@nfcard/validation 0.6.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nfcard/validation",
-  "version": "0.6.0",
+  "version": "0.9.0",
   "description": "Shared Zod validation schemas for the NFCard product family.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "dependencies": {
     "zod": "^3.24.0",
-    "@nfcard/types": "0.5.0"
+    "@nfcard/types": "0.8.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0"

package/src/index.test.ts

@@ -16,6 +16,7 @@ import {
   sanitizeText,
   signupWithProfileSchema,
   socialLinksSchema,
+  socialOverridesSchema,
   userDataSchema,
   validateConfiguration,
   validateDigitalConfig,
@@ -209,6 +210,64 @@ describe('socialLinksSchema', () => {
   });
 });
 
+// ── socialOverridesSchema (FOXHOLE-595 input side) ──────────────
+
+describe('socialOverridesSchema (FOXHOLE-595 input side)', () => {
+  it('sanitizes every present URL field to safe https (or drops unsafe)', () => {
+    const out = socialOverridesSchema.parse({
+      facebook: 'https://facebook.com/foxhome',
+      linkedin: 'javascript:alert(1)', // unsafe scheme → ''
+      instagram: 'instagram.com/foxhome', // bare host → https
+      x: 'http://x.com/foxhome', // http upgraded → https
+      customUrl: '<script>x</script>https://foo.bar', // tags stripped
+      customUrlLabel: '<b>My link</b>',
+    });
+    expect(out.facebook).toBe('https://facebook.com/foxhome');
+    expect(out.linkedin).toBe('');
+    expect(out.instagram).toBe('https://instagram.com/foxhome');
+    expect(out.x?.startsWith('https://')).toBe(true);
+    expect(out.customUrl).not.toMatch(/script/i);
+    expect(out.customUrlLabel).toBe('My link');
+  });
+
+  it('preserves SPARSE semantics — omitted keys stay omitted (no merge clobber)', () => {
+    // The renderer merges { ...baseSocialLinks, ...socialOverrides }; an
+    // omitted override key must NOT appear as '' or it would wipe the
+    // inherited link. See socialOverridesSchema comment.
+    const out = socialOverridesSchema.parse({ facebook: 'https://fb.com/x' });
+    expect(out.facebook).toBe('https://fb.com/x');
+    expect('linkedin' in out).toBe(false);
+    expect('x' in out).toBe(false);
+    expect('customUrl' in out).toBe(false);
+    expect('customUrlLabel' in out).toBe(false);
+    expect(Object.keys(out)).toEqual(['facebook']);
+  });
+
+  it('includes x for parity with the SocialLinks type + renderer', () => {
+    const out = socialOverridesSchema.parse({ x: 'x.com/foo' });
+    expect(out.x).toBe('https://x.com/foo');
+  });
+
+  it.each([
+    'javascript:alert(1)',
+    'JaVaScRiPt:alert(1)',
+    'data:text/html,<script>alert(1)</script>',
+    'vbscript:msgbox(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.c',
+  ])('coerces a dangerous override to empty rather than 400ing: %s', (bad) => {
+    const r = socialOverridesSchema.safeParse({ customUrl: bad });
+    expect(r.success).toBe(true);
+    if (r.success) expect(r.data.customUrl).toBe('');
+  });
+
+  it('accepts an empty object (every field optional)', () => {
+    const r = socialOverridesSchema.safeParse({});
+    expect(r.success).toBe(true);
+    if (r.success) expect(Object.keys(r.data)).toEqual([]);
+  });
+});
+
 // ── userDataSchema ──────────────────────────────────────────────
 
 describe('userDataSchema / validateUserData', () => {
@@ -379,6 +438,23 @@ describe('digitalConfigSchema / validateDigitalConfig', () => {
     const r = validateDigitalConfig({ ...validDigitalConfig, fontKey: '' });
     expect(r.success).toBe(false);
   });
+
+  it('sanitizes socialOverrides on the full config (FOXHOLE-595 input side)', () => {
+    const r = validateDigitalConfig({
+      ...validDigitalConfig,
+      socialOverrides: {
+        linkedin: 'javascript:alert(1)', // unsafe → ''
+        facebook: 'fb.com/x', // bare host → https
+      },
+    });
+    expect(r.success).toBe(true);
+    if (r.success) {
+      expect(r.data.socialOverrides?.linkedin).toBe('');
+      expect(r.data.socialOverrides?.facebook).toBe('https://fb.com/x');
+      // omitted override keys stay absent — no merge clobber downstream
+      expect('instagram' in (r.data.socialOverrides ?? {})).toBe(false);
+    }
+  });
 });
 
 // ── configurationCreateSchema ───────────────────────────────────