = /^https?:\\/\\//i.test(url)\n    const isRootRelative = url.startsWith('/')\n    if (!isAbsolute && !isRootRelative) return url\n\n    const base = typeof window !== 'undefined' ? window.location.origin : 'http://localhost'\n    const u = new URL(url, base)\n    const clean = new URLSearchParams()\n    u.searchParams.forEach((value, name) => {\n      if (SENSITIVE_NAME.test(name) || looksLikeCredential(value)) {\n        clean.set(name, '[redacted]')\n      } else {\n        clean.set(name, value)\n      }\n    })\n    u.search = clean.toString()\n    // Hash fragments occasionally carry credentials (OAuth implicit flow):\n    // never log them.\n    u.hash = u.hash ? '#[redacted]' : ''\n    return u.toString()\n  } catch {\n    return url\n  }\n}\n"],"mappings":";AAsBA,IAAM,iBAAiB;AAEvB,IAAM,2BAAqC;AAAA;AAAA,EAEzC;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AAEA,SAAS,oBAAoB,OAAwB;AACnD,SAAO,yBAAyB,KAAK,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC;AAC7D;AAEO,SAAS,YAAY,KAAqB;AAC/C,MAAI;AAEF,UAAM,aAAa,gBAAgB,KAAK,GAAG;AAC3C,UAAM,iBAAiB,IAAI,WAAW,GAAG;AACzC,QAAI,CAAC,cAAc,CAAC,eAAgB,QAAO;AAE3C,UAAM,OAAO,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS;AACtE,UAAM,IAAI,IAAI,IAAI,KAAK,IAAI;AAC3B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,MAAE,aAAa,QAAQ,CAAC,OAAO,SAAS;AACtC,UAAI,eAAe,KAAK,IAAI,KAAK,oBAAoB,KAAK,GAAG;AAC3D,cAAM,IAAI,MAAM,YAAY;AAAA,MAC9B,OAAO;AACL,cAAM,IAAI,MAAM,KAAK;AAAA,MACvB;AAAA,IACF,CAAC;AACD,MAAE,SAAS,MAAM,SAAS;AAG1B,MAAE,OAAO,EAAE,OAAO,gBAAgB;AAClC,WAAO,EAAE,SAAS;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-I4GWTJ6Q.mjs → chunk-4QQI5ZYD.mjs}

@@ -1,3 +1,6 @@
+import {
+  sanitizeUrl
+} from "./chunk-4QOIFIT5.mjs";
 import {
   scrubCredentials
 } from "./chunk-FGA63IEZ.mjs";
@@ -206,8 +209,27 @@ function createApiClient(options) {
     }
     return response.json();
   }
+  async function checkVisibility(externalId) {
+    const response = await fetcher(
+      `${endpoint}/api/feedback/v1/widget/visibility/`,
+      {
+        method: "POST",
+        headers: {
+          ...widgetHeaders(externalId),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ external_id: externalId })
+      }
+    );
+    if (!response.ok) {
+      throw new Error(`checkVisibility failed: ${response.status}`);
+    }
+    const data = await response.json();
+    return Boolean(data.show);
+  }
   return {
     submitReport,
+    checkVisibility,
     listMine,
     listChangelog,
     getReport,
@@ -218,52 +240,6 @@ function createApiClient(options) {
   };
 }
 
-// src/capture/urlSanitizer.ts
-var SENSITIVE_NAME = /token|key|password|secret|auth|session|sig|credential|bearer|cookie/i;
-var SENSITIVE_VALUE_PATTERNS = [
-  // JWT: three base64url segments separated by dots, header begins with eyJ.
-  /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
-  // Mhosaic feedback keys (the project's own format).
-  /^(?:sk|pk)_proj_[A-Za-z0-9_-]{16,}$/,
-  // GitHub PATs (ghp/gho/ghu/ghs/ghr prefixes, 36+ chars).
-  /^gh[pousr]_[A-Za-z0-9]{30,}$/,
-  // Stripe live/test secret keys.
-  /^(?:sk|pk|rk|whsec)_(?:live|test)_[A-Za-z0-9]{16,}$/,
-  // AWS access key id.
-  /^AKIA[0-9A-Z]{12,}$/,
-  // Slack bot tokens.
-  /^xox[abprso]-[A-Za-z0-9-]{12,}$/,
-  // Generic high-entropy: hex 40+ chars (SHA-1, SHA-256) or long alnum 32+.
-  /^[a-f0-9]{40,}$/i,
-  // Long opaque base64-ish string (common for OAuth codes & session ids).
-  /^[A-Za-z0-9_-]{40,}$/
-];
-function looksLikeCredential(value) {
-  return SENSITIVE_VALUE_PATTERNS.some((re) => re.test(value));
-}
-function sanitizeUrl(url) {
-  try {
-    const isAbsolute = /^https?:\/\//i.test(url);
-    const isRootRelative = url.startsWith("/");
-    if (!isAbsolute && !isRootRelative) return url;
-    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
-    const u = new URL(url, base);
-    const clean = new URLSearchParams();
-    u.searchParams.forEach((value, name) => {
-      if (SENSITIVE_NAME.test(name) || looksLikeCredential(value)) {
-        clean.set(name, "[redacted]");
-      } else {
-        clean.set(name, value);
-      }
-    });
-    u.search = clean.toString();
-    u.hash = u.hash ? "#[redacted]" : "";
-    return u.toString();
-  } catch {
-    return url;
-  }
-}
-
 // src/capture/device.ts
 function collectDevice() {
   const nav = navigator;
@@ -844,7 +820,7 @@ function resolveStrings(overrides, options = {}) {
 
 // src/widget/mount.tsx
 import { h, render } from "preact";
-import { useCallback } from "preact/hooks";
+import { useCallback, useEffect as useEffect8, useState as useState7 } from "preact/hooks";
 
 // src/widget/BoardView.tsx
 import { useEffect as useEffect2, useMemo, useState as useState2 } from "preact/hooks";
@@ -4505,6 +4481,12 @@ var WIDGET_STYLES = `
 
 // src/widget/mount.tsx
 import { Fragment as Fragment3, jsx as jsx12, jsxs as jsxs12 } from "preact/jsx-runtime";
+function computeFabVisible(opts, externalId, visibilityAllowed) {
+  if (!opts.showFAB) return false;
+  if (opts.getExternalId !== void 0 && !externalId) return false;
+  if (opts.requiresVisibilityCheck && !visibilityAllowed) return false;
+  return true;
+}
 function mountWidget(options) {
   const shadow = options.host.attachShadow({ mode: "open" });
   const style = document.createElement("style");
@@ -4553,7 +4535,29 @@ function mountWidget(options) {
       }
     }, []);
     const externalId = options.getExternalId?.();
-    const fabVisible = options.showFAB && (options.getExternalId === void 0 ? true : Boolean(externalId));
+    const [visibilityAllowed, setVisibilityAllowed] = useState7(
+      !options.requiresVisibilityCheck
+    );
+    useEffect8(() => {
+      if (!options.requiresVisibilityCheck) {
+        setVisibilityAllowed(true);
+        return;
+      }
+      if (!externalId || !options.checkVisibility) {
+        setVisibilityAllowed(false);
+        return;
+      }
+      let cancelled = false;
+      options.checkVisibility(externalId).then((show) => {
+        if (!cancelled) setVisibilityAllowed(show);
+      }).catch(() => {
+        if (!cancelled) setVisibilityAllowed(false);
+      });
+      return () => {
+        cancelled = true;
+      };
+    }, [externalId]);
+    const fabVisible = computeFabVisible(options, externalId, visibilityAllowed);
     const showMineTab = Boolean(options.api && externalId);
     return /* @__PURE__ */ jsxs12(Fragment3, { children: [
       fabVisible && /* @__PURE__ */ jsx12(
@@ -4752,8 +4756,8 @@ function createFeedback(config) {
       capture_method: captureMethod,
       technical_context
     };
-    if ("0.16.2") {
-      payload.widget_version = "0.16.2";
+    if ("0.18.0") {
+      payload.widget_version = "0.18.0";
     }
     if (manualScreenshot) payload.screenshot = manualScreenshot;
     if (values.synthetic) payload.synthetic = true;
@@ -4790,7 +4794,11 @@ function createFeedback(config) {
     // Keep this a callback (not a snapshot) so the mount picks up identity
     // changes that happen after createFeedback() — `notifyIdentityChanged()`
     // is the trigger for a re-render.
-    getExternalId: () => user?.id !== void 0 && user.id !== null && user.id !== "" ? String(user.id) : void 0
+    getExternalId: () => user?.id !== void 0 && user.id !== null && user.id !== "" ? String(user.id) : void 0,
+    // Phase 4: the manifest tells the loader whether this project gates the
+    // widget per end-user; the loader forwards it as `requiresVisibilityCheck`.
+    requiresVisibilityCheck: config.requiresVisibilityCheck ?? false,
+    checkVisibility: (externalId) => api.checkVisibility(externalId)
   });
   const instance = {
     show() {
@@ -4839,4 +4847,4 @@ function createFeedback(config) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-I4GWTJ6Q.mjs.map
+//# sourceMappingURL=chunk-4QQI5ZYD.mjs.map