@prairielearn/flash 1.0.5 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @prairielearn/flash
 
+## 1.1.0
+
+### Minor Changes
+
+- 0f5ef9c18: Add support for html-safe flash messages
+
+## 1.0.6
+
+### Patch Changes
+
+- bd0053577: Upgrade all dependencies
+
 ## 1.0.5
 
 ### Patch Changes

package/README.md

@@ -34,7 +34,7 @@ app.get('/set-flash', (req, res) => {
   flash('notice', 'Your preferences have been updated.');
   flash('success', 'Course created successfully.');
   flash('warning', 'Syncing completed with 5 warnings.');
-  flash('error', 'Group must have fewer than 10 members.');
+  flash('error', html`Group must have <em>fewer than 10 members</em>.`);
 
   res.redirect('/display-flash');
 });
@@ -47,7 +47,7 @@ app.get('/display-flash', (req, res) => {
 
 The `flash()` function has three behaviors:
 
-- `flash(type: string, message: string)`: Set a message with the given type.
+- `flash(type: string, message: string | HtmlSafeString)`: Set a message with the given type.
 - `flash(type: string): FlashMessage[]`: Get all messages with the given type.
 - `flash(types: string[]): FlashMessage[]`: Get all messages with any of the given types.
 - `flash(): FlashMessage[]`: Get all messages.

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
+import { HtmlSafeString } from '@prairielearn/html';
 export type FlashMessageType = 'notice' | 'success' | 'warning' | 'error';
 export interface FlashMessage {
     type: FlashMessageType;
@@ -6,4 +7,4 @@ export interface FlashMessage {
 }
 export declare function flashMiddleware(): (req: Request, _res: Response, next: NextFunction) => void;
 export declare function flash(type?: FlashMessageType | FlashMessageType[]): FlashMessage[];
-export declare function flash(type: FlashMessageType, message: string): void;
+export declare function flash(type: FlashMessageType, message: string | HtmlSafeString): void;

package/dist/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flash = exports.flashMiddleware = void 0;
 const node_async_hooks_1 = require("node:async_hooks");
+const html_1 = require("@prairielearn/html");
 const als = new node_async_hooks_1.AsyncLocalStorage();
 function flashMiddleware() {
     return (req, _res, next) => {
@@ -42,7 +43,7 @@ function makeFlashStorage(req) {
     return {
         add(type, message) {
             session.flash ??= [];
-            session.flash.push({ type, message });
+            session.flash.push({ type, message: (0, html_1.html) `${message}`.toString() });
         },
         get(type) {
             const messages = session.flash ?? [];

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uDAAqD;AAGrD,MAAM,GAAG,GAAG,IAAI,oCAAiB,EAAgB,CAAC;AASlD,SAAgB,eAAe;IAC7B,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AALD,0CAKC;AAID,SAAgB,KAAK,CAAC,IAA4C,EAAE,OAAgB;IAClF,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,YAAY,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;KACjB;IAED,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE;QACnC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO;KACR;IAED,IAAI,IAAI,IAAI,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;KAChB;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;IACvC,YAAY,CAAC,QAAQ,EAAE,CAAC;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AA1BD,sBA0BC;AAUD,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;KACjE;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAc,CAAC;IAEnC,OAAO;QACL,GAAG,CAAC,IAAsB,EAAE,OAAe;YACzC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,IAAsB;YACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM;YACJ,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAsB;YAC1B,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAChG,CAAC;QACD,QAAQ;YACN,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;QACrB,CAAC;KACqB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uDAAqD;AAErD,6CAA0D;AAE1D,MAAM,GAAG,GAAG,IAAI,oCAAiB,EAAgB,CAAC;AASlD,SAAgB,eAAe;IAC7B,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AALD,0CAKC;AAID,SAAgB,KAAK,CACnB,IAA4C,EAC5C,OAAiC;IAEjC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,YAAY,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;KACjB;IAED,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE;QACnC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO;KACR;IAED,IAAI,IAAI,IAAI,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;KAChB;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;IACvC,YAAY,CAAC,QAAQ,EAAE,CAAC;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AA7BD,sBA6BC;AAUD,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;KACjE;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAc,CAAC;IAEnC,OAAO;QACL,GAAG,CAAC,IAAsB,EAAE,OAAgC;YAC1D,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAA,WAAI,EAAA,GAAG,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,IAAsB;YACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM;YACJ,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAsB;YAC1B,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAChG,CAAC;QACD,QAAQ;YACN,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;QACrB,CAAC;KACqB,CAAC;AAC3B,CAAC"}

package/dist/index.test.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
 const index_1 = require("./index");
+const html_1 = require("@prairielearn/html");
 describe('flash', () => {
     it('throws an error if no session present', () => {
         chai_1.assert.throw(() => {
@@ -12,8 +13,11 @@ describe('flash', () => {
         chai_1.assert.throw(() => {
             (0, index_1.flash)('notice', 'Hello world');
         });
+        chai_1.assert.throw(() => {
+            (0, index_1.flash)('notice', (0, html_1.html) `<p>hello ${'&'} world</p>`);
+        });
     });
-    it('adds a flash', () => {
+    it('adds a flash using string message', () => {
         const req = {
             session: {},
         };
@@ -23,6 +27,28 @@ describe('flash', () => {
             chai_1.assert.sameDeepMembers((0, index_1.flash)(), [{ type: 'notice', message: 'hello world' }]);
         });
     });
+    it('adds a flash and escapes unsafe HTML', () => {
+        const req = {
+            session: {},
+        };
+        const res = {};
+        (0, index_1.flashMiddleware)()(req, res, () => {
+            (0, index_1.flash)('notice', '<b>hello world</b>');
+            chai_1.assert.sameDeepMembers((0, index_1.flash)(), [
+                { type: 'notice', message: '&lt;b&gt;hello world&lt;/b&gt;' },
+            ]);
+        });
+    });
+    it('adds a flash with HTML-safe message', () => {
+        const req = {
+            session: {},
+        };
+        const res = {};
+        (0, index_1.flashMiddleware)()(req, res, () => {
+            (0, index_1.flash)('notice', (0, html_1.html) `<p>hello ${'&'} world</p>`);
+            chai_1.assert.sameDeepMembers((0, index_1.flash)(), [{ type: 'notice', message: '<p>hello &amp; world</p>' }]);
+        });
+    });
     it('stores multiples flashes with the same type', () => {
         const req = {
             session: {},
@@ -30,10 +56,12 @@ describe('flash', () => {
         const res = {};
         (0, index_1.flashMiddleware)()(req, res, () => {
             (0, index_1.flash)('notice', 'hello world');
-            (0, index_1.flash)('notice', 'goodbye world');
+            (0, index_1.flash)('notice', '<< goodbye world');
+            (0, index_1.flash)('notice', (0, html_1.html) `<p>hello ${'&'} world</p>`);
             chai_1.assert.sameDeepMembers((0, index_1.flash)(), [
                 { type: 'notice', message: 'hello world' },
-                { type: 'notice', message: 'goodbye world' },
+                { type: 'notice', message: '&lt;&lt; goodbye world' },
+                { type: 'notice', message: '<p>hello &amp; world</p>' },
             ]);
         });
     });
@@ -44,9 +72,15 @@ describe('flash', () => {
         const res = {};
         (0, index_1.flashMiddleware)()(req, res, () => {
             (0, index_1.flash)('notice', 'hello world');
-            (0, index_1.flash)('error', 'goodbye world');
+            (0, index_1.flash)('error', '<< goodbye world');
+            (0, index_1.flash)('success', (0, html_1.html) `<p>hello ${'&'} world</p>`);
             chai_1.assert.sameDeepMembers((0, index_1.flash)('notice'), [{ type: 'notice', message: 'hello world' }]);
-            chai_1.assert.sameDeepMembers((0, index_1.flash)('error'), [{ type: 'error', message: 'goodbye world' }]);
+            chai_1.assert.sameDeepMembers((0, index_1.flash)('error'), [
+                { type: 'error', message: '&lt;&lt; goodbye world' },
+            ]);
+            chai_1.assert.sameDeepMembers((0, index_1.flash)('success'), [
+                { type: 'success', message: '<p>hello &amp; world</p>' },
+            ]);
         });
     });
     it('returns all flashes', () => {
@@ -56,10 +90,12 @@ describe('flash', () => {
         const res = {};
         (0, index_1.flashMiddleware)()(req, res, () => {
             (0, index_1.flash)('notice', 'hello world');
-            (0, index_1.flash)('error', 'goodbye world');
+            (0, index_1.flash)('error', '<< goodbye world');
+            (0, index_1.flash)('success', (0, html_1.html) `<p>hello ${'&'} world</p>`);
             chai_1.assert.sameDeepMembers((0, index_1.flash)(), [
                 { type: 'notice', message: 'hello world' },
-                { type: 'error', message: 'goodbye world' },
+                { type: 'error', message: '&lt;&lt; goodbye world' },
+                { type: 'success', message: '<p>hello &amp; world</p>' },
             ]);
         });
     });
@@ -70,11 +106,18 @@ describe('flash', () => {
         const res = {};
         (0, index_1.flashMiddleware)()(req, res, () => {
             (0, index_1.flash)('notice', 'hello world');
-            (0, index_1.flash)('error', 'goodbye world');
+            (0, index_1.flash)('error', '<< goodbye world');
+            (0, index_1.flash)('success', (0, html_1.html) `<p>hello ${'&'} world</p>`);
             chai_1.assert.sameDeepMembers((0, index_1.flash)('notice'), [{ type: 'notice', message: 'hello world' }]);
-            chai_1.assert.sameDeepMembers((0, index_1.flash)('error'), [{ type: 'error', message: 'goodbye world' }]);
+            chai_1.assert.sameDeepMembers((0, index_1.flash)('error'), [
+                { type: 'error', message: '&lt;&lt; goodbye world' },
+            ]);
+            chai_1.assert.sameDeepMembers((0, index_1.flash)('success'), [
+                { type: 'success', message: '<p>hello &amp; world</p>' },
+            ]);
             chai_1.assert.deepEqual((0, index_1.flash)('notice'), []);
             chai_1.assert.deepEqual((0, index_1.flash)('error'), []);
+            chai_1.assert.deepEqual((0, index_1.flash)('success'), []);
             chai_1.assert.isEmpty((0, index_1.flash)());
         });
     });

package/dist/index.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAE9B,mCAAiD;AAEjD,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,aAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,IAAA,uBAAe,GAAE,CAAC,EAAS,EAAE,EAAS,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,aAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAE/B,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YAEjC,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAEhC,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACtF,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAEhC,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAEhC,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACtF,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;YAEtF,aAAM,CAAC,SAAS,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,aAAM,CAAC,SAAS,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,aAAM,CAAC,OAAO,CAAC,IAAA,aAAK,GAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAE9B,mCAAiD;AACjD,6CAA0C;AAE1C,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,aAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,IAAA,uBAAe,GAAE,CAAC,EAAS,EAAE,EAAS,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,aAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,aAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,IAAA,aAAK,EAAC,QAAQ,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAE/B,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;YAEtC,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;YAEjD,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YACpC,IAAA,aAAK,EAAC,QAAQ,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;YAEjD,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE;gBACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAE;aACxD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACnC,IAAA,aAAK,EAAC,SAAS,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;YAElD,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACtF,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE;gBACrC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE;aACrD,CAAC,CAAC;YACH,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,SAAS,CAAC,EAAE;gBACvC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE;aACzD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACnC,IAAA,aAAK,EAAC,SAAS,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;YAElD,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,GAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE;gBACpD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE;aACzD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE;SACL,CAAC;QACT,MAAM,GAAG,GAAG,EAAS,CAAC;QAEtB,IAAA,uBAAe,GAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC/B,IAAA,aAAK,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/B,IAAA,aAAK,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACnC,IAAA,aAAK,EAAC,SAAS,EAAE,IAAA,WAAI,EAAA,YAAY,GAAG,YAAY,CAAC,CAAC;YAElD,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACtF,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE;gBACrC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE;aACrD,CAAC,CAAC;YACH,aAAM,CAAC,eAAe,CAAC,IAAA,aAAK,EAAC,SAAS,CAAC,EAAE;gBACvC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE;aACzD,CAAC,CAAC;YAEH,aAAM,CAAC,SAAS,CAAC,IAAA,aAAK,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,aAAM,CAAC,SAAS,CAAC,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,aAAM,CAAC,SAAS,CAAC,IAAA,aAAK,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,aAAM,CAAC,OAAO,CAAC,IAAA,aAAK,GAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prairielearn/flash",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "main": "dist/index.js",
   "repository": {
     "type": "git",
@@ -12,11 +12,14 @@
     "dev": "tsc --watch --preserveWatchOutput",
     "test": "mocha --no-config --require ts-node/register src/index.test.ts"
   },
+  "dependencies": {
+    "@prairielearn/html": "^3.0.8"
+  },
   "devDependencies": {
     "@prairielearn/tsconfig": "^0.0.0",
-    "@types/express": "^4.17.17",
-    "@types/express-session": "^1.17.7",
-    "@types/node": "^18.17.14",
+    "@types/express": "^4.17.18",
+    "@types/express-session": "^1.17.8",
+    "@types/node": "^18.18.2",
     "mocha": "^10.2.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.2.2"

package/src/index.test.ts

@@ -1,6 +1,7 @@
 import { assert } from 'chai';
 
 import { flashMiddleware, flash } from './index';
+import { html } from '@prairielearn/html';
 
 describe('flash', () => {
   it('throws an error if no session present', () => {
@@ -13,9 +14,12 @@ describe('flash', () => {
     assert.throw(() => {
       flash('notice', 'Hello world');
     });
+    assert.throw(() => {
+      flash('notice', html`<p>hello ${'&'} world</p>`);
+    });
   });
 
-  it('adds a flash', () => {
+  it('adds a flash using string message', () => {
     const req = {
       session: {},
     } as any;
@@ -28,6 +32,34 @@ describe('flash', () => {
     });
   });
 
+  it('adds a flash and escapes unsafe HTML', () => {
+    const req = {
+      session: {},
+    } as any;
+    const res = {} as any;
+
+    flashMiddleware()(req, res, () => {
+      flash('notice', '<b>hello world</b>');
+
+      assert.sameDeepMembers(flash(), [
+        { type: 'notice', message: '&lt;b&gt;hello world&lt;/b&gt;' },
+      ]);
+    });
+  });
+
+  it('adds a flash with HTML-safe message', () => {
+    const req = {
+      session: {},
+    } as any;
+    const res = {} as any;
+
+    flashMiddleware()(req, res, () => {
+      flash('notice', html`<p>hello ${'&'} world</p>`);
+
+      assert.sameDeepMembers(flash(), [{ type: 'notice', message: '<p>hello &amp; world</p>' }]);
+    });
+  });
+
   it('stores multiples flashes with the same type', () => {
     const req = {
       session: {},
@@ -36,11 +68,13 @@ describe('flash', () => {
 
     flashMiddleware()(req, res, () => {
       flash('notice', 'hello world');
-      flash('notice', 'goodbye world');
+      flash('notice', '<< goodbye world');
+      flash('notice', html`<p>hello ${'&'} world</p>`);
 
       assert.sameDeepMembers(flash(), [
         { type: 'notice', message: 'hello world' },
-        { type: 'notice', message: 'goodbye world' },
+        { type: 'notice', message: '&lt;&lt; goodbye world' },
+        { type: 'notice', message: '<p>hello &amp; world</p>' },
       ]);
     });
   });
@@ -53,10 +87,16 @@ describe('flash', () => {
 
     flashMiddleware()(req, res, () => {
       flash('notice', 'hello world');
-      flash('error', 'goodbye world');
+      flash('error', '<< goodbye world');
+      flash('success', html`<p>hello ${'&'} world</p>`);
 
       assert.sameDeepMembers(flash('notice'), [{ type: 'notice', message: 'hello world' }]);
-      assert.sameDeepMembers(flash('error'), [{ type: 'error', message: 'goodbye world' }]);
+      assert.sameDeepMembers(flash('error'), [
+        { type: 'error', message: '&lt;&lt; goodbye world' },
+      ]);
+      assert.sameDeepMembers(flash('success'), [
+        { type: 'success', message: '<p>hello &amp; world</p>' },
+      ]);
     });
   });
 
@@ -68,11 +108,13 @@ describe('flash', () => {
 
     flashMiddleware()(req, res, () => {
       flash('notice', 'hello world');
-      flash('error', 'goodbye world');
+      flash('error', '<< goodbye world');
+      flash('success', html`<p>hello ${'&'} world</p>`);
 
       assert.sameDeepMembers(flash(), [
         { type: 'notice', message: 'hello world' },
-        { type: 'error', message: 'goodbye world' },
+        { type: 'error', message: '&lt;&lt; goodbye world' },
+        { type: 'success', message: '<p>hello &amp; world</p>' },
       ]);
     });
   });
@@ -85,13 +127,20 @@ describe('flash', () => {
 
     flashMiddleware()(req, res, () => {
       flash('notice', 'hello world');
-      flash('error', 'goodbye world');
+      flash('error', '<< goodbye world');
+      flash('success', html`<p>hello ${'&'} world</p>`);
 
       assert.sameDeepMembers(flash('notice'), [{ type: 'notice', message: 'hello world' }]);
-      assert.sameDeepMembers(flash('error'), [{ type: 'error', message: 'goodbye world' }]);
+      assert.sameDeepMembers(flash('error'), [
+        { type: 'error', message: '&lt;&lt; goodbye world' },
+      ]);
+      assert.sameDeepMembers(flash('success'), [
+        { type: 'success', message: '<p>hello &amp; world</p>' },
+      ]);
 
       assert.deepEqual(flash('notice'), []);
       assert.deepEqual(flash('error'), []);
+      assert.deepEqual(flash('success'), []);
       assert.isEmpty(flash());
     });
   });

package/src/index.ts

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { Request, Response, NextFunction } from 'express';
+import { HtmlSafeString, html } from '@prairielearn/html';
 
 const als = new AsyncLocalStorage<FlashStorage>();
 
@@ -18,8 +19,11 @@ export function flashMiddleware() {
 }
 
 export function flash(type?: FlashMessageType | FlashMessageType[]): FlashMessage[];
-export function flash(type: FlashMessageType, message: string): void;
-export function flash(type?: FlashMessageType | FlashMessageType[], message?: string) {
+export function flash(type: FlashMessageType, message: string | HtmlSafeString): void;
+export function flash(
+  type?: FlashMessageType | FlashMessageType[],
+  message?: string | HtmlSafeString,
+) {
   const flashStorage = als.getStore();
   if (!flashStorage) {
     throw new Error('flash() must be called within a request');
@@ -48,7 +52,7 @@ export function flash(type?: FlashMessageType | FlashMessageType[], message?: st
 }
 
 interface FlashStorage {
-  add(type: FlashMessageType, message: string): void;
+  add(type: FlashMessageType, message: string | HtmlSafeString): void;
   get(type: FlashMessageType): FlashMessage[] | null;
   getAll(): FlashMessage[];
   clear(type: FlashMessageType): void;
@@ -63,9 +67,9 @@ function makeFlashStorage(req: Request): FlashStorage {
   const session = req.session as any;
 
   return {
-    add(type: FlashMessageType, message: string) {
+    add(type: FlashMessageType, message: string | HtmlSafeString) {
       session.flash ??= [];
-      session.flash.push({ type, message });
+      session.flash.push({ type, message: html`${message}`.toString() });
     },
     get(type: FlashMessageType) {
       const messages = session.flash ?? [];