@nanobpm/urban 0.19.0 → 0.20.0

package/dist/runtime/core/modules/pages.js

@@ -392,6 +392,27 @@ function renderText(node) {
   return el(v === "heading" ? "h1" : "p", { class: cls }, node.props.text || "");
 }
 
+// A grid td cell. When the column declares linkField, the cell text (the
+// column's own value) becomes a link to the URL held in that other field,
+// opened in a new tab. Only http(s) hrefs are linked — anything else (e.g. a
+// javascript: URL smuggled through row data) falls back to plain text — and
+// external links get rel=noopener noreferrer so the opened page can't reach
+// window.opener. Shared by the top-level grid and child grids.
+function gridCell(col, row) {
+  const text = row[col.field] == null ? "" : String(row[col.field]);
+  if (col.linkField) {
+    const href = row[col.linkField] == null ? "" : String(row[col.linkField]);
+    if (text !== "" && /^https?:\/\//i.test(href)) {
+      return el(
+        "td",
+        {},
+        el("a", { class: "pc-link", href, target: "_blank", rel: "noopener noreferrer" }, text),
+      );
+    }
+  }
+  return el("td", {}, text);
+}
+
 function renderActionForm(node) {
   const p = node.props;
   const card = el("section", { class: "pc-card" });
@@ -552,7 +573,7 @@ function renderDataGrid(node) {
         cbody.append(el("tr", {}, el("td", { colspan: cspan }, "None")));
       }
       for (const cr of rows) {
-        const cells = ccols.map((c) => el("td", {}, cr[c.field] == null ? "" : String(cr[c.field])));
+        const cells = ccols.map((c) => gridCell(c, cr));
         if (cg.lazyField) {
           const lf = cg.lazyField;
           const has = cr[lf.field] != null && String(cr[lf.field]).trim() !== "";
@@ -606,7 +627,7 @@ function renderDataGrid(node) {
   }
 
   function renderRow(row) {
-    const cells = cols.map((c) => el("td", {}, row[c.field] == null ? "" : String(row[c.field])));
+    const cells = cols.map((c) => gridCell(c, row));
     let toggle = null;
     if (hasExtra) {
       const actionCell = el("td", { class: "pc-row-actions" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/urban",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
   "license": "Apache-2.0",
   "type": "module",

package/src/runtime/core/modules/pages.test.ts

@@ -89,6 +89,19 @@ test("GET /app/runtime.js serves the renderer module", async () => {
   assert.match(res.body ?? "", /pc:refresh/);
 });
 
+test("renderer wires a column's linkField to a new-tab anchor", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // A column declaring `linkField` renders its text as a link to that field's
+  // URL, opened safely in a new tab. Guard the whole shape so the feature can't
+  // silently regress: the field is read, http(s) is required, and the anchor
+  // opens in a new tab with a hardened rel.
+  assert.match(js, /col\.linkField/);
+  assert.match(js, /\^https\?:/);
+  assert.match(js, /target: "_blank"/);
+  assert.match(js, /rel: "noopener noreferrer"/);
+});
+
 test("GET /app/pages/<id> returns the page json, 404 for unknown", async () => {
   const ok = await dispatch("GET", "/app/pages/home");
   assert.equal(ok.status, 200);

package/src/runtime/core/modules/pages.ts

@@ -427,6 +427,27 @@ function renderText(node) {
   return el(v === "heading" ? "h1" : "p", { class: cls }, node.props.text || "");
 }
 
+// A grid td cell. When the column declares linkField, the cell text (the
+// column's own value) becomes a link to the URL held in that other field,
+// opened in a new tab. Only http(s) hrefs are linked — anything else (e.g. a
+// javascript: URL smuggled through row data) falls back to plain text — and
+// external links get rel=noopener noreferrer so the opened page can't reach
+// window.opener. Shared by the top-level grid and child grids.
+function gridCell(col, row) {
+  const text = row[col.field] == null ? "" : String(row[col.field]);
+  if (col.linkField) {
+    const href = row[col.linkField] == null ? "" : String(row[col.linkField]);
+    if (text !== "" && /^https?:\/\//i.test(href)) {
+      return el(
+        "td",
+        {},
+        el("a", { class: "pc-link", href, target: "_blank", rel: "noopener noreferrer" }, text),
+      );
+    }
+  }
+  return el("td", {}, text);
+}
+
 function renderActionForm(node) {
   const p = node.props;
   const card = el("section", { class: "pc-card" });
@@ -587,7 +608,7 @@ function renderDataGrid(node) {
         cbody.append(el("tr", {}, el("td", { colspan: cspan }, "None")));
       }
       for (const cr of rows) {
-        const cells = ccols.map((c) => el("td", {}, cr[c.field] == null ? "" : String(cr[c.field])));
+        const cells = ccols.map((c) => gridCell(c, cr));
         if (cg.lazyField) {
           const lf = cg.lazyField;
           const has = cr[lf.field] != null && String(cr[lf.field]).trim() !== "";
@@ -641,7 +662,7 @@ function renderDataGrid(node) {
   }
 
   function renderRow(row) {
-    const cells = cols.map((c) => el("td", {}, row[c.field] == null ? "" : String(row[c.field])));
+    const cells = cols.map((c) => gridCell(c, row));
     let toggle = null;
     if (hasExtra) {
       const actionCell = el("td", { class: "pc-row-actions" });