@projektemacher/storymapjs 0.10.8 → 0.11.0

package/src/storymap/content-state.ts

@@ -1,3 +1,5 @@
+import { asRecord, isHttpUrl } from "./iiif-shared";
+
 /**
  * IIIF Content State 1.0 — the `iiif-content` initialization parameter.
  *
@@ -21,8 +23,6 @@
  * This module reads all four forms and writes the simplest one that can carry
  * the state, which is the Target URI for a whole canvas and the Target Body for
  * a region.
- *
- * See docs/plans/iiif-interop.md §5.1.
  */
 
 /** The initialization parameter the spec names. */
@@ -63,11 +63,6 @@ export function decodeContentState(encoded: string): string {
     return decodeURIComponent(atob(base64url.replace(/-/g, "+").replace(/_/g, "/")));
 }
 
-function asRecord(value: unknown): Json | null {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-    return value as Json;
-}
-
 /** `[x, y, w, h]` from an `xywh=` / `xywh=pixel:` fragment, or null. */
 function regionFromFragment(id: string): [string, [number, number, number, number]] | null {
     const at = id.indexOf("#");
@@ -136,7 +131,7 @@ export function parseContentState(value: string | null | undefined): ContentStat
         return stateFromJson(trimmed);
     }
 
-    if (/^https?:\/\//i.test(trimmed)) {
+    if (isHttpUrl(trimmed)) {
         // 2.2.2 or 2.2.4: a plain URI, never encoded. It is either the target
         // itself or a content state Annotation we would have to dereference,
         // and dereferencing is the host's call, not ours.

package/src/storymap/font-css.ts

@@ -0,0 +1,72 @@
+/**
+ * Font-theme stylesheet resolution.
+ *
+ * Pure functions (no viewer state), extracted from `StoryMap.ts` so the
+ * 2000-line viewer file does not also own URL policy. Both are re-exported
+ * from `./StoryMap`, so existing import paths keep working.
+ */
+
+/**
+ * The configured theme source, or null when the host bundles the theme
+ * itself (`font_css: false`, or `"none"` for JSON-friendliness): the viewer
+ * injects no stylesheet in that case. Empty/absent falls back to
+ * `"stock:default"`, as before.
+ */
+export function fontCssOriginal(configured: string | false | undefined | null): string | null {
+    if (configured === false || configured === "none") return null;
+    return configured || "stock:default";
+}
+
+/**
+ * Resolve a `font_css` value to an absolute stylesheet URL, or null when
+ * there is no theme stylesheet to inject (`font_css: false` / `"none"`).
+ *
+ * - `stock:<name>` resolves against the library location.
+ * - Absolute URLs pass through untouched.
+ * - Anything else resolves against the page URL, so hosts can reference
+ *   themes vendored into their own public dir (e.g. "fonts/font.css").
+ */
+export function resolveFontCssUrl(font: string | false): string | null {
+    // the theme ships in the host bundle: nothing for the viewer to inject
+    if (font === false || font === "none") return null;
+    if (font.startsWith("stock:")) {
+        const font_name = font.split(":")[1] || "default";
+        // A crafted name ("stock:../../secret") would otherwise resolve to an
+        // arbitrary same-origin file next to the bundle, because the name is
+        // concatenated into a URL path. Only accept a bare theme name.
+        if (!/^[a-z0-9-]+$/i.test(font_name)) {
+            console.warn(
+                "StoryMapJS: ignoring font_css with an invalid stock theme name",
+                font_name,
+            );
+            return new URL(/* @vite-ignore */ "../css/fonts/font.default.css", import.meta.url)
+                .href;
+        }
+        // resolved against the library location: one directory up from
+        // src/main.ts (dev) and js/storymap.js (build) in both cases
+        return new URL("../css/fonts/font." + font_name + ".css", import.meta.url).href;
+    }
+    // Absolute URL, protocol-relative, or a data: URL. Note this must be a
+    // real URL test, not a `/^(http|https|\/\/)/` prefix check: the old prefix
+    // test false-positived on a relative path that merely *starts* with those
+    // letters (e.g. "httpfonts.css"), which raised a spurious consent prompt
+    // for a same-origin file.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(font) || font.startsWith("//")) {
+        return font;
+    }
+    return new URL(font, document.baseURI).href;
+}
+
+/** True when `url` points off-origin (or at a data: URL) and needs a consent ask. */
+export function isExternalUrl(url: string): boolean {
+    // data:/blob: are not off-origin but are not a theme stylesheet either
+    if (/^(data|blob):/i.test(url)) {
+        return true;
+    }
+    try {
+        return new URL(url, document.baseURI).origin !== window.location.origin;
+    } catch {
+        // unparseable: treat as external, so we err towards asking
+        return true;
+    }
+}