@quazardous/qdadm 2.31.0 → 2.33.0

package/src/tasks/useTaskRunner.ts

@@ -0,0 +1,52 @@
+/**
+ * useTaskRunner - start a long backend task and follow it (#4114)
+ *
+ * ```ts
+ * const tasks = useTaskRunner()
+ * tasks.run({
+ *   label: `Create box ${name}`,
+ *   start: () => api.post('/boxes', { name }).then((r) => r.data),   // → { task_id }
+ *   task: { entity: 'tasks' },                                     // follow the task record
+ *   log: (id) => ({ poll: (from) => api.get(`/tasks/${id}/log`, { params: { from } }).then((r) => r.data) }),
+ *   cancel: (id) => api.post(`/tasks/${id}/cancel`),
+ *   to: (id) => ({ name: 'task-show', params: { id } }),
+ * })
+ *
+ * // As a row action, with a typed confirmation
+ * list.addAction('destroy', {
+ *   icon: 'pi pi-trash', severity: 'danger',
+ *   onClick: taskAction((box) => ({
+ *     label: `Destroy ${box.name}`, kind: 'destroy-box',
+ *     start: () => api.delete(`/boxes/${box.id}`).then((r) => r.data),
+ *     confirm: { typed: box.name, message: 'The box and its database are deleted.' },
+ *   })),
+ * })
+ * ```
+ */
+
+import { inject } from 'vue'
+import { getTaskStore, type RunOptions, type TaskRun } from './taskStore'
+
+export function useTaskRunner() {
+  const store = getTaskStore()
+  store.attach({
+    orchestrator: inject('qdadmOrchestrator', null),
+    signals: inject('qdadmSignals', null),
+  })
+  return {
+    run: store.run,
+    cancel: store.cancel,
+    dismiss: store.dismiss,
+    open: store.open,
+    runs: store.state.runs,
+    active: store.active,
+  }
+}
+
+/**
+ * An action handler that starts a task: `onClick: taskAction((row) => ({ label, start, ... }))`.
+ * Works for row actions, header actions, show-page actions and plain buttons.
+ */
+export function taskAction<A extends unknown[]>(build: (...args: A) => RunOptions): (...args: A) => Promise<TaskRun | null> {
+  return (...args: A) => getTaskStore().run(build(...args))
+}

package/src/utils/ansi.ts

@@ -0,0 +1,127 @@
+/**
+ * ANSI SGR parsing for log output (#4110).
+ *
+ * Only the Select Graphic Rendition sequences (`ESC [ … m`) carry meaning in
+ * a log: colours and weight. Every other escape (cursor moves, erase line,
+ * OSC titles) is dropped, since a tail has no cursor to move.
+ *
+ * The style carries from one line to the next, as in a terminal: a worker
+ * that prints `ESC[31m` and two lines later `ESC[0m` coloured both lines.
+ * So a stream is parsed in order, passing the state along.
+ */
+
+export interface AnsiStyle {
+  fg?: string
+  bg?: string
+  bold?: boolean
+  dim?: boolean
+  italic?: boolean
+  underline?: boolean
+  inverse?: boolean
+}
+
+export interface AnsiSegment {
+  text: string
+  style: AnsiStyle
+}
+
+/** xterm's default 16 colours: 0-7 normal, 8-15 bright. */
+const BASE_COLORS = [
+  '#000000', '#cd3131', '#0dbc79', '#e5e510', '#2472c8', '#bc3fbc', '#11a8cd', '#e5e5e5',
+  '#666666', '#f14c4c', '#23d18b', '#f5f543', '#3b8eea', '#d670d6', '#29b8db', '#ffffff',
+]
+
+function color256(n: number): string | undefined {
+  if (n < 0 || n > 255) return undefined
+  if (n < 16) return BASE_COLORS[n]
+  if (n < 232) {
+    const c = n - 16
+    const level = (v: number) => (v === 0 ? 0 : 55 + v * 40)
+    const r = level(Math.floor(c / 36))
+    const g = level(Math.floor(c / 6) % 6)
+    const b = level(c % 6)
+    return `rgb(${r}, ${g}, ${b})`
+  }
+  const grey = 8 + (n - 232) * 10
+  return `rgb(${grey}, ${grey}, ${grey})`
+}
+
+// eslint-disable-next-line no-control-regex
+const ESCAPE = /\x1b\[([0-9;:]*)([A-Za-z])|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g
+
+/** The text of a line without any escape sequence. */
+export function stripAnsi(text: string): string {
+  return text.replace(ESCAPE, '')
+}
+
+/** Apply one SGR parameter list to a style, returning the new style. */
+function applySgr(style: AnsiStyle, params: string): AnsiStyle {
+  const codes = params === '' ? [0] : params.split(/[;:]/).map((p) => (p === '' ? 0 : Number(p)))
+  let next: AnsiStyle = { ...style }
+  for (let i = 0; i < codes.length; i++) {
+    const code = codes[i]!
+    if (code === 0) next = {}
+    else if (code === 1) next.bold = true
+    else if (code === 2) next.dim = true
+    else if (code === 3) next.italic = true
+    else if (code === 4) next.underline = true
+    else if (code === 7) next.inverse = true
+    else if (code === 22) { delete next.bold; delete next.dim }
+    else if (code === 23) delete next.italic
+    else if (code === 24) delete next.underline
+    else if (code === 27) delete next.inverse
+    else if (code >= 30 && code <= 37) next.fg = BASE_COLORS[code - 30]
+    else if (code >= 90 && code <= 97) next.fg = BASE_COLORS[code - 90 + 8]
+    else if (code === 39) delete next.fg
+    else if (code >= 40 && code <= 47) next.bg = BASE_COLORS[code - 40]
+    else if (code >= 100 && code <= 107) next.bg = BASE_COLORS[code - 100 + 8]
+    else if (code === 49) delete next.bg
+    else if (code === 38 || code === 48) {
+      const key = code === 38 ? 'fg' : 'bg'
+      let value: string | undefined
+      if (codes[i + 1] === 5) {
+        value = color256(codes[i + 2] ?? -1)
+        i += 2
+      } else if (codes[i + 1] === 2) {
+        const [r, g, b] = [codes[i + 2], codes[i + 3], codes[i + 4]]
+        if ([r, g, b].every((v) => v !== undefined && v >= 0 && v <= 255)) value = `rgb(${r}, ${g}, ${b})`
+        i += 4
+      }
+      if (value) next[key] = value
+    }
+  }
+  return next
+}
+
+/**
+ * Split one line into styled segments, starting from `state` (the style the
+ * previous line ended in). Returns the segments and the style this line ends
+ * in, for the next one.
+ */
+export function parseAnsiLine(line: string, state: AnsiStyle = {}): { segments: AnsiSegment[]; state: AnsiStyle } {
+  const segments: AnsiSegment[] = []
+  let style = state
+  let last = 0
+  ESCAPE.lastIndex = 0
+  for (let m = ESCAPE.exec(line); m; m = ESCAPE.exec(line)) {
+    if (m.index > last) segments.push({ text: line.slice(last, m.index), style })
+    if (m[2] === 'm') style = applySgr(style, m[1] ?? '')
+    last = m.index + m[0].length
+  }
+  if (last < line.length) segments.push({ text: line.slice(last), style })
+  return { segments, state: style }
+}
+
+/** Inline CSS for a style; inverse swaps the colours it has. */
+export function ansiStyleToCss(style: AnsiStyle): Record<string, string> {
+  const css: Record<string, string> = {}
+  const fg = style.inverse ? style.bg ?? 'var(--qd-log-bg)' : style.fg
+  const bg = style.inverse ? style.fg ?? 'var(--qd-log-fg)' : style.bg
+  if (fg) css.color = fg
+  if (bg) css.backgroundColor = bg
+  if (style.bold) css.fontWeight = '700'
+  if (style.dim) css.opacity = '0.65'
+  if (style.italic) css.fontStyle = 'italic'
+  if (style.underline) css.textDecoration = 'underline'
+  return css
+}

package/src/utils/email.ts

@@ -0,0 +1,270 @@
+/**
+ * Email helpers for EmailPreview (#4113).
+ *
+ * A captured email is shown inside a sandboxed iframe: no scripts, no
+ * same-origin access, and a Content-Security-Policy that blocks every
+ * remote load (images included, until the user asks) — an email is
+ * untrusted HTML written by whoever sent it, and a remote image is a read
+ * receipt. Nothing here needs postal-mime; raw MIME parsing lives in
+ * `@quazardous/qdadm/email`.
+ */
+
+export interface EmailAddress {
+  name?: string | null
+  address?: string | null
+}
+
+export type EmailAddressInput = string | EmailAddress | Array<string | EmailAddress> | null | undefined
+
+export interface EmailAttachment {
+  filename?: string | null
+  contentType?: string | null
+  size?: number | null
+  /** Where to fetch it (absolute, or relative to the page). */
+  url?: string | null
+  /** Its bytes, or base64 text. */
+  content?: string | ArrayBuffer | Uint8Array | null
+  /** `cid:` references in the HTML point here. */
+  contentId?: string | null
+  disposition?: 'attachment' | 'inline' | null
+}
+
+export interface ParsedEmail {
+  from?: EmailAddressInput
+  to?: EmailAddressInput
+  cc?: EmailAddressInput
+  replyTo?: EmailAddressInput
+  subject?: string | null
+  date?: string | Date | null
+  messageId?: string | null
+  /** Every header, in order. */
+  headers?: Array<{ key: string; value: string }> | Record<string, string | string[]> | null
+  html?: string | null
+  text?: string | null
+  /** The raw MIME source, for the Source tab. */
+  raw?: string | null
+  attachments?: EmailAttachment[] | null
+}
+
+/** Parse a raw MIME message into a ParsedEmail; see `@quazardous/qdadm/email`. */
+export type EmailParser = (raw: string | ArrayBuffer | Uint8Array) => Promise<ParsedEmail>
+
+// --- Addresses ---
+
+export function addressList(input: EmailAddressInput): EmailAddress[] {
+  if (!input) return []
+  const list = Array.isArray(input) ? input : [input]
+  return list.map((a) => (typeof a === 'string' ? { address: a } : a))
+}
+
+export function formatAddress(a: EmailAddress): string {
+  if (a.name && a.address) return `${a.name} <${a.address}>`
+  return a.address ?? a.name ?? ''
+}
+
+export function formatAddresses(input: EmailAddressInput): string {
+  return addressList(input).map(formatAddress).join(', ')
+}
+
+// --- Headers ---
+
+export function headerList(email: ParsedEmail): Array<{ key: string; value: string }> {
+  const h = email.headers
+  if (!h) return []
+  if (Array.isArray(h)) return h
+  return Object.entries(h).flatMap(([key, v]) => (Array.isArray(v) ? v : [v]).map((value) => ({ key, value: String(value) })))
+}
+
+// --- Attachments ---
+
+function base64FromBytes(bytes: Uint8Array): string {
+  let bin = ''
+  for (let i = 0; i < bytes.length; i += 0x8000) bin += String.fromCharCode(...bytes.subarray(i, i + 0x8000))
+  return btoa(bin)
+}
+
+function toUint8(content: ArrayBuffer | Uint8Array): Uint8Array {
+  return ArrayBuffer.isView(content) ? new Uint8Array(content.buffer, content.byteOffset, content.byteLength) : new Uint8Array(content)
+}
+
+/** A URL for an attachment's bytes: its own URL, or a data URL of its content. */
+export function attachmentUrl(att: EmailAttachment): string | null {
+  if (att.url) return att.url
+  if (att.content === null || att.content === undefined) return null
+  const type = att.contentType || 'application/octet-stream'
+  const b64 = typeof att.content === 'string' ? att.content.replace(/\s+/g, '') : base64FromBytes(toUint8(att.content))
+  return `data:${type};base64,${b64}`
+}
+
+export function attachmentSize(att: EmailAttachment): number | null {
+  if (typeof att.size === 'number') return att.size
+  const c = att.content
+  if (!c) return null
+  if (typeof c === 'string') return Math.floor((c.replace(/\s+/g, '').length * 3) / 4)
+  return toUint8(c).byteLength
+}
+
+const stripCid = (id: string) => id.trim().replace(/^<|>$/g, '')
+
+// --- The HTML document ---
+
+/** Remote images an HTML part asks for (src, srcset, background, CSS url()). */
+export function countRemoteImages(html: string): number {
+  const matches = html.match(/\b(?:src|background)\s*=\s*["']?\s*(?:https?:)?\/\/|url\(\s*["']?\s*(?:https?:)?\/\//gi)
+  return matches?.length ?? 0
+}
+
+function originOf(url: string): string | null {
+  try {
+    return new URL(url, typeof location !== 'undefined' ? location.href : 'http://localhost/').origin
+  } catch {
+    return null
+  }
+}
+
+export interface EmailDocumentOptions {
+  attachments?: EmailAttachment[] | null
+  /** Let remote images load. */
+  allowRemoteImages?: boolean
+}
+
+/**
+ * The iframe's `srcdoc`: the email's HTML behind a CSP that only lets inline
+ * styles and data/cid images through, with `cid:` references pointing at
+ * their attachments and links opening in a new tab.
+ *
+ * The CSP is a `<meta>` placed first, so the parser puts it in the head
+ * before anything the email itself declares.
+ */
+export function emailDocument(html: string, options: EmailDocumentOptions = {}): string {
+  const imgSources = new Set(['data:'])
+  const byCid = new Map<string, string>()
+  for (const att of options.attachments ?? []) {
+    if (!att.contentId) continue
+    const url = attachmentUrl(att)
+    if (!url) continue
+    byCid.set(stripCid(att.contentId).toLowerCase(), url)
+    if (!url.startsWith('data:')) {
+      const origin = originOf(url)
+      if (origin) imgSources.add(origin)
+    }
+  }
+  if (options.allowRemoteImages) {
+    imgSources.add('https:')
+    imgSources.add('http:')
+  }
+  const resolve = (url: string) =>
+    url.startsWith('data:') ? url : new URL(url, typeof location !== 'undefined' ? location.href : 'http://localhost/').href
+  const withCids = html.replace(/cid:([^"'\s)>]+)/gi, (whole, id: string) => {
+    let key = id
+    try {
+      key = decodeURIComponent(id)
+    } catch {
+      // a stray % in the id: compare it as written
+    }
+    const url = byCid.get(stripCid(key).toLowerCase())
+    return url ? resolve(url) : whole
+  })
+  const csp = [
+    "default-src 'none'",
+    "style-src 'unsafe-inline'",
+    `img-src ${[...imgSources].join(' ')}`,
+    'font-src data:',
+    "form-action 'none'",
+  ].join('; ')
+  const head =
+    `<meta http-equiv="Content-Security-Policy" content="${csp}">` +
+    '<meta charset="utf-8"><base target="_blank">' +
+    '<style>html{color-scheme:light}body{margin:0;padding:12px;font-family:system-ui,sans-serif;background:#fff;color:#222}img{max-width:100%;height:auto}</style>'
+  return `<!doctype html>${head}${withoutLeaks(withCids)}`
+}
+
+/**
+ * What the CSP does not stop: a meta refresh navigates the frame itself to a
+ * remote page (the sandbox allows a frame to navigate itself), DNS prefetch /
+ * preconnect hints reach out before any policy applies, and a `<base>` would
+ * re-aim every relative link.
+ *
+ * Read with DOMParser, whose documents are inert (nothing runs, nothing
+ * loads): the browser decodes attributes the way the frame would, so
+ * `http-equiv="&#x72;efresh"` is caught too. A regex is the fallback where
+ * there is no DOM.
+ */
+function withoutLeaks(html: string): string {
+  if (typeof DOMParser === 'undefined') {
+    return html
+      .replace(/<meta\b[^>]*http-equiv[^>]*>/gi, '')
+      .replace(/<link\b[^>]*>/gi, '')
+      .replace(/<base\b[^>]*>/gi, '')
+  }
+  const doc = new DOMParser().parseFromString(html, 'text/html')
+  const HINTS = ['dns-prefetch', 'preconnect', 'prefetch', 'prerender', 'preload', 'modulepreload']
+  doc.querySelectorAll('meta[http-equiv], base').forEach((el) => el.remove())
+  doc.querySelectorAll('link').forEach((el) => {
+    const rel = (el.getAttribute('rel') ?? '').toLowerCase().split(/\s+/)
+    if (rel.some((r) => HINTS.includes(r)) || rel.includes('stylesheet') || rel.includes('import')) el.remove()
+  })
+  return doc.documentElement.outerHTML
+}
+
+/** The iframe sandbox: no scripts, an opaque origin, links may open a new tab. */
+export const EMAIL_SANDBOX = 'allow-popups allow-popups-to-escape-sandbox'
+
+// --- Mailpit ---
+
+interface MailpitAddress {
+  Name?: string
+  Address?: string
+}
+
+interface MailpitPart {
+  PartID: string
+  FileName?: string
+  ContentType?: string
+  ContentID?: string
+  Size?: number
+}
+
+export interface MailpitMessage {
+  ID: string
+  From?: MailpitAddress | null
+  To?: MailpitAddress[] | null
+  Cc?: MailpitAddress[] | null
+  ReplyTo?: MailpitAddress[] | null
+  Subject?: string
+  Date?: string
+  MessageID?: string
+  HTML?: string
+  Text?: string
+  Attachments?: MailpitPart[] | null
+  Inline?: MailpitPart[] | null
+}
+
+/**
+ * A Mailpit message (`GET /api/v1/message/{ID}`) as a ParsedEmail. Parts are
+ * fetched from `${baseUrl}/api/v1/message/{ID}/part/{PartID}`; headers come
+ * from `/headers`, and the source from `/raw`, if the app wants them.
+ */
+export function fromMailpit(message: MailpitMessage, baseUrl = ''): ParsedEmail {
+  const addr = (a?: MailpitAddress | null): EmailAddress => ({ name: a?.Name || null, address: a?.Address || null })
+  const part = (p: MailpitPart, disposition: 'attachment' | 'inline'): EmailAttachment => ({
+    filename: p.FileName ?? null,
+    contentType: p.ContentType ?? null,
+    size: p.Size ?? null,
+    contentId: p.ContentID ?? null,
+    url: `${baseUrl.replace(/\/$/, '')}/api/v1/message/${encodeURIComponent(message.ID)}/part/${encodeURIComponent(p.PartID)}`,
+    disposition,
+  })
+  return {
+    from: message.From ? addr(message.From) : null,
+    to: (message.To ?? []).map(addr),
+    cc: (message.Cc ?? []).map(addr),
+    replyTo: (message.ReplyTo ?? []).map(addr),
+    subject: message.Subject ?? null,
+    date: message.Date ?? null,
+    messageId: message.MessageID ?? null,
+    html: message.HTML ?? null,
+    text: message.Text ?? null,
+    attachments: [...(message.Attachments ?? []).map((p) => part(p, 'attachment')), ...(message.Inline ?? []).map((p) => part(p, 'inline'))],
+  }
+}

package/src/utils/index.ts

@@ -40,5 +40,37 @@ export {
   isEqual,
 } from './transformers'
 
+// ANSI escapes in logs (#4110)
+export { parseAnsiLine, stripAnsi, ansiStyleToCss, type AnsiStyle, type AnsiSegment } from './ansi'
+
+// Payloads in their own format (#4112)
+export {
+  detectFormat,
+  maskKeys,
+  prettyXml,
+  parseCsv,
+  parseForm,
+  diffLines,
+  diffCsv,
+  normalizeLines,
+  type PayloadFormat,
+  type PayloadBody,
+  type PayloadMask,
+  type DiffOp,
+} from './payload'
+
+// Captured emails (#4113); raw MIME parsing is in '@quazardous/qdadm/email'
+export {
+  emailDocument,
+  fromMailpit,
+  formatAddresses,
+  EMAIL_SANDBOX,
+  type ParsedEmail,
+  type EmailAddress,
+  type EmailAttachment,
+  type EmailParser,
+  type MailpitMessage,
+} from './email'
+
 // Type exports
 export type { KeyValuePair, LanguageObject } from './transformers'