@pptb/types 1.1.3-beta.2 → 1.2.0

package/lib/validate.js

@@ -7,7 +7,7 @@
  */
 
 /** @typedef {{ name: string; url?: string }} Contributor */
-/** @typedef {{ "connect-src"?: string[]; "script-src"?: string[]; "style-src"?: string[]; "img-src"?: string[]; "font-src"?: string[]; "frame-src"?: string[] }} CspExceptions */
+/** @typedef {{ "connect-src"?: string[]; "script-src"?: string[]; "style-src"?: string[]; "img-src"?: string[]; "font-src"?: string[]; "frame-src"?: string[]; "media-src"?: string[] }} CspExceptions */
 /** @typedef {{ repository?: string; website?: string; funding?: string; readmeUrl?: string }} Configurations */
 /** @typedef {{ multiConnection?: "required" | "optional" | "none"; minAPI?: string }} Features */
 /**
@@ -85,6 +85,16 @@ function validateIconPath(fieldName, iconPath, errors) {
         errors.push(`${fieldName} must be a relative path (e.g., 'icon.svg' or 'icons/icon.svg')`);
         return;
     }
+    // Reject Windows absolute paths like "C:\..." or "C:/"
+    if (/^[a-zA-Z]:/.test(iconPath)) {
+        errors.push(`${fieldName} must be a relative path (e.g., 'icon.svg' or 'icons/icon.svg')`);
+        return;
+    }
+    // Reject backslashes — icon paths must use forward slashes
+    if (iconPath.includes("\\")) {
+        errors.push(`${fieldName} must use forward slashes, not backslashes (e.g., 'icons/icon.svg')`);
+        return;
+    }
     if (iconPath.includes("..")) {
         errors.push(`${fieldName} cannot contain '..' (path traversal not allowed)`);
         return;
@@ -205,14 +215,14 @@ async function validatePackageJson(packageJson, options = {}) {
         }
 
         // Funding validation (optional but recommended)
-        if (!configs.funding) {
-            warnings.push("configurations.funding is not set; consider adding a sponsorship or funding URL to support contributors");
-        } else if (!isValidUrl(configs.funding)) {
-            warnings.push("configurations.funding has an invalid URL format");
-        } else if (!skipUrlChecks) {
-            const accessible = await isUrlAccessible(configs.funding);
-            if (!accessible) {
-                warnings.push("configurations.funding URL is not accessible");
+        if (configs.funding) {
+            if (!isValidUrl(configs.funding)) {
+                warnings.push("configurations.funding has an invalid URL format");
+            } else if (!skipUrlChecks) {
+                const accessible = await isUrlAccessible(configs.funding);
+                if (!accessible) {
+                    warnings.push("configurations.funding URL is not accessible");
+                }
             }
         }
 
@@ -233,45 +243,57 @@ async function validatePackageJson(packageJson, options = {}) {
 
     // CSP Exceptions validation (optional, but validated if present)
     if (packageJson.cspExceptions) {
-        const validCspDirectives = ["connect-src", "script-src", "style-src", "img-src", "font-src", "frame-src"];
+        const cspExceptions = packageJson.cspExceptions;
 
-        const hasAnyDirectives = Object.keys(packageJson.cspExceptions).length > 0;
-        if (!hasAnyDirectives) {
-            errors.push("cspExceptions cannot be empty. If CSP exceptions are not needed, remove the cspExceptions field");
-        }
+        if (typeof cspExceptions !== "object" || cspExceptions === null || Array.isArray(cspExceptions)) {
+            errors.push("cspExceptions must be an object mapping CSP directives to arrays of strings");
+        } else {
+            const validCspDirectives = ["connect-src", "script-src", "style-src", "img-src", "font-src", "frame-src", "media-src"];
 
-        Object.keys(packageJson.cspExceptions).forEach((directive) => {
-            if (!validCspDirectives.includes(directive)) {
-                warnings.push(`Unknown CSP directive: ${directive}`);
-            }
-            const values = packageJson.cspExceptions?.[/** @type {keyof CspExceptions} */ (directive)];
-            if (values && !Array.isArray(values)) {
-                errors.push(`CSP directive "${directive}" must be an array of strings`);
-            } else if (values && values.length === 0) {
-                errors.push(`CSP directive "${directive}" cannot be an empty array`);
+            const hasAnyDirectives = Object.keys(cspExceptions).length > 0;
+            if (!hasAnyDirectives) {
+                errors.push("cspExceptions cannot be empty. If CSP exceptions are not needed, remove the cspExceptions field");
             }
-        });
+
+            Object.keys(cspExceptions).forEach((directive) => {
+                if (!validCspDirectives.includes(directive)) {
+                    warnings.push(`Unknown CSP directive: ${directive}`);
+                }
+                const values = cspExceptions[/** @type {keyof CspExceptions} */ (directive)];
+                if (values && !Array.isArray(values)) {
+                    errors.push(`CSP directive "${directive}" must be an array of strings`);
+                } else if (values && values.length === 0) {
+                    errors.push(`CSP directive "${directive}" cannot be an empty array`);
+                }
+            });
+        }
     }
 
     // Features validation (optional, but validated if present)
-    if (packageJson.features) {
-        const VALID_FEATURE_KEYS = ["multiConnection", "minAPI"];
-        const featureKeys = Object.keys(packageJson.features);
-        const invalidKeys = featureKeys.filter((key) => !VALID_FEATURE_KEYS.includes(key));
-
-        if (invalidKeys.length > 0) {
-            errors.push(`features can only contain ${VALID_FEATURE_KEYS.map((k) => `'${k}'`).join(", ")} properties. Invalid properties: ${invalidKeys.join(", ")}`);
-        }
+    if (packageJson.features !== undefined) {
+        const features = packageJson.features;
+
+        if (features === null || typeof features !== "object" || Array.isArray(features)) {
+            errors.push("features must be a non-array object with optional 'multiConnection' and 'minAPI' properties");
+        } else {
+            const VALID_FEATURE_KEYS = ["multiConnection", "minAPI"];
+            const featureKeys = Object.keys(features);
+            const invalidKeys = featureKeys.filter((key) => !VALID_FEATURE_KEYS.includes(key));
+
+            if (invalidKeys.length > 0) {
+                errors.push(`features can only contain ${VALID_FEATURE_KEYS.map((k) => `'${k}'`).join(", ")} properties. Invalid properties: ${invalidKeys.join(", ")}`);
+            }
 
-        if (packageJson.features.multiConnection === undefined) {
-            errors.push("features.multiConnection is required when features object is provided");
-        } else if (!VALID_MULTI_CONNECTION_VALUES.includes(packageJson.features.multiConnection)) {
-            errors.push(`features.multiConnection must be one of: ${VALID_MULTI_CONNECTION_VALUES.join(", ")}`);
-        }
+            if (features.multiConnection === undefined) {
+                errors.push("features.multiConnection is required when features object is provided");
+            } else if (!VALID_MULTI_CONNECTION_VALUES.includes(features.multiConnection)) {
+                errors.push(`features.multiConnection must be one of: ${VALID_MULTI_CONNECTION_VALUES.join(", ")}`);
+            }
 
-        if (packageJson.features.minAPI !== undefined) {
-            if (typeof packageJson.features.minAPI !== "string" || !SEMVER_REGEX.test(packageJson.features.minAPI)) {
-                errors.push("features.minAPI must be a valid semantic version string (e.g., '1.0.0')");
+            if (features.minAPI !== undefined) {
+                if (typeof features.minAPI !== "string" || !SEMVER_REGEX.test(features.minAPI)) {
+                    errors.push("features.minAPI must be a valid semantic version string (e.g., '1.0.0')");
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pptb/types",
-  "version": "1.1.3-beta.2",
+  "version": "1.2.0",
   "description": "Type definitions for Power Platform ToolBox APIs and validity checks for tool packages",
   "main": "index.d.ts",
   "types": "index.d.ts",