@oneie/plugin-pages 0.1.0 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneie/plugin-pages",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "ONE pages — renders a workspace's published Puck pages on any Astro site via the public pages:view receiver",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -11,6 +11,10 @@
     "./fetchPage.ts": "./src/fetchPage.ts",
     "./PageRoute.astro": "./src/PageRoute.astro"
   },
+  "scripts": {
+    "build": "tsc --noEmit",
+    "test": "vitest run"
+  },
   "dependencies": {
     "clsx": "^2.1.1",
     "lucide-react": "^1.14.0",
@@ -19,8 +23,18 @@
   },
   "peerDependencies": {
     "astro": ">=6.0.0",
-    "@oneie/frontend": ">=0.1.0",
+    "@oneie/frontend": "^0.1.1",
     "@puckeditor/core": ">=0.21.0",
     "react": ">=19.0.0"
+  },
+  "devDependencies": {
+    "astro": "^6.2.2",
+    "@puckeditor/core": "^0.21.3",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.6"
   }
 }

package/tests/plugin-pages.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect } from 'vitest'
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { PageRenderer, type PuckData } from '../src/PageRenderer'
+import { fetchPage } from '../src/fetchPage'
+
+// Real production fixture — the exact `pages:view` response for workspace `tony`,
+// page `beer`, captured live 2026-07-11. Not hand-invented: this is what caught
+// C1's stub-block bug (block type names that never matched any real page) — a
+// self-referential fixture would never have caught that, so this test uses real
+// content on purpose. `Heading` (id only) is a structural block outside this
+// cycle's ported set — expected to render nothing, not a failure.
+const beerPage = {
+  root: {},
+  content: [
+    { type: 'LandingHero', props: { id: 'LandingHero-kr5o1y' } },
+    { type: 'Heading', props: { id: 'Heading-jxrapx' } },
+    { type: 'LandingFeatures', props: { id: 'LandingFeatures-al6pnl' } },
+    { type: 'HowItWorks', props: { id: 'HowItWorks-6gplnc' } },
+    { type: 'ProofBar', props: { id: 'ProofBar-g3yvbh' } },
+    { type: 'SecondaryCTA', props: { id: 'SecondaryCTA-drayza' } },
+    { type: 'FAQSection', props: { id: 'FAQSection-y7z0lt' } },
+    { type: 'Testimonials', props: { id: 'Testimonials-9cq0fo' } },
+    { type: 'PricingSection', props: { id: 'PricingSection-mtqhe8' } },
+  ],
+  zones: {},
+} as unknown as PuckData
+
+const mockFetch = (body: unknown): typeof fetch =>
+  (async () =>
+    new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    })) as unknown as typeof fetch
+
+describe('PageRenderer — real page content', () => {
+  it('renders every block type from a real published page (not a self-invented fixture)', () => {
+    const html = renderToStaticMarkup(createElement(PageRenderer, { data: beerPage }))
+    // The real beer page's stored props are just `{id}` per block (never customized
+    // past insertion) — Puck's read-only <Render> does NOT merge each component's
+    // config-level `defaultProps` (that's editor-only, for new-component insertion);
+    // it passes stored props straight through, so each *component's own* JS default
+    // parameter value is what actually renders. Asserting on those (not the config
+    // defaultProps) is what proves the real registry keys resolve to the right
+    // component — a stub-key config would render none of this.
+    expect(html).toContain('What you get') // LandingFeatures component default title
+    expect(html).toContain('How it works') // HowItWorks component default title
+    expect(html).toContain('Common questions') // FAQSection component default title
+    expect(html).toContain('What agencies say') // Testimonials component default title
+    expect(html).toContain('Simple pricing') // PricingSection component default title
+    expect(html).toContain('No credit card · 2-minute setup') // LandingHero + SecondaryCTA shared default frictionText
+    expect(html).toContain('lucide-arrow-right') // LandingHero/SecondaryCTA CTA icon actually rendered
+    expect((html.match(/<section/g) ?? []).length).toBe(8) // 8 of the 9 fixture blocks are ported (Heading is out of scope)
+  })
+
+  it('renders nothing for a block type outside the ported set, without throwing', () => {
+    const onlyUnknown = { root: {}, content: [{ type: 'Heading', props: { id: 'x' } }], zones: {} } as unknown as PuckData
+    expect(() => renderToStaticMarkup(createElement(PageRenderer, { data: onlyUnknown }))).not.toThrow()
+  })
+
+  it('never renders a javascript: URL stored in a link href (stored-XSS guard)', () => {
+    // Page content is workspace-owner-authored but rendered to the PUBLIC with no
+    // login — a malicious/compromised href must not become an executable link on
+    // every visitor's browser, on every site that installs this package.
+    const maliciousPage = {
+      root: {},
+      content: [
+        { type: 'LandingHero', props: { id: 'h1', headline: 'x', subhead: 'y', primaryCta: { label: 'Go', href: "javascript:alert(document.cookie)" } } },
+        { type: 'SecondaryCTA', props: { id: 's1', headline: 'x', primaryCta: { label: 'Go', href: "javascript:alert(1)" } } },
+        { type: 'PricingSection', props: { id: 'p1', tiers: [{ name: 'Free', monthlyPrice: '$0', annualPrice: '$0', description: '', features: [], cta: 'Buy', ctaHref: "javascript:alert(1)" }] } },
+        { type: 'FooterSection', props: { id: 'f1', links: [{ label: 'Evil', href: "javascript:alert(1)" }], socials: [{ platform: 'twitter', href: "data:text/html,evil" }] } },
+      ],
+      zones: {},
+    } as unknown as PuckData
+    const html = renderToStaticMarkup(createElement(PageRenderer, { data: maliciousPage }))
+    expect(html).not.toContain('javascript:')
+    expect(html).not.toContain('data:text/html')
+  })
+})
+
+describe('fetchPage', () => {
+  it('returns the Puck data for a published page', async () => {
+    const envelope = { outcome: 'result', result: { ok: true, slug: 'tony', title: 'Beer', data: beerPage, url: '/p/beer' } }
+    const data = await fetchPage('tony', 'beer', { fetchImpl: mockFetch(envelope) })
+    expect(data).not.toBeNull()
+    expect((data as PuckData).content[0].type).toBe('LandingHero')
+  })
+
+  it('never returns a draft page (server filters via status=published)', async () => {
+    const envelope = { outcome: 'result', result: { ok: false, error: 'not_found' } }
+    const data = await fetchPage('tony', 'secret-draft', { fetchImpl: mockFetch(envelope) })
+    expect(data).toBeNull()
+  })
+})

package/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "extends": "../tsconfig.base.json",
+  "include": ["src"]
+}

package/vitest.config.ts

@@ -0,0 +1,5 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  esbuild: { jsx: 'automatic', jsxImportSource: 'react' },
+})

package/LICENSE

@@ -1,86 +0,0 @@
-# ONE License (Version 1.0)
-
-Copyright (c) 2024-2026 one.ie
-
-## Maximum Freedom, One Obligation
-
-This license empowers you with complete commercial freedom to use, reuse, modify, sell and resell the software, AI and data, at any price you wish.
-
-No usage limits. No royalty fees. Just pure, unrestricted ability to innovate and profit from the software.
-
-You are free to run ONE locally, on your own servers, in the cloud and at the edge.
-
-## You Receive
-
-### Unlimited Rights
-
-You have unrestricted rights to use, modify, license, sublicense, distribute, sell, resell and monetize the Software without restrictions, subject only to the Brand Requirement below.
-
-### Permitted Actions
-
-Including, but not limited to:
-
-- Commercial use and integration into any systems
-- Creation and sale of derivative works
-- Providing software as a service
-- AI training and content generation
-- Patenting innovations based on the Software
-- Open source applications and integrations
-
-### License Compatibility
-
-This license is compatible with all major open-source licenses, including:
-
-- MIT License
-- Apache License
-- GNU General Public License (GPL)
-- BSD Licenses
-- Mozilla Public License
-
-### Perpetual Rights
-
-These rights are granted in perpetuity and are irrevocable, provided the Brand Requirement is maintained.
-
-## Intellectual Property
-
-- We retain ownership of the original Software and data.
-- You own any modifications you make.
-- You never have to share your code or data.
-
-## Brand Requirement
-
-The only obligation is:
-
-- Don't remove the ONE brand, logo, and link to https://one.ie/ from the deployed product.
-
-To remove the Brand Requirement — white-label, no visible ONE branding — obtain the
-**ONE Enterprise License** (see `LICENSE-ENTERPRISE.md` or contact agent@one.ie).
-
-## Liability and Warranty
-
-The Software and data is provided "AS IS". We bear no liability for its use.
-
-## Termination
-
-This license terminates if you remove or hide the ONE brand, logo, or link without
-holding a current ONE Enterprise License.
-
-## Governing Law and Disputes
-
-This license is governed by the laws of Ireland. The parties will attempt to resolve disputes through good-faith negotiation. If necessary, disputes will proceed to mediation under the Mediators' Institute of Ireland rules, and then to binding arbitration under the Arbitration Act 2010, seated in Dublin, conducted in English.
-
----
-
-This license is designed to maximize freedom to innovate and profit. There is no copyleft requirement to share any code, making it suitable for enterprise use.
-
-## Enterprise Solutions
-
-Building something big? We're here to help:
-
-- **Free** — use every feature with the ONE brand link in the footer
-- **White-label** — remove the brand requirement (ONE Enterprise License)
-- **Custom** — white-label solutions tailored to your needs
-- **Enterprise** — full support and deployment assistance
-- **Training** — help getting your team started
-
-Contact agent@one.ie to share your needs · Learn at https://one.ie/learn · Agents: https://one.ie/llms.txt