@startsimpli/ui 0.4.100 → 0.4.101

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/ui",
-  "version": "0.4.100",
+  "version": "0.4.101",
   "description": "Shared UI components package for StartSimpli applications",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/components/validation/__tests__/checks.test.ts

@@ -128,6 +128,30 @@ describe('no-hype', () => {
 describe('approved sources', () => {
   const approvedHosts = ['example.com', 'gov.uk'];
 
+  it('accepts a SUBDOMAIN of an approved domain', () => {
+    // Same organisation, own subdomain. Exact-host matching rejected
+    // documents.worldbank.org while worldbank.org was approved — on the live
+    // OGMC corpus that was the last thing blocking approval on 3 drafts.
+    const c = find(
+      runContentChecks(
+        { sources: 'https://docs.example.com/a https://a.b.gov.uk/c' },
+        { approvedHosts },
+      ),
+      'approved-sources',
+    );
+    expect(c?.status).toBe('pass');
+  });
+
+  it('does NOT accept a domain that merely ENDS WITH an approved one', () => {
+    // The dot is load-bearing: `notexample.com` must not pass as `example.com`.
+    const c = find(
+      runContentChecks({ sources: 'https://notexample.com/a' }, { approvedHosts }),
+      'approved-sources',
+    );
+    expect(c?.status).toBe('fail');
+    expect(c?.detail).toContain('notexample.com');
+  });
+
   it('is skipped entirely when approvedHosts is omitted', () => {
     expect(find(runContentChecks({ sources: 'https://example.com/a' }), 'approved-sources')).toBeUndefined();
   });

package/src/components/validation/checks.ts

@@ -287,7 +287,22 @@ export function runContentChecks(fields: ContentFields, config: ContentChecksCon
 
   // Approved sources — only when the app supplied an allow-list.
   if (approvedHosts !== undefined) {
-    const approved = new Set(approvedHosts.map((h) => h.toLowerCase().replace(/^www\./, '')));
+    const approved = approvedHosts.map((h) => h.toLowerCase().replace(/^www\./, ''));
+    /**
+     * A host is approved when it IS an approved domain or is a SUBDOMAIN of one.
+     *
+     * Exact equality alone rejected `documents.worldbank.org` while
+     * `worldbank.org` was approved, and `eservices.misa.gov.sa` while
+     * `misa.gov.sa` was — the same organisation publishing on its own
+     * subdomain. On the live OGMC corpus that was the last thing blocking
+     * approval on 3 drafts after the source list itself was fixed.
+     *
+     * The dot in `.${domain}` is load-bearing: without it `notworldbank.org`
+     * would match `worldbank.org`, which is exactly the attack a naive
+     * `endsWith` invites.
+     */
+    const isApproved = (host: string): boolean =>
+      approved.some((domain) => host === domain || host.endsWith(`.${domain}`));
     const urls = extractUrls(fields.sources);
     const hosts = urls.map(hostOf).filter(Boolean);
     if (hosts.length === 0) {
@@ -299,7 +314,7 @@ export function runContentChecks(fields: ContentFields, config: ContentChecksCon
         locations: [{ field: 'sources' }],
       });
     } else {
-      const bad = Array.from(new Set(hosts.filter((h) => !approved.has(h) || FORUM_SOCIAL.test(h))));
+      const bad = Array.from(new Set(hosts.filter((h) => !isApproved(h) || FORUM_SOCIAL.test(h))));
       // Highlight the offending URLs as they appear in the sources text — the
       // reviewer pastes URLs, not bare hosts, so matching on the host alone
       // would highlight nothing.