@samva/vite 0.5.0 → 0.6.0

package/dist/editor/index.html

@@ -4,8 +4,8 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Samva editor</title>
-    <script type="module" crossorigin src="./assets/index-BZ-5-1V0.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-Cg4x6ewh.css">
+    <script type="module" crossorigin src="./assets/index-DWbrYu6R.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-CxXHDnD3.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/index.js

@@ -4,6 +4,7 @@ import { createEmailRenderer } from "./email.js";
 import { isTemplateDefinition, readEmailProject, renderEmailFixtures } from "./project.js";
 import { existsSync } from "node:fs";
 import { open, readFile, realpath, rename, rm, stat } from "node:fs/promises";
+import { isIP } from "node:net";
 import { extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { checkEmailCompatibility, emailSelections } from "@samva/markup/compiler";
@@ -109,13 +110,12 @@ var EditorFileStore = class {
 		const rel = full.slice(this.dir.length + 1).split("\\").join("/");
 		return kindForId(rel) === void 0 ? void 0 : rel;
 	}
-	async load(id, previous) {
+	async load(id, previous, fixture = this.session.get(id)?.fixture) {
 		const path = await this.resolvePath(id);
 		if (path === void 0) return { diagnostics: [diagnostic(id, "error", "template-unavailable", "Template file is missing or resolves outside the configured templates directory.")] };
 		const authoredSource = await readFile(path, "utf8").catch(() => void 0);
 		if (authoredSource === void 0) return { diagnostics: [diagnostic(id, "error", "template-read-error", "Template file could not be read.")] };
-		const session = this.session.get(id);
-		const name = session?.name ?? deriveName(id);
+		const name = this.session.get(id)?.name ?? deriveName(id);
 		if (this.evaluator === void 0) return {
 			authoredSource,
 			diagnostics: [diagnostic(id, "error", "tsx-evaluator-unavailable", "TSX templates require the Vite evaluator.")]
@@ -124,7 +124,7 @@ var EditorFileStore = class {
 			path,
 			id,
 			name,
-			fixture: session?.fixture
+			fixture
 		}).catch((cause) => ({
 			ok: false,
 			diagnostics: [diagnostic(id, "error", "module-load-error", cause instanceof Error ? cause.message : String(cause))]
@@ -408,12 +408,7 @@ var EditorFileStore = class {
 				error: `Template declares no fixture named ${JSON.stringify(fixture)}.`
 			};
 			const meta = this.session.get(id);
-			this.session.set(id, {
-				...meta,
-				metadata: meta?.metadata ?? {},
-				fixture
-			});
-			const loaded = await this.load(id, entry);
+			const loaded = await this.load(id, entry, fixture);
 			if (loaded.entry === void 0) {
 				if (loaded.diagnostics.length > 0) this.diagnostics.set(id, loaded.diagnostics);
 				return {
@@ -422,6 +417,11 @@ var EditorFileStore = class {
 					error: `Template ${id} could not be re-rendered.`
 				};
 			}
+			this.session.set(id, {
+				...meta,
+				metadata: meta?.metadata ?? {},
+				fixture
+			});
 			this.entries.set(id, loaded.entry);
 			this.publishEntry(id, loaded.entry, client);
 			return { ok: true };
@@ -513,6 +513,28 @@ const isViteInternalPath = (pathname) => VITE_INTERNAL_PREFIXES.some((prefix) =>
 const hasFileExtension = (pathname) => extname(pathname) !== "";
 const underRoute = (route, pathname) => route === "/" || pathname === route || pathname.startsWith(`${route}/`);
 const childRoute = (route, child) => route === "/" ? `/${child}` : `${route}/${child}`;
+const isLoopbackHostname = (hostname) => {
+	const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1") return true;
+	if (isIP(normalized) !== 4) return false;
+	return normalized.split(".")[0] === "127";
+};
+const isLoopbackAddress = (address) => {
+	if (address === void 0) return false;
+	const normalized = address.startsWith("::ffff:") ? address.slice(7) : address;
+	return isLoopbackHostname(normalized);
+};
+const isTrustedSourceSave = (req) => {
+	if (!isLoopbackAddress(req.socket.remoteAddress)) return false;
+	const origin = req.headers.origin;
+	if (origin === void 0) return false;
+	try {
+		const parsed = new URL(origin);
+		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username === "" && parsed.password === "" && isLoopbackHostname(parsed.hostname);
+	} catch {
+		return false;
+	}
+};
 const MAX_BODY_BYTES = 6295552;
 var EditorBodyTooLarge = class extends Error {};
 const readBody = (req) => new Promise((done, fail) => {
@@ -716,7 +738,11 @@ const samvaEditor = (options = {}) => {
 					runtime: "automatic",
 					importSource: "@samva/markup"
 				} },
-				optimizeDeps: { exclude: ["@samva/markup"] }
+				optimizeDeps: { exclude: ["@samva/markup"] },
+				server: {
+					host: "127.0.0.1",
+					allowedHosts: ["localhost", ".localhost"]
+				}
 			};
 		},
 		configResolved(resolved) {
@@ -895,8 +921,7 @@ const samvaEditor = (options = {}) => {
 						const id = query.get("id");
 						if (!id) return sendJson(res, 400, { error: "missing id" });
 						if (req.method === "POST") {
-							const origin = req.headers.origin;
-							if (origin !== void 0 && origin !== `http://${req.headers.host}` && origin !== `https://${req.headers.host}`) return sendJson(res, 403, { error: "Source saves require the editor origin." });
+							if (!isTrustedSourceSave(req)) return sendJson(res, 403, { error: "Source saves require the editor origin." });
 							let body;
 							try {
 								body = JSON.parse(await readBody(req));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samva/vite",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Unified Vite editor for Samva email, SMS, and WhatsApp templates",
   "keywords": [
     "email",
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.4",
-    "@samva/markup": "^0.5.0",
+    "@samva/markup": "^0.6.0",
     "better-result": "3.0.1",
     "caniemail": "2.0.2",
     "css-tree": "3.2.1",