@mohasinac/appkit 3.5.2 → 3.5.4

package/dist/utils/id-generators.js

@@ -74,7 +74,8 @@ export function generateOrderId(input) {
 export function generateFAQId(input) {
     if (input.customId?.trim())
         return input.customId.trim();
-    return `faq-${slugify(input.category)}-${slugify(input.question).substring(0, 50)}`;
+    const questionSlug = slugify(input.question).substring(0, 50).replace(/-+$/, "");
+    return `faq-${slugify(input.category)}-${questionSlug}`;
 }
 // ─── Coupon ───────────────────────────────────────────────────────────────────
 export function generateCouponId(code, customId) {
@@ -427,53 +428,74 @@ export function generateMediaFilename(ctx) {
     }
 }
 /**
- * W1-51 — validate that a filename matches the canonical pattern produced
- * by {@link generateMediaFilename}. Called from /api/media/sign before a
+ * W1-51 (regex fixed 2026-08-15 — see bug notes below) — validate that a
+ * filename matches the canonical pattern produced by
+ * {@link generateMediaFilename}. Called from /api/media/sign before a
  * signed-URL is issued so malformed names can never enter storage.
  *
- * Pattern: `<prefix>-<slug parts>-<YYYYMMDD>(-<N>)?(-<rand>)?\.<ext>` where
- * the prefix is one of the known media type tokens.
+ * The generator functions above put the type word (image/video/logo/
+ * banner/avatar) at the END of the slug portion, e.g.
+ * `product-{name}-{category}-{store}-image-{n}.ext`, NOT as a literal
+ * compound prefix like `product-image-{...}`. The previous version of this
+ * validator anchored on the compound-prefix shape and rejected real output
+ * from every generator except invoice/payout-doc/shipping-proof/
+ * refund-proof/catalogue-image — causing /api/media/sign to 500 for
+ * product/review/auction/preorder/store/brand/blog/event/category/user/
+ * carousel/rich-text uploads. Each pattern below mirrors one generator
+ * function's actual output shape. blog-cover/blog-content-image/
+ * blog-additional-image all dispatch to the same generator as blog-image
+ * (and the four event-* variants likewise share one shape), so one pattern
+ * validates all sub-types of that family.
  *
  * Returns true when the filename is acceptable.
  */
-const MEDIA_FILENAME_PREFIXES = [
-    "product-image", "product-video",
-    "review-image", "review-video",
-    "auction-image", "preorder-image",
-    "store-logo", "store-banner",
-    "brand-logo", "brand-banner",
-    "blog-image", "blog-cover", "blog-content-image", "blog-additional-image",
-    "event-image", "event-cover", "event-winner-image", "event-additional-image",
-    "rich-text-image",
-    "category-image",
-    "user-avatar",
-    "carousel-image",
-    "catalogue-image",
-    "invoice", "payout-doc",
-    "shipping-proof", "refund-proof",
+const SLUG_PART = "[a-z0-9]+(?:-[a-z0-9]+)*";
+const EXT_PART = "[a-z0-9]+";
+const DATE_PART = "\\d{8}";
+const MEDIA_FILENAME_PATTERNS = [
+    { context: "product-image", pattern: new RegExp(`^product-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "product-video", pattern: new RegExp(`^product-${SLUG_PART}-video-\\d+\\.${EXT_PART}$`) },
+    { context: "review-image", pattern: new RegExp(`^review-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "review-video", pattern: new RegExp(`^review-${SLUG_PART}-video-1\\.${EXT_PART}$`) },
+    { context: "auction-image", pattern: new RegExp(`^auction-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "preorder-image", pattern: new RegExp(`^preorder-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "store-logo", pattern: new RegExp(`^store-${SLUG_PART}-logo\\.${EXT_PART}$`) },
+    { context: "store-banner", pattern: new RegExp(`^store-${SLUG_PART}-banner\\.${EXT_PART}$`) },
+    { context: "brand-logo", pattern: new RegExp(`^brand-${SLUG_PART}-logo\\.${EXT_PART}$`) },
+    { context: "brand-banner", pattern: new RegExp(`^brand-${SLUG_PART}-banner\\.${EXT_PART}$`) },
+    { context: "blog-image", pattern: new RegExp(`^blog-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "event-image", pattern: new RegExp(`^event-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "rich-text-image", pattern: new RegExp(`^rich-text-${SLUG_PART}-image-\\d+\\.${EXT_PART}$`) },
+    { context: "category-image", pattern: new RegExp(`^category-${SLUG_PART}-image\\.${EXT_PART}$`) },
+    { context: "user-avatar", pattern: new RegExp(`^user-${SLUG_PART}-avatar\\.${EXT_PART}$`) },
+    { context: "carousel-image", pattern: new RegExp(`^carousel-${SLUG_PART}-image\\.${EXT_PART}$`) },
+    { context: "catalogue-image", pattern: new RegExp(`^catalogue-image-${SLUG_PART}-\\d+\\.${EXT_PART}$`) },
+    { context: "invoice", pattern: new RegExp(`^invoice-${SLUG_PART}-${DATE_PART}\\.pdf$`) },
+    { context: "payout-doc", pattern: new RegExp(`^payout-doc-${SLUG_PART}-${DATE_PART}\\.pdf$`) },
+    { context: "shipping-proof", pattern: new RegExp(`^shipping-proof-${SLUG_PART}-${DATE_PART}\\.${EXT_PART}$`) },
+    { context: "refund-proof", pattern: new RegExp(`^refund-proof-${SLUG_PART}-${SLUG_PART}-${DATE_PART}\\.${EXT_PART}$`) },
+    { context: "payment-proof", pattern: new RegExp(`^payment-proof-${SLUG_PART}-${SLUG_PART}-${DATE_PART}\\.${EXT_PART}$`) },
 ];
-const MEDIA_FILENAME_REGEX = new RegExp(`^(?:${MEDIA_FILENAME_PREFIXES.join("|")})-[a-z0-9]([a-z0-9-]*[a-z0-9])?(?:-\\d+)?\\.[a-z0-9]+$`);
 export function validateMediaFilename(filename) {
     if (!filename || filename.length > 256)
         return false;
     if (filename.includes("..") || filename.includes("/") || filename.includes("\\"))
         return false;
-    return MEDIA_FILENAME_REGEX.test(filename);
+    return MEDIA_FILENAME_PATTERNS.some(({ pattern }) => pattern.test(filename));
 }
 /**
- * Derives the `MediaFilenameContext["type"]` a filename was generated under
- * (e.g. "catalogue-image") by matching against the same prefix list
- * {@link validateMediaFilename} uses — the longest matching prefix wins so
- * "blog-content-image" isn't mis-derived as "blog-cover"'s sibling "blog-".
+ * Derives the `MediaFilenameContext["type"]` family a filename was
+ * generated under (e.g. "catalogue-image") by matching against the same
+ * shape patterns {@link validateMediaFilename} uses. Sibling context types
+ * that share one generator (e.g. blog-cover/blog-content-image/
+ * blog-additional-image all produce the same shape as blog-image) resolve
+ * to that shared family name — the dispatcher itself can't distinguish them
+ * from the filename alone, since it never encoded the sub-type into the name.
  * Used at /api/media/finalize time to stamp `MediaAssetDocument.contextType`
  * without changing the finalize request contract.
  */
 export function deriveContextTypeFromFilename(filename) {
-    const stem = filename.replace(/\.[^.]+$/, "");
-    const matches = MEDIA_FILENAME_PREFIXES.filter((prefix) => stem.startsWith(`${prefix}-`) || stem === prefix);
-    if (matches.length === 0)
-        return undefined;
-    return matches.reduce((longest, candidate) => (candidate.length > longest.length ? candidate : longest));
+    return MEDIA_FILENAME_PATTERNS.find(({ pattern }) => pattern.test(filename))?.context;
 }
 /**
  * Generates a scannable barcode identifier for a product listing.

package/dist/utils/number.formatter.js

@@ -40,10 +40,20 @@ export function formatFileSize(bytes) {
 export function formatCompactNumber(num) {
     if (num < 1000)
         return num.toString();
-    if (num < 1000000)
-        return `${(num / 1000).toFixed(1)}K`;
-    if (num < 1000000000)
-        return `${(num / 1000000).toFixed(1)}M`;
+    if (num < 1000000) {
+        const kValue = (num / 1000).toFixed(1);
+        // Rounding can push a value right up to the next unit's boundary
+        // (e.g. 999950 -> "1000.0K") — escalate instead of displaying "1000.0K".
+        if (kValue === "1000.0")
+            return `${(num / 1000000).toFixed(1)}M`;
+        return `${kValue}K`;
+    }
+    if (num < 1000000000) {
+        const mValue = (num / 1000000).toFixed(1);
+        if (mValue === "1000.0")
+            return `${(num / 1000000000).toFixed(1)}B`;
+        return `${mValue}M`;
+    }
     return `${(num / 1000000000).toFixed(1)}B`;
 }
 export function formatDecimal(num, decimals = 2) {
@@ -73,7 +83,10 @@ export function parseFormattedNumber(str) {
     }
     else if (lastDotIndex > -1 && lastCommaIndex === -1) {
         const afterDot = cleaned.substring(lastDotIndex + 1);
-        const isThousands = dotCount > 1 || afterDot.length > 3;
+        // A single separator followed by exactly 3 digits is the standard
+        // thousands-grouping width (e.g. "3.500" -> 3500), not a decimal — only
+        // 1-2 trailing digits are treated as a genuine decimal fraction.
+        const isThousands = dotCount > 1 || afterDot.length >= 3;
         if (isThousands)
             cleaned = cleaned.replace(/\./g, "");
         decimalSeparator = ".";
@@ -81,7 +94,7 @@ export function parseFormattedNumber(str) {
     }
     else if (lastCommaIndex > -1 && lastDotIndex === -1) {
         const afterComma = cleaned.substring(lastCommaIndex + 1);
-        const commaIsThousands = commaCount > 1 || afterComma.length > 3;
+        const commaIsThousands = commaCount > 1 || afterComma.length >= 3;
         if (commaIsThousands) {
             cleaned = cleaned.replace(/,/g, "");
             decimalSeparator = ".";

package/dist/utils/string.formatter.js

@@ -76,7 +76,10 @@ function applyMark(text, mark) {
     }
     if (mark.type === "link") {
         const rawHref = String(mark.attrs?.href ?? "#").trim();
-        const safe = /^(https?:\/\/|mailto:|\/|#)/i.test(rawHref) ? rawHref : "#";
+        // `\/(?!\/)` allows a single leading slash (same-site relative path) but
+        // rejects `//host/...` protocol-relative URLs, which browsers resolve to
+        // an arbitrary external origin despite "looking" like a local path.
+        const safe = /^(https?:\/\/|mailto:|\/(?!\/)|#)/i.test(rawHref) ? rawHref : "#";
         const href = safe.replace(/[&"<>]/g, (c) => ({ "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" })[c] ?? c);
         return `<a href="${href}" rel="noopener noreferrer">${text}</a>`;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.5.2",
+  "version": "3.5.4",
   "license": "MIT",
   "publishConfig": {
     "access": "public"