@nutin/cli 1.2.3 → 1.3.1

package/templates/base/src/core/base-classes/base-component/helpers/event.helper.ts.hbs

@@ -3,9 +3,9 @@ import { TokenHelper } from './token.helper.js';
 
 export class EventHelper {
   public static bindEvents(
-    component: BaseComponent, 
-    element: HTMLElement, 
-    eventListeners: Array<[string, EventListener]>
+    component: BaseComponent,
+    element: HTMLElement,
+    eventListeners: Array<[EventTarget, string, EventListener]>
   ): void {
     element.querySelectorAll('[data-event]').forEach(el => {
       const parts = el.getAttribute('data-event')!.split(':');
@@ -23,6 +23,14 @@ export class EventHelper {
     });
   }
 
+  public static destroyEvents(
+    eventListeners: Array<[EventTarget, string, EventListener]>
+  ): void {
+    eventListeners.forEach(([target, event, listener]) => {
+      target.removeEventListener(event, listener);
+    });
+  }
+
   private static createBoundHandler(
     el: Element, 
     component: BaseComponent, 
@@ -37,21 +45,12 @@ export class EventHelper {
   }
 
   private static addEvent(
-    target: EventTarget, 
-    event: string, 
-    listener: EventListener, 
-    eventListeners: Array<[string, EventListener]>
+    target: EventTarget,
+    event: string,
+    listener: EventListener,
+    eventListeners: Array<[EventTarget, string, EventListener]>
   ): void {
     target.addEventListener(event, listener);
-    eventListeners.push([event, listener]);
-  }
-
-  public static destroyEvents(
-    element: HTMLElement, 
-    eventListeners: Array<[string, EventListener]>
-  ): void {
-    eventListeners.forEach(([event, listener]) => {
-      element.removeEventListener(event, listener);
-    });
+    eventListeners.push([target, event, listener]);
   }
 }

package/templates/base/src/core/base-classes/base-component/helpers/security.helper.ts.hbs

@@ -1,13 +1,11 @@
+export type TrustLevel = 'strict' | 'normal' | 'trusted';
+
 export class SecurityHelper {
-  public static escapeHtml(value: unknown): string {
+  public static sanitizeTemplate(value: unknown, trustLevel: TrustLevel = 'normal'): string {
     if (value === null || value === undefined) return '';
-    const str = String(value);
-    return str
-      .replace(/&/g, "&")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-      .replace(/"/g, "&quot;")
-      .replace(/'/g, "&#039;");
+    let template = String(value);
+
+    return this.sanitizeInputTemplate(template, trustLevel);
   }
 
   public static sanitizeInputElement(
@@ -21,4 +19,38 @@ export class SecurityHelper {
     }
     return '';
   }
+
+  public static escapeHtml(value: unknown): string {
+    if (value === null || value === undefined) return '';
+    const str = String(value);
+    return str
+      .replace(/&/g, "&amp;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
+  private static sanitizeInputTemplate(template: string, trustLevel: TrustLevel): string {
+    // Trusted: no tamplate sanitization
+    if (trustLevel === 'trusted') {
+      return template;
+    }
+
+    // Always remove scripts and inline event handlers
+    template = template
+      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+      .replace(/\son\w+\s*=\s*["'][^"']*["']/gi, '');
+    
+    // Strict: remove iframe, object, embed, href, data: protocol
+    if (trustLevel === 'strict') {
+      template = template
+        .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe>/gi, '')
+        .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object>/gi, '')
+        .replace(/<embed\b[^>]*>/gi, '')
+        .replace(/href\s*=\s*["']javascript:[^"']*["']/gi, '')
+        .replace(/src\s*=\s*["']data:[^"']*["']/gi, '');
+    }
+    return template;
+  }
 }

package/templates/base/src/core/base-classes/base-component/helpers/token.helper.ts.hbs

@@ -47,6 +47,22 @@ export class TokenHelper {
     );
   }
 
+/** Register a new exact token like "@foo" */
+  public static registerCustomToken(
+    name: string,
+    resolver: (el: HTMLElement, ev: Event) => any
+  ): void {
+    this.customResolvers[name] = resolver;
+  }
+
+/** Register a new prefixed token like "@style:" */
+  public static registerPrefixedToken(
+    prefix: string,
+    resolver: (suffix: string, el: HTMLElement) => any
+  ): void {
+    PREFIXED_TOKEN_RESOLVERS[prefix] = resolver;
+  }
+
   private static resolveExact(token: string, el: HTMLElement, ev: Event): any | null {
     const resolver = EXACT_TOKEN_RESOLVERS[token];
     return resolver ? resolver(el, ev) : null;
@@ -80,20 +96,4 @@ export class TokenHelper {
     }
     return null;
   }
-
-/** Register a new exact token like "@foo" */
-  public static registerCustomToken(
-    name: string,
-    resolver: (el: HTMLElement, ev: Event) => any
-  ) {
-    this.customResolvers[name] = resolver;
-  }
-
-/** Register a new prefixed token like "@style:" */
-  public static registerPrefixedToken(
-    prefix: string,
-    resolver: (suffix: string, el: HTMLElement) => any
-  ) {
-    PREFIXED_TOKEN_RESOLVERS[prefix] = resolver;
-  }
 }

package/templates/base/src/core/base-classes/component/component.ts.hbs

@@ -56,20 +56,30 @@ export abstract class Component<T extends HTMLElement = HTMLElement, K = any> ex
     normalizeKeys = [],
     defaults = {},
   }: ComponentOptions) {
-    let normalizedConfig = ConfigHelper.normalize(config, defaults);
-    normalizedConfig = ConfigHelper.normalizeStrings(normalizedConfig, normalizeKeys);
-
-    const template = templateFn(normalizedConfig);
-
+    const template = ConfigHelper.createNormalizedTemplate({
+      config, defaults, normalizeKeys, templateFn,
+    });
     super({template, mountTarget, tagName});
 
-    this.config = normalizeKeys && config
-      ? ConfigHelper.normalizeStrings(config, normalizeKeys)
-      : config ?? ({} as T);
-
+    this.config = ConfigHelper.setConfigValue(config, normalizeKeys);
     this.props = props;
+    this.buttonManager = this.createButtonManager();
+  }
+
+  public getValues(): Record<string, string> {
+    return DataBindingHelper.getDataBindingValues(this.element);
+  }
+
+  public override render(): HTMLElement {
+    this.applyProps();
+    this.appendDynamicButtons();
+    this.autoBindEvents();
+    this.parseDataAttributes();
+    return super.render();
+  }
 
-    this.buttonManager = new ButtonManager(
+  private createButtonManager(): ButtonManager {
+    return new ButtonManager(
       this, 
       this.props.buttons, 
       { containerClassName: 'component-buttons' }
@@ -80,11 +90,9 @@ export abstract class Component<T extends HTMLElement = HTMLElement, K = any> ex
     if (this.props.className) {
       this.element.classList.add(this.props.className);
     }
-
     if (this.props.style) {
       this.element.style = this.props.style;
     }
-
     this.applyDataBindings();
   }
 
@@ -95,16 +103,4 @@ export abstract class Component<T extends HTMLElement = HTMLElement, K = any> ex
   private applyDataBindings(): void {
     DataBindingHelper.applyDataBindings(this.element, this.props);
   }
-
-  public getValues(): Record<string, string> {
-    return DataBindingHelper.getDataBindingValues(this.element);
-  }
-
-  public override render(): HTMLElement {
-    this.applyProps();
-    this.appendDynamicButtons();
-    this.autoBindEvents();
-    this.parseDataAttributes();
-    return super.render();
-  }
 }

package/templates/base/src/core/base-classes/component/helpers/config.helper.ts.hbs

@@ -1,5 +1,5 @@
 export class ConfigHelper {
-  static normalize<T extends Record<string, any>>(
+  public static normalize<T extends Record<string, any>>(
     config: T, 
     defaults: Partial<T>
   ): T {
@@ -9,7 +9,7 @@ export class ConfigHelper {
     } as T;
   }
 
-  static normalizeStrings<T extends Record<string, any>>(
+  public static normalizeStrings<T extends Record<string, any>>(
     config: T,
     stringKeys: (keyof T)[]
   ): T {
@@ -23,4 +23,21 @@ export class ConfigHelper {
     
     return normalized;
   }
+  
+  public static createNormalizedTemplate<T extends Record<string, any>>({
+    config, 
+    defaults = {}, 
+    normalizeKeys = [], 
+    templateFn = () => ''
+  }: T) {
+    let normalizedConfig = ConfigHelper.normalize(config, defaults);
+    normalizedConfig = ConfigHelper.normalizeStrings(normalizedConfig, normalizeKeys);
+    return templateFn(normalizedConfig);
+  }
+
+  public static setConfigValue<T extends Record<string, any>>(config: T, normalizeKeys: (keyof T)[]): T {
+    if (normalizeKeys) return ConfigHelper.normalizeStrings(config, normalizeKeys) as T;
+    else if (config) return config as T 
+    else return ({} as T);
+  }
 }

package/templates/base/src/core/base-classes/component/helpers/data-binding.helper.ts.hbs

@@ -1,7 +1,7 @@
 import { ComponentProps } from "../component.js";
 
 export class DataBindingHelper {
-  static applyDataBindings(element: HTMLElement, props: ComponentProps): void {
+  public static applyDataBindings(element: HTMLElement, props: ComponentProps): void {
     const bindEls = element.querySelectorAll('[data-bind]');
     bindEls.forEach(el => {
       const key = el.getAttribute('data-bind');
@@ -18,7 +18,7 @@ export class DataBindingHelper {
     });
   }
 
-  static getDataBindingValues(element: HTMLElement): Record<string, string> {
+  public static getDataBindingValues(element: HTMLElement): Record<string, string> {
     const values: Record<string, string> = {};
     element.querySelectorAll('[data-bind]').forEach(el => {
       const key = el.getAttribute('data-bind');

package/templates/base/src/core/base-classes/service/service.ts.hbs

@@ -15,16 +15,10 @@ export abstract class Service<T extends Service<T>> {
         `${constructor.name} is a Service. Use ${constructor.name}.getInstance() instead.`
       );
     }
+    this.autoBindMethods();
     window.addEventListener('beforeunload', this.dispose);
   }
 
-  /**
-   * For async and custom cleanup operations
-   */
-  protected onDestroy<T extends Service<T>>(this: () => T): void {
-    console.log(`No onDestroy operations.`)
-  }
-
   public static createInstance<T extends Service<T>>(
     constructor: new (...args: any[]) => T,
     ...args: any[]
@@ -62,11 +56,7 @@ export abstract class Service<T extends Service<T>> {
     }
   }
 
-  protected registerCleanup(callback: () => void) {
-    this._cleanupCallbacks.push(callback);
-  }
-
-  public dispose = () => {
+  public dispose = (): void => {
     this._cleanupCallbacks.forEach(fn => fn());
     this._cleanupCallbacks = [];
     Service._instances.delete(this.constructor);
@@ -81,6 +71,39 @@ export abstract class Service<T extends Service<T>> {
     Service._instantiating.clear();
   }
 
+  protected registerCleanup(callback: () => void): void {
+    this._cleanupCallbacks.push(callback);
+  }
+
+  /**
+   * For async and custom cleanup operations
+   */
+  protected onDestroy<T extends Service<T>>(this: () => T): void {
+    console.log(`No onDestroy operations.`)
+  }
+
+  private autoBindMethods(): void {
+    let proto = Object.getPrototypeOf(this);
+
+    while (proto && proto !== Service.prototype) {
+      const propertyNames = Object.getOwnPropertyNames(proto);
+
+      for (const key of propertyNames) {
+        const descriptor = Object.getOwnPropertyDescriptor(proto, key);
+
+        if (
+          key !== 'constructor' &&
+          descriptor &&
+          typeof descriptor.value === 'function'
+        ) {
+          (this as any)[key] = descriptor.value.bind(this);
+        }
+      }
+
+      proto = Object.getPrototypeOf(proto);
+    }
+  }
+
   /**
    * Resets the Service instance without cleanup.
    */

package/templates/base/src/core/base-classes/view/view.ts.hbs

@@ -18,12 +18,6 @@ export abstract class View<T extends HTMLElement = HTMLElement> extends BaseComp
     this.viewName = viewName || this.getKebabCaseViewName();
   }
 
-  private getKebabCaseViewName(): string {
-    const className = this.constructor.name;
-    const baseName = className.replace(/View$/, '');
-    return baseName.replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
-  }
-
    /**
    * Set route parameters for this view instance
    * Called by the router when the view is instantiated
@@ -74,4 +68,10 @@ export abstract class View<T extends HTMLElement = HTMLElement> extends BaseComp
     super.destroy();
     this.onExit();
   }
+
+  private getKebabCaseViewName(): string {
+    const className = this.constructor.name;
+    const baseName = className.replace(/View$/, '');
+    return baseName.replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
+  }
 }

package/templates/base/src/core/services/event-bus/event-bus.ts.hbs

@@ -34,18 +34,6 @@ export class EventBus extends Service<EventBus> {
     this.addHandler(event, callback, true);
   }
 
-  private addHandler<K extends EventKey>(
-    event: K,
-    callback: (data: EventMap[K]) => void,
-    once: boolean
-  ) {
-    if (!this.handlers[event]) {
-      this.handlers[event] = [];
-    }
-    this.handlers[event]!.push(callback);
-    this._subscriptions.push({ event, callback, once });
-  }
-
   public emit<K extends EventKey>(event: K, data?: EventMap[K]): void {
     const callbacks = this.handlers[event];
     if (!callbacks) return;
@@ -80,7 +68,19 @@ export class EventBus extends Service<EventBus> {
     );
   }
 
-  private cleanupEventListeners = () => {
+  private addHandler<K extends EventKey>(
+    event: K,
+    callback: (data: EventMap[K]) => void,
+    once: boolean
+  ): void {
+    if (!this.handlers[event]) {
+      this.handlers[event] = [];
+    }
+    this.handlers[event]!.push(callback);
+    this._subscriptions.push({ event, callback, once });
+  }
+
+  private cleanupEventListeners = (): void => {
     this._subscriptions.forEach(({ event, callback }) => {
       this.off(event, callback);
     });

package/templates/base/src/core/services/http-client/helpers/http-builder.helper.ts.hbs

@@ -12,11 +12,21 @@ export interface IRequestConfig {
 }
 
 export class HttpBuilder {
-  static buildRequestBody(data: unknown): string | undefined {
-    return data ? JSON.stringify(data) : undefined;
+  public static buildRequestOptions(
+    method: HttpMethod,
+    data: unknown,
+    config: IRequestConfig,
+    signal: AbortSignal
+  ): RequestInit {
+    return {
+      method,
+      headers: config.headers,
+      body: this.buildRequestBody(data),
+      signal
+    };
   }
 
-  static buildRequestUrl(endpoint: string, queryParams?: Record<string, string>): URL {
+  public static buildRequestUrl(endpoint: string, queryParams?: Record<string, string>): URL {
     const url = new URL(endpoint);
     
     if (queryParams) {
@@ -26,23 +36,13 @@ export class HttpBuilder {
     return url;
   }
 
-  static appendQueryParams(url: URL, queryParams: Record<string, string>): void {
+  private static buildRequestBody(data: unknown): string | undefined {
+    return data ? JSON.stringify(data) : undefined;
+  }
+
+  private static appendQueryParams(url: URL, queryParams: Record<string, string>): void {
     Object.entries(queryParams).forEach(([key, value]) => {
       url.searchParams.append(key, value);
     });
   }
-
-  static buildRequestOptions(
-    method: HttpMethod,
-    data: unknown,
-    config: IRequestConfig,
-    signal: AbortSignal
-  ): RequestInit {
-    return {
-      method,
-      headers: config.headers,
-      body: this.buildRequestBody(data),
-      signal
-    };
-  }
 }

package/templates/base/src/core/services/http-client/helpers/http-manager.helper.ts.hbs

@@ -16,7 +16,7 @@ export class HttpError extends Error {
 }
 
 export class HttpManager {
-  static createAbortController(timeout?: number): IAbortControllerSetup {
+  public static createAbortController(timeout?: number): IAbortControllerSetup {
     const controller = new AbortController();
     const timeoutId = timeout ? 
       setTimeout(() => controller.abort(), timeout) : 
@@ -25,25 +25,13 @@ export class HttpManager {
     return { controller, timeoutId };
   }
 
-  static async safeParseErrorResponse(response: Response): Promise<unknown> {
-    try {
-      return await response.json();
-    } catch {
-      return null;
-    }
-  }
-
-  static async validateResponse(response: Response): Promise<void> {
+  public static async validateResponse(response: Response): Promise<void> {
     if (!response.ok) {
       await this.handleResponseError(response);
     }
   }
-
-  static isJsonResponse(contentType: string | null): boolean {
-    return contentType?.includes('application/json') ?? false;
-  }
   
-  static async parseSuccessResponse<T>(response: Response): Promise<T> {
+  public static async parseSuccessResponse<T>(response: Response): Promise<T> {
     const contentType = response.headers.get('content-type');
     
     if (this.isJsonResponse(contentType)) {
@@ -53,25 +41,37 @@ export class HttpManager {
     return await response.text() as unknown as T;
   }
 
-  static isTimeoutError(error: unknown): boolean {
-    return error instanceof DOMException && error.name === 'AbortError';
-  }
-
-  static handleRequestError(error: unknown): never {
+  public static handleRequestError(error: unknown): never {
     if (this.isTimeoutError(error)) {
       throw new Error('Request timed out');
     }
     throw error;
   }
 
-  static async handleResponseError(response: Response): Promise<never> {
+  public static cleanupTimeout(timeoutId: TimeoutType | null): void {
+    if (timeoutId) {
+      clearTimeout(timeoutId);
+    }
+  }
+
+  private static async handleResponseError(response: Response): Promise<never> {
     const errorData = await this.safeParseErrorResponse(response);
     throw new HttpError(response.status, response.statusText, errorData);
   }
 
-  static cleanupTimeout(timeoutId: TimeoutType | null): void {
-    if (timeoutId) {
-      clearTimeout(timeoutId);
+  private static isJsonResponse(contentType: string | null): boolean {
+    return contentType?.includes('application/json') ?? false;
+  }
+
+  private static async safeParseErrorResponse(response: Response): Promise<unknown> {
+    try {
+      return await response.json();
+    } catch {
+      return null;
     }
   }
+
+  private static isTimeoutError(error: unknown): boolean {
+    return error instanceof DOMException && error.name === 'AbortError';
+  }
 }

package/templates/base/src/core/services/http-client/http-client.ts.hbs

@@ -17,15 +17,31 @@ export class HttpClient extends Service<HttpClient> {
     this._defaultHeaders = { 'Content-Type': 'application/json', ...defaultHeaders };
   }
 
-  public addRequestInterceptor(fn: (url: string, options: RequestInit) => void) {
+  public get<T = unknown>(endpoint: string, config?: IRequestConfig): Promise<T> { 
+    return this.request<T>('GET', endpoint, null, config);
+  }
+  public post<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig): Promise<T> { 
+    return this.request<T>('POST', endpoint, data, config);
+  }
+  public put<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig): Promise<T> { 
+    return this.request<T>('PUT', endpoint, data, config);
+  }
+  public patch<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig): Promise<T> { 
+    return this.request<T>('PATCH', endpoint, data, config);
+  }
+  public delete<T = unknown>(endpoint: string, config?: IRequestConfig): Promise<T> { 
+    return this.request<T>('DELETE', endpoint, undefined, config);
+  }
+
+  public addRequestInterceptor(fn: (url: string, options: RequestInit) => void): void {
     this._requestInterceptors.push(fn);
   }
 
-  public addResponseInterceptor(fn: (response: Response) => void) {
+  public addResponseInterceptor(fn: (response: Response) => void): void {
     this._responseInterceptors.push(fn);
   }
 
-  onDestroy(): void {
+  protected onDestroy(): void {
     this._baseUrl = '';
     this._defaultHeaders = {};
     this._requestInterceptors = [];
@@ -60,22 +76,6 @@ export class HttpClient extends Service<HttpClient> {
       HttpManager.cleanupTimeout(timeoutId);
     }
   }
-
-  public get<T = unknown>(endpoint: string, config?: IRequestConfig) { 
-    return this.request<T>('GET', endpoint, null, config);
-  }
-  public post<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig) { 
-    return this.request<T>('POST', endpoint, data, config);
-  }
-  public put<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig) { 
-    return this.request<T>('PUT', endpoint, data, config);
-  }
-  public patch<T = unknown>(endpoint: string, data?: unknown, config?: IRequestConfig) { 
-    return this.request<T>('PATCH', endpoint, data, config);
-  }
-  public delete<T = unknown>(endpoint: string, config?: IRequestConfig) { 
-    return this.request<T>('DELETE', endpoint, undefined, config);
-  }
 }
 
 export const AppHttpClient = HttpClient.getInstance();

package/templates/base/src/core/services/pipe-registry/pipe-registry.ts.hbs

@@ -7,11 +7,7 @@ class PipeRegistry extends Service<PipeRegistry> {
 
   constructor() { super(); }
 
-  onDestroy() {
-    this._pipes = {};
-  }
-
-  register(name: string, fn: PipeFunction): void {
+  public register(name: string, fn: PipeFunction): void {
     if(this._pipes[name]) {
       console.warn(`Skipping pipe "${name}": A pipe with this name already exists.`);
       return;
@@ -19,7 +15,7 @@ class PipeRegistry extends Service<PipeRegistry> {
     this._pipes[name] = fn;
   }
 
-  apply(name: string, value: any, args: string[] = []): string {
+  public apply(name: string, value: any, args: string[] = []): string {
     const pipe = this._pipes[name];
     if (!pipe) {
       console.warn(`Pipe "${name}" not found.`);
@@ -27,6 +23,10 @@ class PipeRegistry extends Service<PipeRegistry> {
     }
     return pipe(value, ...args);
   }
+
+  protected onDestroy(): void {
+    this._pipes = {};
+  }
 }
 
 export const AppPipeRegistry = PipeRegistry.getInstance();