@nfcard/validation 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nfcard/validation",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Shared Zod validation schemas for the NFCard product family.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "dependencies": {
     "zod": "^3.24.0",
-    "@nfcard/types": "0.7.0"
+    "@nfcard/types": "0.8.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0"

package/src/index.test.ts

@@ -6,11 +6,9 @@ import {
   configurationCreateSchema,
   contactExchangeSchema,
   createOrderSchema,
-  ctaButtonsSchema,
   digitalConfigSchema,
   hubConfigSchema,
   materialSchema,
-  MAX_CTA_BUTTONS,
   physicalConfigSchema,
   profileCreateSchema,
   profileVisibilitySchema,
@@ -270,93 +268,6 @@ describe('socialOverridesSchema (FOXHOLE-595 input side)', () => {
   });
 });
 
-// ── ctaButtonsSchema (NFCARD-211 — Pro CTA buttons) ─────────────
-
-describe('ctaButtonsSchema (NFCARD-211 — Pro CTA buttons)', () => {
-  it('keeps a valid button and upgrades http → https', () => {
-    const out = ctaButtonsSchema.parse([
-      { label: 'Book a call', url: 'http://calendly.com/foxhome' },
-    ]);
-    expect(out).toEqual([
-      { label: 'Book a call', url: 'https://calendly.com/foxhome' },
-    ]);
-  });
-
-  it('prefixes https onto a bare-host url', () => {
-    const [btn] = ctaButtonsSchema.parse([
-      { label: 'Shop', url: 'foxhome.hu/shop' },
-    ]);
-    expect(btn.url).toBe('https://foxhome.hu/shop');
-  });
-
-  it.each([
-    'javascript:alert(1)',
-    'JaVaScRiPt:alert(1)',
-    'data:text/html,<script>alert(1)</script>',
-    'vbscript:msgbox(1)',
-    'file:///etc/passwd',
-    'mailto:a@b.c',
-  ])('drops a button whose url is a dangerous/non-http scheme: %s', (bad) => {
-    // url sanitizes to '' → the button is incomplete → filtered out.
-    expect(ctaButtonsSchema.parse([{ label: 'Click me', url: bad }])).toEqual([]);
-  });
-
-  it('strips HTML tags from the label and caps its length at 40', () => {
-    const [btn] = ctaButtonsSchema.parse([
-      { label: '<b>Pay now</b>', url: 'https://pay.example.com' },
-    ]);
-    expect(btn.label).toBe('Pay now');
-    const long = ctaButtonsSchema.parse([
-      { label: 'x'.repeat(200), url: 'https://e.com' },
-    ]);
-    expect(long[0].label.length).toBe(40);
-  });
-
-  it('drops incomplete buttons (missing label or url)', () => {
-    const out = ctaButtonsSchema.parse([
-      { label: '', url: 'https://valid.example.com' },
-      { label: 'No link', url: '' },
-      { label: 'Good', url: 'https://ok.example.com' },
-    ]);
-    // URL.href normalises a bare origin with a trailing slash.
-    expect(out).toEqual([{ label: 'Good', url: 'https://ok.example.com/' }]);
-  });
-
-  it(`caps the list at MAX_CTA_BUTTONS (${MAX_CTA_BUTTONS})`, () => {
-    const many = Array.from({ length: MAX_CTA_BUTTONS + 4 }, (_, i) => ({
-      label: `Btn ${i}`,
-      url: `https://e${i}.example.com`,
-    }));
-    expect(ctaButtonsSchema.parse(many)).toHaveLength(MAX_CTA_BUTTONS);
-  });
-
-  it('rejects an abusive payload over the hard array cap', () => {
-    const huge = Array.from({ length: 51 }, () => ({
-      label: 'x',
-      url: 'https://e.example.com',
-    }));
-    expect(ctaButtonsSchema.safeParse(huge).success).toBe(false);
-  });
-
-  it('flows through digitalConfigSchema — unsafe buttons dropped on save', () => {
-    const r = digitalConfigSchema.safeParse({
-      templateId: 'card',
-      accentColor: '#1A6B52',
-      fontKey: 'inter',
-      showAvatar: true,
-      ctaButtons: [
-        { label: 'Evil', url: 'javascript:alert(1)' },
-        { label: 'Book', url: 'calendly.com/x' },
-      ],
-    });
-    expect(r.success).toBe(true);
-    if (r.success)
-      expect(r.data.ctaButtons).toEqual([
-        { label: 'Book', url: 'https://calendly.com/x' },
-      ]);
-  });
-});
-
 // ── userDataSchema ──────────────────────────────────────────────
 
 describe('userDataSchema / validateUserData', () => {