@nfcard/validation 0.21.0 → 0.22.0

package/dist/index.js

@@ -418,7 +418,7 @@ function elementPrintability(el, ctx) {
       if (el.sizeMm * el.transform.scale < QR_MIN_SIZE_MM - EPS) {
         push("qrTooSmall", "The QR code is below the scannable size floor.");
       }
-      if (!el.url || !el.url.trim()) {
+      if (el.mode !== "redirect" && (!el.url || !el.url.trim())) {
         push("qrEmptyUrl", "The QR code has no target URL.");
       }
       break;
@@ -613,10 +613,11 @@ var baseElementFields = {
   locked: z.boolean().optional(),
   colour: z.string().optional()
 };
+var qrModeSchema = z.enum(["redirect", "raw"]).optional();
 var cardElementSchema = z.discriminatedUnion("type", [
   z.object({ ...baseElementFields, type: z.literal("chip"), shape: chipSidesSchema }),
   z.object({ ...baseElementFields, type: z.literal("text"), text: z.string(), sizeMm: z.number().positive(), weight: z.number(), role: elementRoleSchema, fontKey: z.string().optional(), italic: z.boolean().optional(), underline: z.boolean().optional() }),
-  z.object({ ...baseElementFields, type: z.literal("qr"), url: z.string().url("invalidUrl"), sizeMm: z.number().positive(), frameRole: elementRoleSchema, moduleRole: elementRoleSchema }),
+  z.object({ ...baseElementFields, type: z.literal("qr"), url: z.string().url("invalidUrl").or(z.literal("")).optional(), mode: qrModeSchema, sizeMm: z.number().positive(), frameRole: elementRoleSchema, moduleRole: elementRoleSchema }),
   z.object({ ...baseElementFields, type: z.literal("image"), assetRef: z.string().min(1), widthMm: z.number().positive(), heightMm: z.number().positive(), role: elementRoleSchema, bgRemoved: z.boolean().optional(), svgOverrides: z.array(z.string().optional()).optional() }),
   z.object({ ...baseElementFields, type: z.literal("logo"), assetRef: z.string().min(1), widthMm: z.number().positive(), heightMm: z.number().positive(), role: elementRoleSchema })
 ]);
@@ -650,7 +651,10 @@ var cardDesignSchema = z.object({
       })
     )
   }).optional(),
-  qr: z.object({ enabled: z.boolean(), url: z.string().url("invalidUrl") }).optional(),
+  // NFCARD-561 -- `mode` makes "point to profile" DATA, not a string match; when it is
+  // 'redirect' the url is absent and the API substitutes the card's own /r/{code}?src=qr.
+  // Optional throughout: prod holds persisted designs with neither field.
+  qr: z.object({ enabled: z.boolean(), url: z.string().url("invalidUrl").or(z.literal("")).optional(), mode: qrModeSchema }).optional(),
   logo: z.object({ svg: z.string().optional(), svgPath: z.string().optional() }).optional(),
   wordmark: z.boolean().optional(),
   contentFace: z.enum(["top", "bottom"]).optional(),
@@ -1032,6 +1036,7 @@ export {
   profileUpdateSchema,
   profileUserDataSchema,
   profileVisibilitySchema,
+  qrModeSchema,
   sanitizeHttpUrl,
   sanitizeText,
   signupWithProfileSchema,

package/package.json

@@ -1,39 +1,45 @@
 {
   "name": "@nfcard/validation",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Shared Zod validation schemas for the NFCard product family.",
   "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
   "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
+    ".": "./src/index.ts"
   },
   "files": [
     "dist",
     "src"
   ],
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "build": "tsup src/index.ts --format esm --dts --clean",
+    "prepublishOnly": "pnpm build"
+  },
   "dependencies": {
     "zod": "^3.24.0",
-    "@nfcard/types": "0.15.0"
+    "@nfcard/types": "workspace:*"
   },
   "devDependencies": {
     "tsup": "^8.0.0"
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+      ".": {
+        "import": "./dist/index.js",
+        "types": "./dist/index.d.ts"
+      }
+    }
   },
   "repository": {
     "type": "git",
     "url": "https://bitbucket.org/fox-hole/nfcard-shared.git",
     "directory": "validation"
-  },
-  "scripts": {
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "build": "tsup src/index.ts --format esm --dts --clean"
   }
-}
+}

package/src/booking.test.ts

@@ -1,85 +1,85 @@
-import { describe, expect, it } from 'vitest'
-import { bookingSchema, digitalConfigSchema } from './index'
-
-const baseConfig = {
-  templateId: 'classic' as const,
-  accentColor: '#123456',
-  fontKey: 'inter',
-  showAvatar: true,
-}
-
-describe('bookingSchema', () => {
-  it('accepts a valid provider + handle and stores only { provider, handle }', () => {
-    expect(bookingSchema.parse({ provider: 'salonic', handle: 'kiss-fodraszat' })).toEqual({
-      provider: 'salonic',
-      handle: 'kiss-fodraszat',
-    })
-  })
-
-  it('normalizes a pasted booking-page URL down to the subdomain handle', () => {
-    expect(
-      bookingSchema.parse({
-        provider: 'salonic',
-        handle: 'https://kiss-fodraszat.salonic.hu/booking?x=1',
-      }),
-    ).toEqual({ provider: 'salonic', handle: 'kiss-fodraszat' })
-  })
-
-  it('lowercases the handle', () => {
-    expect(bookingSchema.parse({ provider: 'reservio', handle: 'HighBrow' })).toEqual({
-      provider: 'reservio',
-      handle: 'highbrow',
-    })
-  })
-
-  it('keeps a sanitized custom label, capped at 40 chars', () => {
-    const out = bookingSchema.parse({
-      provider: 'salonic',
-      handle: 'kiss-fodraszat',
-      label: '<b>Foglalj</b> ' + 'x'.repeat(60),
-    })
-    expect(out?.provider).toBe('salonic')
-    expect(out?.label).not.toContain('<')
-    expect((out?.label ?? '').length).toBeLessThanOrEqual(40)
-  })
-
-  it('drops everything invalid to undefined instead of throwing (never 400)', () => {
-    expect(bookingSchema.parse(undefined)).toBeUndefined()
-    expect(bookingSchema.parse(null)).toBeUndefined()
-    expect(bookingSchema.parse('nonsense')).toBeUndefined()
-    expect(bookingSchema.parse({})).toBeUndefined()
-    expect(bookingSchema.parse({ provider: 'booksy', handle: 'szalon' })).toBeUndefined()
-    expect(bookingSchema.parse({ provider: 'salonic', handle: 'www' })).toBeUndefined() // reserved
-    expect(bookingSchema.parse({ provider: 'salonic', handle: '-bad' })).toBeUndefined() // bad DNS label
-    expect(
-      bookingSchema.parse({ provider: 'salonic', handle: 'https://evil.com/szalon' }),
-    ).toBeUndefined()
-    expect(
-      bookingSchema.parse({ provider: 'salonic', handle: 'javascript:alert(1)' }),
-    ).toBeUndefined()
-    expect(bookingSchema.parse({ provider: 'salonic', handle: 123 })).toBeUndefined()
-  })
-})
-
-describe('digitalConfigSchema — booking field', () => {
-  it('round-trips a valid booking', () => {
-    const parsed = digitalConfigSchema.parse({
-      ...baseConfig,
-      booking: { provider: 'salonic', handle: 'kiss-fodraszat' },
-    })
-    expect(parsed.booking).toEqual({ provider: 'salonic', handle: 'kiss-fodraszat' })
-  })
-
-  it('drops an invalid booking without failing the whole config save', () => {
-    const parsed = digitalConfigSchema.parse({
-      ...baseConfig,
-      booking: { provider: 'salonic', handle: 'https://evil.com/x' },
-    })
-    expect(parsed.booking).toBeUndefined()
-  })
-
-  it('is optional — a config without a booking parses fine', () => {
-    const parsed = digitalConfigSchema.parse(baseConfig)
-    expect(parsed.booking).toBeUndefined()
-  })
-})
+import { describe, expect, it } from 'vitest'
+import { bookingSchema, digitalConfigSchema } from './index'
+
+const baseConfig = {
+  templateId: 'classic' as const,
+  accentColor: '#123456',
+  fontKey: 'inter',
+  showAvatar: true,
+}
+
+describe('bookingSchema', () => {
+  it('accepts a valid provider + handle and stores only { provider, handle }', () => {
+    expect(bookingSchema.parse({ provider: 'salonic', handle: 'kiss-fodraszat' })).toEqual({
+      provider: 'salonic',
+      handle: 'kiss-fodraszat',
+    })
+  })
+
+  it('normalizes a pasted booking-page URL down to the subdomain handle', () => {
+    expect(
+      bookingSchema.parse({
+        provider: 'salonic',
+        handle: 'https://kiss-fodraszat.salonic.hu/booking?x=1',
+      }),
+    ).toEqual({ provider: 'salonic', handle: 'kiss-fodraszat' })
+  })
+
+  it('lowercases the handle', () => {
+    expect(bookingSchema.parse({ provider: 'reservio', handle: 'HighBrow' })).toEqual({
+      provider: 'reservio',
+      handle: 'highbrow',
+    })
+  })
+
+  it('keeps a sanitized custom label, capped at 40 chars', () => {
+    const out = bookingSchema.parse({
+      provider: 'salonic',
+      handle: 'kiss-fodraszat',
+      label: '<b>Foglalj</b> ' + 'x'.repeat(60),
+    })
+    expect(out?.provider).toBe('salonic')
+    expect(out?.label).not.toContain('<')
+    expect((out?.label ?? '').length).toBeLessThanOrEqual(40)
+  })
+
+  it('drops everything invalid to undefined instead of throwing (never 400)', () => {
+    expect(bookingSchema.parse(undefined)).toBeUndefined()
+    expect(bookingSchema.parse(null)).toBeUndefined()
+    expect(bookingSchema.parse('nonsense')).toBeUndefined()
+    expect(bookingSchema.parse({})).toBeUndefined()
+    expect(bookingSchema.parse({ provider: 'booksy', handle: 'szalon' })).toBeUndefined()
+    expect(bookingSchema.parse({ provider: 'salonic', handle: 'www' })).toBeUndefined() // reserved
+    expect(bookingSchema.parse({ provider: 'salonic', handle: '-bad' })).toBeUndefined() // bad DNS label
+    expect(
+      bookingSchema.parse({ provider: 'salonic', handle: 'https://evil.com/szalon' }),
+    ).toBeUndefined()
+    expect(
+      bookingSchema.parse({ provider: 'salonic', handle: 'javascript:alert(1)' }),
+    ).toBeUndefined()
+    expect(bookingSchema.parse({ provider: 'salonic', handle: 123 })).toBeUndefined()
+  })
+})
+
+describe('digitalConfigSchema — booking field', () => {
+  it('round-trips a valid booking', () => {
+    const parsed = digitalConfigSchema.parse({
+      ...baseConfig,
+      booking: { provider: 'salonic', handle: 'kiss-fodraszat' },
+    })
+    expect(parsed.booking).toEqual({ provider: 'salonic', handle: 'kiss-fodraszat' })
+  })
+
+  it('drops an invalid booking without failing the whole config save', () => {
+    const parsed = digitalConfigSchema.parse({
+      ...baseConfig,
+      booking: { provider: 'salonic', handle: 'https://evil.com/x' },
+    })
+    expect(parsed.booking).toBeUndefined()
+  })
+
+  it('is optional — a config without a booking parses fine', () => {
+    const parsed = digitalConfigSchema.parse(baseConfig)
+    expect(parsed.booking).toBeUndefined()
+  })
+})

package/src/elements.test.ts

@@ -270,3 +270,79 @@ describe('per-element override fields survive validation (#1  P0 contract)', ()
     expect(a).toMatchObject({ rasterBgDataUrl: 'data:,bg', rasterAspect: 1.5 })
   })
 })
+
+// ── NFCARD-561: qr.mode makes "point to profile" data, not a string match ──
+//
+// The API used to detect it with a QR_PROFILE_TARGETS sentinel set
+// ('' / https://nfcard.hu / http://nfcard.hu). Any near-miss — a www. host, a
+// trailing path, a stale buyer-typed value — printed verbatim, and a printed
+// card cannot be corrected afterwards.
+
+describe('qr.mode (NFCARD-561)', () => {
+  it("accepts mode 'redirect' with NO url — the target is resolved at card creation", () => {
+    const res = cardDesignSchema.safeParse(
+      withElements([chipEl(), { ...qrEl(), url: undefined, mode: 'redirect' }]),
+    )
+    expect(res.success).toBe(true)
+  })
+
+  it("accepts mode 'redirect' with an empty-string url (the pre-561 free-layout spelling)", () => {
+    const res = cardDesignSchema.safeParse(
+      withElements([chipEl(), { ...qrEl(), url: '', mode: 'redirect' }]),
+    )
+    expect(res.success).toBe(true)
+  })
+
+  it("accepts mode 'raw' alongside a buyer-typed url", () => {
+    const res = cardDesignSchema.safeParse(
+      withElements([chipEl(), { ...qrEl(), url: 'https://acme.example/team', mode: 'raw' }]),
+    )
+    expect(res.success).toBe(true)
+  })
+
+  it('rejects an unknown mode', () => {
+    const res = cardDesignSchema.safeParse(
+      withElements([chipEl(), { ...qrEl(), mode: 'profile' }]),
+    )
+    expect(res.success).toBe(false)
+  })
+
+  it('still rejects a malformed url whatever the mode', () => {
+    const res = cardDesignSchema.safeParse(
+      withElements([chipEl(), { ...qrEl(), url: 'not-a-url', mode: 'raw' }]),
+    )
+    expect(codes(res)).toContain('invalidUrl')
+  })
+
+  it('a mode-less QR element still validates (pre-561 designs are untouched)', () => {
+    expect(cardDesignSchema.safeParse(withElements([chipEl(), qrEl()])).success).toBe(true)
+  })
+
+  it('carries mode through the legacy qr channel too', () => {
+    const parsed = cardDesignSchema.parse({
+      ...legacyDesign,
+      qr: { enabled: true, mode: 'redirect' },
+    }) as { qr: Record<string, unknown> }
+    expect(parsed.qr).toMatchObject({ enabled: true, mode: 'redirect' })
+  })
+})
+
+describe('printability — a redirect QR needs no url (NFCARD-561)', () => {
+  const at = (over = {}) =>
+    ({ ...qrEl(), transform: { xMm: 0, yMm: 0, rotationDeg: 0, scale: 1, z: 2 }, ...over }) as never
+
+  it("does not raise qrEmptyUrl for mode 'redirect' with no url", () => {
+    const codes = elementPrintability(at({ url: undefined, mode: 'redirect' })).map((v) => v.code)
+    expect(codes).not.toContain('qrEmptyUrl')
+  })
+
+  it("still raises qrEmptyUrl for mode 'raw' with no url", () => {
+    const codes = elementPrintability(at({ url: '', mode: 'raw' })).map((v) => v.code)
+    expect(codes).toContain('qrEmptyUrl')
+  })
+
+  it('still raises qrEmptyUrl for a mode-less QR with no url (legacy behaviour)', () => {
+    const codes = elementPrintability(at({ url: '' })).map((v) => v.code)
+    expect(codes).toContain('qrEmptyUrl')
+  })
+})

package/src/printability.ts

@@ -294,7 +294,11 @@ export function elementPrintability(el: CardElement, ctx: PrintabilityCtx): Viol
       if (el.sizeMm * el.transform.scale < QR_MIN_SIZE_MM - EPS) {
         push('qrTooSmall', 'The QR code is below the scannable size floor.')
       }
-      if (!el.url || !el.url.trim()) {
+      // NFCARD-561 — an absent url is CORRECT for a "point to profile" QR: the
+      // card's own /r/{shortCode}?src=qr is substituted at card creation, since
+      // the short code does not exist at design time. Only a `raw` (or legacy,
+      // mode-less) QR actually needs a buyer-supplied target.
+      if (el.mode !== 'redirect' && (!el.url || !el.url.trim())) {
         push('qrEmptyUrl', 'The QR code has no target URL.')
       }
       break

package/src/tipJar.test.ts

@@ -1,77 +1,77 @@
-import { describe, expect, it } from 'vitest'
-import { tipJarSchema, digitalConfigSchema } from './index'
-
-const baseConfig = {
-  templateId: 'classic' as const,
-  accentColor: '#123456',
-  fontKey: 'inter',
-  showAvatar: true,
-}
-
-describe('tipJarSchema', () => {
-  it('accepts a valid provider + handle and stores only { provider, handle }', () => {
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'ricsi' })).toEqual({
-      provider: 'kofi',
-      handle: 'ricsi',
-    })
-  })
-
-  it('normalizes a pasted full URL down to the handle', () => {
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'https://ko-fi.com/ricsi?x=1' })).toEqual(
-      { provider: 'kofi', handle: 'ricsi' },
-    )
-  })
-
-  it('lowercases revolut handles', () => {
-    expect(tipJarSchema.parse({ provider: 'revolut', handle: 'RicSi' })).toEqual({
-      provider: 'revolut',
-      handle: 'ricsi',
-    })
-  })
-
-  it('keeps a sanitized custom label, capped at 40 chars', () => {
-    const out = tipJarSchema.parse({
-      provider: 'kofi',
-      handle: 'ricsi',
-      label: '<b>Támogass</b> ' + 'x'.repeat(60),
-    })
-    expect(out?.provider).toBe('kofi')
-    expect(out?.label).not.toContain('<')
-    expect((out?.label ?? '').length).toBeLessThanOrEqual(40)
-  })
-
-  it('drops everything invalid to undefined instead of throwing (never 400)', () => {
-    expect(tipJarSchema.parse(undefined)).toBeUndefined()
-    expect(tipJarSchema.parse(null)).toBeUndefined()
-    expect(tipJarSchema.parse('nonsense')).toBeUndefined()
-    expect(tipJarSchema.parse({})).toBeUndefined()
-    expect(tipJarSchema.parse({ provider: 'stripe', handle: 'ricsi' })).toBeUndefined()
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'x' })).toBeUndefined() // too short
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'https://evil.com/ricsi' })).toBeUndefined()
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'javascript:alert(1)' })).toBeUndefined()
-    expect(tipJarSchema.parse({ provider: 'kofi', handle: 123 })).toBeUndefined()
-  })
-})
-
-describe('digitalConfigSchema — tipJar field', () => {
-  it('round-trips a valid tipJar', () => {
-    const parsed = digitalConfigSchema.parse({
-      ...baseConfig,
-      tipJar: { provider: 'revolut', handle: 'ricsi' },
-    })
-    expect(parsed.tipJar).toEqual({ provider: 'revolut', handle: 'ricsi' })
-  })
-
-  it('drops an invalid tipJar without failing the whole config save', () => {
-    const parsed = digitalConfigSchema.parse({
-      ...baseConfig,
-      tipJar: { provider: 'kofi', handle: 'https://evil.com/x' },
-    })
-    expect(parsed.tipJar).toBeUndefined()
-  })
-
-  it('is optional — a config without a tipJar parses fine', () => {
-    const parsed = digitalConfigSchema.parse(baseConfig)
-    expect(parsed.tipJar).toBeUndefined()
-  })
-})
+import { describe, expect, it } from 'vitest'
+import { tipJarSchema, digitalConfigSchema } from './index'
+
+const baseConfig = {
+  templateId: 'classic' as const,
+  accentColor: '#123456',
+  fontKey: 'inter',
+  showAvatar: true,
+}
+
+describe('tipJarSchema', () => {
+  it('accepts a valid provider + handle and stores only { provider, handle }', () => {
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'ricsi' })).toEqual({
+      provider: 'kofi',
+      handle: 'ricsi',
+    })
+  })
+
+  it('normalizes a pasted full URL down to the handle', () => {
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'https://ko-fi.com/ricsi?x=1' })).toEqual(
+      { provider: 'kofi', handle: 'ricsi' },
+    )
+  })
+
+  it('lowercases revolut handles', () => {
+    expect(tipJarSchema.parse({ provider: 'revolut', handle: 'RicSi' })).toEqual({
+      provider: 'revolut',
+      handle: 'ricsi',
+    })
+  })
+
+  it('keeps a sanitized custom label, capped at 40 chars', () => {
+    const out = tipJarSchema.parse({
+      provider: 'kofi',
+      handle: 'ricsi',
+      label: '<b>Támogass</b> ' + 'x'.repeat(60),
+    })
+    expect(out?.provider).toBe('kofi')
+    expect(out?.label).not.toContain('<')
+    expect((out?.label ?? '').length).toBeLessThanOrEqual(40)
+  })
+
+  it('drops everything invalid to undefined instead of throwing (never 400)', () => {
+    expect(tipJarSchema.parse(undefined)).toBeUndefined()
+    expect(tipJarSchema.parse(null)).toBeUndefined()
+    expect(tipJarSchema.parse('nonsense')).toBeUndefined()
+    expect(tipJarSchema.parse({})).toBeUndefined()
+    expect(tipJarSchema.parse({ provider: 'stripe', handle: 'ricsi' })).toBeUndefined()
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'x' })).toBeUndefined() // too short
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'https://evil.com/ricsi' })).toBeUndefined()
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 'javascript:alert(1)' })).toBeUndefined()
+    expect(tipJarSchema.parse({ provider: 'kofi', handle: 123 })).toBeUndefined()
+  })
+})
+
+describe('digitalConfigSchema — tipJar field', () => {
+  it('round-trips a valid tipJar', () => {
+    const parsed = digitalConfigSchema.parse({
+      ...baseConfig,
+      tipJar: { provider: 'revolut', handle: 'ricsi' },
+    })
+    expect(parsed.tipJar).toEqual({ provider: 'revolut', handle: 'ricsi' })
+  })
+
+  it('drops an invalid tipJar without failing the whole config save', () => {
+    const parsed = digitalConfigSchema.parse({
+      ...baseConfig,
+      tipJar: { provider: 'kofi', handle: 'https://evil.com/x' },
+    })
+    expect(parsed.tipJar).toBeUndefined()
+  })
+
+  it('is optional — a config without a tipJar parses fine', () => {
+    const parsed = digitalConfigSchema.parse(baseConfig)
+    expect(parsed.tipJar).toBeUndefined()
+  })
+})