@nanobpm/urban 0.76.0 → 0.77.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.76.0",
+	"version": "0.77.0",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/browser/runtime.browser.js

@@ -2385,32 +2385,58 @@ function renderDataGrid(node) {
 }
 
 // A navigation node — a horizontal menu bar (variant "bar", default) or a
-// vertical side rail (variant "rail"). Each item links either to another page
-// ({ label, page } -> an in-app #/<page> hash link, highlighted when it's the
-// current page) or to an external URL ({ label, href } -> a hardened new-tab
-// link; only http(s) is honoured). With items:"auto" (or omitted) the nav
-// lists every page from the /app/pages index, using each page's title. An item
-// may also carry a `badge` ({ source, table, filter, tone, refreshMs,
-// hideWhenZero }) that renders a live count pill from the /app/data gateway.
+// vertical side rail (variant "rail"). Each item links to one of three targets,
+// in precedence order:
+//   1. { label, page }  → an in-app #/<page> hash link within THIS (pages)
+//      surface, highlighted when it's the current page.
+//   2. { label, path }  → a same-origin, same-tab link to another mounted
+//      surface by relative path (e.g. "/tasks" → the taskInbox surface). The
+//      path is resolved against the app's mount root via baseRelativeUrl, so a
+//      root-absolute "/tasks" survives the Nano console's path-prefixed App-View
+//      proxy (/console/app-view/<name>/tasks) instead of escaping to the console
+//      origin. Only same-origin values are honoured here — a scheme
+//      (http(s)/javascript:/…) or protocol-relative "//host" is rejected (""),
+//      falling through to the {href} case, so `path` can never smuggle an
+//      external or executable-scheme target into a same-tab link. This is the
+//      only link form that composes multi-surface apps into a coherent,
+//      proxy-safe navigable whole (nanobpm/nano-ide#436).
+//   3. { label, href }  → a hardened external new-tab link; only http(s) is
+//      honoured.
+// With items:"auto" (or omitted) the nav lists every page from the /app/pages
+// index, using each page's title. An item may also carry a `badge` ({ source,
+// table, filter, tone, refreshMs, hideWhenZero }) that renders a live count pill
+// from the /app/data gateway.
 /** @param {any} item
  * @returns {HTMLAnchorElement|null}
  */
 function navLink(item) {
   const isPage = safePageId(item.page);
-  const isExt = !isPage && typeof item.href === "string" && /^https?:\/\//i.test(item.href);
-  if (!isPage && !isExt) return null;
+  // A same-origin relative path to another mounted surface (e.g. "/tasks"),
+  // rebased onto the app mount root so it survives the console proxy prefix.
+  const rel = isPage ? "" : sameOriginPath(item.path);
+  const isRel = !isPage && rel !== "";
+  const isExt = !isPage && !isRel && typeof item.href === "string" && /^https?:\/\//i.test(item.href);
+  if (!isPage && !isRel && !isExt) return null;
   /** @type {Record<string, any>} */
   const attrs = { class: "pc-nav-link" };
   if (isPage) {
     attrs.href = "#/" + encodeURIComponent(item.page);
     if (item.page === CURRENT) { attrs.class += " active"; attrs["aria-current"] = "page"; }
+  } else if (isRel) {
+    // Same-origin, same-tab: no target=_blank — this is in-app cross-surface
+    // navigation, not an external hand-off.
+    attrs.href = rel;
   } else {
     attrs.href = item.href; attrs.target = "_blank"; attrs.rel = "noopener noreferrer";
   }
   /** @type {Array<Node|string>} */
   const kids = [];
   if (item.icon != null) kids.push(el("span", { class: "pc-nav-icon" }, String(item.icon)));
-  const labelText = String(item.label != null ? item.label : (item.page || item.href));
+  // Default the label from the target actually used, not a fixed page>path>href
+  // fallback: when `path` is rejected and we fell through to `href`, the label
+  // must reflect the href we navigate to, never the discarded `path`.
+  const defaultLabel = isPage ? item.page : (isRel ? item.path : item.href);
+  const labelText = String(item.label != null ? item.label : defaultLabel);
   kids.push(el("span", { class: "pc-nav-label" }, labelText));
   const link = el("a", attrs, ...kids);
   // A nav item may carry a live count badge sourced from a datasource (e.g. the
@@ -2560,6 +2586,31 @@ function baseRelativeUrl(url) {
   return cleaned; // already relative
 }
 
+// Resolve a same-origin, in-app relative path (e.g. a nav item's { path: "/tasks" }
+// targeting another mounted surface) onto the app's mount root, so it survives the
+// console App-View proxy prefix — the SAME rebasing rule as baseRelativeUrl (the
+// single source of truth for "strip one leading slash to rebase onto the mount
+// root"). Unlike baseRelativeUrl (whose output is an <iframe> src that may legally
+// be an http(s) URL), a cross-surface nav link must stay SAME-ORIGIN and same-tab:
+// a scheme (http(s):, and — defence in depth — javascript:/data:/… ) or a
+// protocol-relative "//host" is NOT an in-app path, so it is rejected ("") and the
+// caller falls through to the hardened new-tab {href} handling. Whitespace is
+// stripped/trimmed FIRST (browsers strip ASCII tab/newline before parsing a URL, so
+// `/ta\tsks` must be judged on its cleaned form) so the scheme gate can't be
+// bypassed by embedded whitespace.
+/** @param {any} path */
+function sameOriginPath(path) {
+  if (typeof path !== "string") return "";
+  // Browsers normalize backslashes to `/` in URLs, so `\\evil.example/tasks` (or
+  // `/\evil.example`) is parsed as protocol-relative `//evil.example/…`. Fold `\` → `/`
+  // before the scheme/`//` gates so a backslash can't smuggle a cross-origin target past them.
+  const cleaned = path.replace(/[\t\n\r]/g, "").replace(/\\/g, "/").trim();
+  if (cleaned === "") return "";
+  if (/^[a-z][a-z0-9+.-]*:/i.test(cleaned)) return ""; // any scheme → not a same-origin in-app path
+  if (cleaned.startsWith("//")) return ""; // protocol-relative → different origin
+  return baseRelativeUrl(cleaned); // rebase root-absolute onto the mount root (shared rule)
+}
+
 // `appView` (ADR 0057 / #416): mount an embedded App View — an <iframe> hosting a
 // self-contained view document (e.g. the agent cockpit's embed.html) served
 // alongside the page. This is the runtime counterpart of the console's App-View
@@ -2798,4 +2849,4 @@ function boot() {
 // renderer functions / RENDERERS registry can be imported directly.
 if (typeof document !== "undefined" && document.getElementById("page")) boot();
 
-export { RENDERERS, renderText, renderButton, renderProse, renderNav, renderAppView, navLink, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell, buildDetailForm, evalDetailCondition, normalizeDetailOptions, chevronToggle, setChevronOpen };
+export { RENDERERS, renderText, renderButton, renderProse, renderNav, renderAppView, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell, buildDetailForm, evalDetailCondition, normalizeDetailOptions, chevronToggle, setChevronOpen };

package/src/runtime/browser/runtime.browser.test.ts

@@ -7,7 +7,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { PAGE_NODE_TYPES } from "../core/page-nodes.ts";
-import { RENDERERS, renderText, renderAppView, navLink, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell } from "./runtime.browser.js";
+import { RENDERERS, renderText, renderAppView, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell } from "./runtime.browser.js";
 
 // ── Minimal fake DOM ────────────────────────────────────────────────────────
 // Just enough of the Element/Document surface that el()/renderText touch:
@@ -348,6 +348,110 @@ test("#338: navLink badge degrades to no pill (never a broken nav) when the fetc
   assert.equal(pill.textContent, "");
 });
 
+// ── #436: same-origin cross-surface nav (a { path } item) ───────────────────
+// A pages-surface nav item can now point at another mounted surface by a relative
+// same-origin path (e.g. "/tasks" → the taskInbox surface): an in-page, same-tab
+// link, rebased onto the app mount root so it survives the console App-View proxy
+// prefix. This is distinct from { page } (an in-app #/<page> hash) and { href }
+// (an external new-tab http(s) link).
+
+test("#436: navLink({ path }) renders a same-origin, same-tab link rebased onto the mount root", (t) => {
+  t.after(installFakeDom());
+  const link = navLink({ label: "Tasks", path: "/tasks" });
+  assert.ok(link, "expected a nav link for a { path } item");
+  assert.equal(link.tagName, "A");
+  // Root-absolute "/tasks" is rebased to a document-relative "tasks" so it inherits
+  // the mount root (and thus the console proxy prefix) rather than escaping to origin.
+  assert.equal(link.getAttribute("href"), "tasks");
+  // Same-tab, same-origin: NOT an external hand-off — no new-tab / noopener chrome.
+  assert.equal(link.getAttribute("target"), null, "cross-surface nav stays in the same tab");
+  assert.equal(link.getAttribute("rel"), null, "no rel=noopener on a same-origin link");
+  const label = findByClass(link, "pc-nav-label");
+  assert.ok(label && label.textContent === "Tasks");
+});
+
+test("#436: navLink({ path }) falls back to the path as its label when none is given", (t) => {
+  t.after(installFakeDom());
+  const link = navLink({ path: "/tasks" });
+  assert.ok(link);
+  const label = findByClass(link, "pc-nav-label");
+  assert.ok(label && label.textContent === "/tasks", "label defaults to the raw path");
+});
+
+test("#436: a { page } item still wins over a { path } (in-app hash route has precedence)", (t) => {
+  t.after(installFakeDom());
+  const link = navLink({ label: "Home", page: "home", path: "/tasks" });
+  assert.ok(link);
+  assert.equal(link.getAttribute("href"), "#/home", "page hash route takes precedence over path");
+  assert.equal(link.getAttribute("target"), null);
+});
+
+test("#436: a same-origin { path } wins over an external { href } (in-app link preferred)", (t) => {
+  t.after(installFakeDom());
+  const link = navLink({ label: "Tasks", path: "/tasks", href: "https://example.test/tasks" });
+  assert.ok(link);
+  assert.equal(link.getAttribute("href"), "tasks", "the same-origin path is used, not the external href");
+  assert.equal(link.getAttribute("target"), null, "so it stays same-tab, not a new-tab external link");
+});
+
+test("#436: a scheme/protocol-relative { path } is rejected and falls through to the { href } handling", (t) => {
+  t.after(installFakeDom());
+  // A hostile/mistaken path carrying a scheme must NOT become a same-tab link — it
+  // is rejected as not-same-origin and the item falls through to the hardened
+  // new-tab external-href branch.
+  const link = navLink({ label: "Evil", path: "javascript:alert(1)", href: "https://example.test/ok" });
+  assert.ok(link);
+  assert.equal(link.getAttribute("href"), "https://example.test/ok");
+  assert.equal(link.getAttribute("target"), "_blank");
+  assert.equal(link.getAttribute("rel"), "noopener noreferrer");
+});
+
+test("#436: with no label and a rejected { path }, the default label matches the { href } actually used", (t) => {
+  t.after(installFakeDom());
+  // No explicit label: the path is rejected (unsafe scheme) and we fall through to
+  // the external href. The default label MUST reflect the href we navigate to, never
+  // the discarded path — otherwise the visible text lies about the link target.
+  const link = navLink({ path: "javascript:alert(1)", href: "https://example.test/ok" });
+  assert.ok(link);
+  assert.equal(link.getAttribute("href"), "https://example.test/ok");
+  const label = findByClass(link, "pc-nav-label");
+  assert.ok(label && label.textContent === "https://example.test/ok", "label defaults to the href actually used, not the rejected path");
+});
+
+test("#436: a { path } item with only an unsafe scheme and no href renders nothing", (t) => {
+  t.after(installFakeDom());
+  assert.equal(navLink({ label: "Evil", path: "javascript:alert(1)" }), null);
+  assert.equal(navLink({ label: "Ext", path: "//evil.example/tasks" }), null);
+});
+
+test("#436: sameOriginPath rebases in-app paths and rejects non-same-origin targets", () => {
+  // Root-absolute → rebased onto the mount root (survives the console proxy prefix).
+  assert.equal(sameOriginPath("/tasks"), "tasks");
+  assert.equal(sameOriginPath("/tasks/inbox"), "tasks/inbox");
+  // Already document-relative → left as-is.
+  assert.equal(sameOriginPath("tasks"), "tasks");
+  assert.equal(sameOriginPath("./tasks"), "./tasks");
+  // Embedded ASCII tab/newline is stripped before the scheme gate (browsers strip
+  // it before parsing), so `java\tscript:` can't sneak past as a "relative" path.
+  assert.equal(sameOriginPath("java\tscript:alert(1)"), "");
+  // Any scheme / protocol-relative host is not a same-origin in-app path.
+  assert.equal(sameOriginPath("https://example.test/tasks"), "");
+  assert.equal(sameOriginPath("http://example.test/tasks"), "");
+  assert.equal(sameOriginPath("javascript:alert(1)"), "");
+  assert.equal(sameOriginPath("data:text/html,x"), "");
+  assert.equal(sameOriginPath("//evil.example/tasks"), "");
+  // Backslashes are folded to `/` before the gates (browsers normalize them), so a
+  // `\\host` or `/\host` value can't smuggle a protocol-relative cross-origin target past.
+  assert.equal(sameOriginPath("\\\\evil.example/tasks"), "");
+  assert.equal(sameOriginPath("/\\evil.example/tasks"), "");
+  assert.equal(sameOriginPath("\\/evil.example/tasks"), "");
+  // Non-strings / blanks → "".
+  assert.equal(sameOriginPath(""), "");
+  assert.equal(sameOriginPath("   "), "");
+  assert.equal(sameOriginPath(null), "");
+  assert.equal(sameOriginPath(42), "");
+});
+
 test("#338: applyNavBadge honours hideWhenZero and mirrors the count into the accessible name", (t) => {
   const restore = installFakeDom();
   t.after(restore);