@open-mercato/shared 0.9.1-develop.7566.1.b9de0a5eb7 → 0.9.1-develop.7572.1.e9bdaac5f1

package/.turbo/turbo-build.log

@@ -1,3 +1,3 @@
 [generate-countries] up to date (259 countries)
-[build:shared] found 319 entry points
+[build:shared] found 320 entry points
 [build:shared] built successfully

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.9.1-develop.7566.1.b9de0a5eb7";
+const APP_VERSION = "0.9.1-develop.7572.1.e9bdaac5f1";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.9.1-develop.7566.1.b9de0a5eb7';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.9.1-develop.7572.1.e9bdaac5f1';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/notifications/safeHref.js

@@ -0,0 +1,20 @@
+const SENTINEL_ORIGIN = "https://notifications.open-mercato.local";
+const CONTROL_OR_BACKSLASH = /[\u0000-\u001F\u007F\\]/;
+function isSafeNotificationHref(href) {
+  if (!href.startsWith("/") || href.startsWith("//")) {
+    return false;
+  }
+  if (CONTROL_OR_BACKSLASH.test(href)) {
+    return false;
+  }
+  try {
+    const parsed = new URL(href, SENTINEL_ORIGIN);
+    return parsed.origin === SENTINEL_ORIGIN && !parsed.pathname.startsWith("//");
+  } catch {
+    return false;
+  }
+}
+export {
+  isSafeNotificationHref
+};
+//# sourceMappingURL=safeHref.js.map

package/dist/modules/notifications/safeHref.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/notifications/safeHref.ts"],
+  "sourcesContent": ["const SENTINEL_ORIGIN = 'https://notifications.open-mercato.local'\nconst CONTROL_OR_BACKSLASH = /[\\u0000-\\u001F\\u007F\\\\]/\n\nexport function isSafeNotificationHref(href: string): boolean {\n  if (!href.startsWith('/') || href.startsWith('//')) {\n    return false\n  }\n\n  if (CONTROL_OR_BACKSLASH.test(href)) {\n    return false\n  }\n\n  try {\n    const parsed = new URL(href, SENTINEL_ORIGIN)\n    return parsed.origin === SENTINEL_ORIGIN && !parsed.pathname.startsWith('//')\n  } catch {\n    return false\n  }\n}\n"],
+  "mappings": "AAAA,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;AAEtB,SAAS,uBAAuB,MAAuB;AAC5D,MAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,GAAG;AAClD,WAAO;AAAA,EACT;AAEA,MAAI,qBAAqB,KAAK,IAAI,GAAG;AACnC,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,MAAM,eAAe;AAC5C,WAAO,OAAO,WAAW,mBAAmB,CAAC,OAAO,SAAS,WAAW,IAAI;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.9.1-develop.7566.1.b9de0a5eb7",
+  "version": "0.9.1-develop.7572.1.e9bdaac5f1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -121,7 +121,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.9.1-develop.7566.1.b9de0a5eb7",
+    "@open-mercato/cache": "0.9.1-develop.7572.1.e9bdaac5f1",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/modules/notifications/safeHref.ts

@@ -0,0 +1,19 @@
+const SENTINEL_ORIGIN = 'https://notifications.open-mercato.local'
+const CONTROL_OR_BACKSLASH = /[\u0000-\u001F\u007F\\]/
+
+export function isSafeNotificationHref(href: string): boolean {
+  if (!href.startsWith('/') || href.startsWith('//')) {
+    return false
+  }
+
+  if (CONTROL_OR_BACKSLASH.test(href)) {
+    return false
+  }
+
+  try {
+    const parsed = new URL(href, SENTINEL_ORIGIN)
+    return parsed.origin === SENTINEL_ORIGIN && !parsed.pathname.startsWith('//')
+  } catch {
+    return false
+  }
+}