@nfcard/validation 0.5.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nfcard/validation",
-  "version": "0.5.0",
+  "version": "0.8.0",
   "description": "Shared Zod validation schemas for the NFCard product family.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "dependencies": {
     "zod": "^3.24.0",
-    "@nfcard/types": "0.4.0"
+    "@nfcard/types": "0.7.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0"

package/src/index.test.ts

@@ -1,13 +1,16 @@
 import { describe, expect, it } from 'vitest';
 import {
+  cardDesignSchema,
   cardElementsSchema,
   comboIdSchema,
   configurationCreateSchema,
   contactExchangeSchema,
   createOrderSchema,
+  ctaButtonsSchema,
   digitalConfigSchema,
   hubConfigSchema,
   materialSchema,
+  MAX_CTA_BUTTONS,
   physicalConfigSchema,
   profileCreateSchema,
   profileVisibilitySchema,
@@ -15,6 +18,7 @@ import {
   sanitizeText,
   signupWithProfileSchema,
   socialLinksSchema,
+  socialOverridesSchema,
   userDataSchema,
   validateConfiguration,
   validateDigitalConfig,
@@ -208,6 +212,151 @@ describe('socialLinksSchema', () => {
   });
 });
 
+// ── socialOverridesSchema (FOXHOLE-595 input side) ──────────────
+
+describe('socialOverridesSchema (FOXHOLE-595 input side)', () => {
+  it('sanitizes every present URL field to safe https (or drops unsafe)', () => {
+    const out = socialOverridesSchema.parse({
+      facebook: 'https://facebook.com/foxhome',
+      linkedin: 'javascript:alert(1)', // unsafe scheme → ''
+      instagram: 'instagram.com/foxhome', // bare host → https
+      x: 'http://x.com/foxhome', // http upgraded → https
+      customUrl: '<script>x</script>https://foo.bar', // tags stripped
+      customUrlLabel: '<b>My link</b>',
+    });
+    expect(out.facebook).toBe('https://facebook.com/foxhome');
+    expect(out.linkedin).toBe('');
+    expect(out.instagram).toBe('https://instagram.com/foxhome');
+    expect(out.x?.startsWith('https://')).toBe(true);
+    expect(out.customUrl).not.toMatch(/script/i);
+    expect(out.customUrlLabel).toBe('My link');
+  });
+
+  it('preserves SPARSE semantics — omitted keys stay omitted (no merge clobber)', () => {
+    // The renderer merges { ...baseSocialLinks, ...socialOverrides }; an
+    // omitted override key must NOT appear as '' or it would wipe the
+    // inherited link. See socialOverridesSchema comment.
+    const out = socialOverridesSchema.parse({ facebook: 'https://fb.com/x' });
+    expect(out.facebook).toBe('https://fb.com/x');
+    expect('linkedin' in out).toBe(false);
+    expect('x' in out).toBe(false);
+    expect('customUrl' in out).toBe(false);
+    expect('customUrlLabel' in out).toBe(false);
+    expect(Object.keys(out)).toEqual(['facebook']);
+  });
+
+  it('includes x for parity with the SocialLinks type + renderer', () => {
+    const out = socialOverridesSchema.parse({ x: 'x.com/foo' });
+    expect(out.x).toBe('https://x.com/foo');
+  });
+
+  it.each([
+    'javascript:alert(1)',
+    'JaVaScRiPt:alert(1)',
+    'data:text/html,<script>alert(1)</script>',
+    'vbscript:msgbox(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.c',
+  ])('coerces a dangerous override to empty rather than 400ing: %s', (bad) => {
+    const r = socialOverridesSchema.safeParse({ customUrl: bad });
+    expect(r.success).toBe(true);
+    if (r.success) expect(r.data.customUrl).toBe('');
+  });
+
+  it('accepts an empty object (every field optional)', () => {
+    const r = socialOverridesSchema.safeParse({});
+    expect(r.success).toBe(true);
+    if (r.success) expect(Object.keys(r.data)).toEqual([]);
+  });
+});
+
+// ── ctaButtonsSchema (NFCARD-211 — Pro CTA buttons) ─────────────
+
+describe('ctaButtonsSchema (NFCARD-211 — Pro CTA buttons)', () => {
+  it('keeps a valid button and upgrades http → https', () => {
+    const out = ctaButtonsSchema.parse([
+      { label: 'Book a call', url: 'http://calendly.com/foxhome' },
+    ]);
+    expect(out).toEqual([
+      { label: 'Book a call', url: 'https://calendly.com/foxhome' },
+    ]);
+  });
+
+  it('prefixes https onto a bare-host url', () => {
+    const [btn] = ctaButtonsSchema.parse([
+      { label: 'Shop', url: 'foxhome.hu/shop' },
+    ]);
+    expect(btn.url).toBe('https://foxhome.hu/shop');
+  });
+
+  it.each([
+    'javascript:alert(1)',
+    'JaVaScRiPt:alert(1)',
+    'data:text/html,<script>alert(1)</script>',
+    'vbscript:msgbox(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.c',
+  ])('drops a button whose url is a dangerous/non-http scheme: %s', (bad) => {
+    // url sanitizes to '' → the button is incomplete → filtered out.
+    expect(ctaButtonsSchema.parse([{ label: 'Click me', url: bad }])).toEqual([]);
+  });
+
+  it('strips HTML tags from the label and caps its length at 40', () => {
+    const [btn] = ctaButtonsSchema.parse([
+      { label: '<b>Pay now</b>', url: 'https://pay.example.com' },
+    ]);
+    expect(btn.label).toBe('Pay now');
+    const long = ctaButtonsSchema.parse([
+      { label: 'x'.repeat(200), url: 'https://e.com' },
+    ]);
+    expect(long[0].label.length).toBe(40);
+  });
+
+  it('drops incomplete buttons (missing label or url)', () => {
+    const out = ctaButtonsSchema.parse([
+      { label: '', url: 'https://valid.example.com' },
+      { label: 'No link', url: '' },
+      { label: 'Good', url: 'https://ok.example.com' },
+    ]);
+    // URL.href normalises a bare origin with a trailing slash.
+    expect(out).toEqual([{ label: 'Good', url: 'https://ok.example.com/' }]);
+  });
+
+  it(`caps the list at MAX_CTA_BUTTONS (${MAX_CTA_BUTTONS})`, () => {
+    const many = Array.from({ length: MAX_CTA_BUTTONS + 4 }, (_, i) => ({
+      label: `Btn ${i}`,
+      url: `https://e${i}.example.com`,
+    }));
+    expect(ctaButtonsSchema.parse(many)).toHaveLength(MAX_CTA_BUTTONS);
+  });
+
+  it('rejects an abusive payload over the hard array cap', () => {
+    const huge = Array.from({ length: 51 }, () => ({
+      label: 'x',
+      url: 'https://e.example.com',
+    }));
+    expect(ctaButtonsSchema.safeParse(huge).success).toBe(false);
+  });
+
+  it('flows through digitalConfigSchema — unsafe buttons dropped on save', () => {
+    const r = digitalConfigSchema.safeParse({
+      templateId: 'card',
+      accentColor: '#1A6B52',
+      fontKey: 'inter',
+      showAvatar: true,
+      ctaButtons: [
+        { label: 'Evil', url: 'javascript:alert(1)' },
+        { label: 'Book', url: 'calendly.com/x' },
+      ],
+    });
+    expect(r.success).toBe(true);
+    if (r.success)
+      expect(r.data.ctaButtons).toEqual([
+        { label: 'Book', url: 'https://calendly.com/x' },
+      ]);
+  });
+});
+
 // ── userDataSchema ──────────────────────────────────────────────
 
 describe('userDataSchema / validateUserData', () => {
@@ -378,6 +527,23 @@ describe('digitalConfigSchema / validateDigitalConfig', () => {
     const r = validateDigitalConfig({ ...validDigitalConfig, fontKey: '' });
     expect(r.success).toBe(false);
   });
+
+  it('sanitizes socialOverrides on the full config (FOXHOLE-595 input side)', () => {
+    const r = validateDigitalConfig({
+      ...validDigitalConfig,
+      socialOverrides: {
+        linkedin: 'javascript:alert(1)', // unsafe → ''
+        facebook: 'fb.com/x', // bare host → https
+      },
+    });
+    expect(r.success).toBe(true);
+    if (r.success) {
+      expect(r.data.socialOverrides?.linkedin).toBe('');
+      expect(r.data.socialOverrides?.facebook).toBe('https://fb.com/x');
+      // omitted override keys stay absent — no merge clobber downstream
+      expect('instagram' in (r.data.socialOverrides ?? {})).toBe(false);
+    }
+  });
 });
 
 // ── configurationCreateSchema ───────────────────────────────────
@@ -685,3 +851,92 @@ describe('hubConfigSchema', () => {
     expect(hubConfigSchema.safeParse({ avatarUrl: '' }).success).toBe(true);
   });
 });
+
+// ── cardDesign (cardgen interop, FOXHOLE-810) ───────────────────
+
+const validCardDesign = {
+  material: '3dprint_standard' as const,
+  designType: 'custom' as const,
+  thicknessMm: 1.8,
+  pattern: {
+    family: 'spiral' as const,
+    variant: 'pulse' as const,
+    density: 0.55,
+    holeMinMm: 0.6,
+    holeMaxMm: 2.0,
+    intensity: 0.5,
+    cellShape: 0 as const,
+    cellRotationDeg: 0,
+    chipShape: 0 as const,
+    chipRotationDeg: 0,
+  },
+  layout: { chipAnchor: { col: 0 as const, row: 1 as const } },
+  filaments: { background: '#F2F1ED', text: '#1A1A1A', accent: '#3FA34D' },
+};
+
+const valid3dPhysicalConfig = {
+  material: '3dprint_standard' as const,
+  colour: '#F2F1ED',
+  comboId: 'A1' as const,
+  frontElements: validCardElements,
+  backElements: validCardElements,
+};
+
+describe('cardDesignSchema', () => {
+  it('accepts a valid 3D card design', () => {
+    expect(cardDesignSchema.safeParse(validCardDesign).success).toBe(true);
+  });
+
+  it('accepts a solid card (pattern: null)', () => {
+    expect(
+      cardDesignSchema.safeParse({ ...validCardDesign, pattern: null }).success,
+    ).toBe(true);
+  });
+
+  it('rejects plastic (cardgen has no FDM mesh for PVC)', () => {
+    expect(
+      cardDesignSchema.safeParse({ ...validCardDesign, material: 'plastic' }).success,
+    ).toBe(false);
+  });
+
+  it('rejects holeMin > holeMax', () => {
+    const bad = { ...validCardDesign, pattern: { ...validCardDesign.pattern, holeMinMm: 3, holeMaxMm: 1 } };
+    expect(cardDesignSchema.safeParse(bad).success).toBe(false);
+  });
+
+  it('rejects an unknown pattern family', () => {
+    const bad = { ...validCardDesign, pattern: { ...validCardDesign.pattern, family: 'mosaic' } };
+    expect(cardDesignSchema.safeParse(bad).success).toBe(false);
+  });
+
+  it('rejects a chip anchor outside 0..2', () => {
+    const bad = { ...validCardDesign, layout: { chipAnchor: { col: 3, row: 1 } } };
+    expect(cardDesignSchema.safeParse(bad).success).toBe(false);
+  });
+
+  it('rejects a non-hex filament', () => {
+    const bad = { ...validCardDesign, filaments: { ...validCardDesign.filaments, accent: 'green' } };
+    expect(cardDesignSchema.safeParse(bad).success).toBe(false);
+  });
+});
+
+describe('physicalConfig.cardDesign (nested, not stripped)', () => {
+  it('accepts a 3D physicalConfig carrying a matching cardDesign', () => {
+    const res = physicalConfigSchema.safeParse({ ...valid3dPhysicalConfig, cardDesign: validCardDesign });
+    expect(res.success).toBe(true);
+    // and it survives (not stripped):
+    if (res.success) expect(res.data.cardDesign?.material).toBe('3dprint_standard');
+  });
+
+  it('rejects a cardDesign whose material disagrees with the card', () => {
+    const res = physicalConfigSchema.safeParse({
+      ...valid3dPhysicalConfig,
+      cardDesign: { ...validCardDesign, material: 'metal' },
+    });
+    expect(res.success).toBe(false);
+  });
+
+  it('still accepts a legacy physicalConfig with no cardDesign', () => {
+    expect(physicalConfigSchema.safeParse(validPhysicalConfig).success).toBe(true);
+  });
+});