@structured-id/ui-core 4.1.0 → 4.3.0

package/src/utils/normalizePrincipal.test.ts

@@ -1,5 +1,10 @@
-import { describe, it, expect } from "vitest";
+import { beforeAll, describe, it, expect } from "vitest";
 import { detectLoginInputType, normalizePrincipal } from "./normalizePrincipal";
+import { initEmail } from "./email";
+import { TEST_PSL } from "./email.testing";
+
+// As an application does at start: the email parser loaded, LOCAL namespace.
+beforeAll(() => initEmail({ psl: TEST_PSL }));
 
 describe("detectLoginInputType", () => {
   it("detects email", () => {
@@ -17,10 +22,18 @@ describe("detectLoginInputType", () => {
     expect(detectLoginInputType("alice")).toBe("username");
     expect(detectLoginInputType("bob_smith")).toBe("username");
     expect(detectLoginInputType("dev42")).toBe("username");
-    // Uppercase accepted in detection (will be lowercased on normalize)
+    // Uppercase accepted; the server derives the key.
     expect(detectLoginInputType("Admin123")).toBe("username");
   });
 
+  it("detects a username in any script, counted in code points", () => {
+    expect(detectLoginInputType("Иван")).toBe("username");
+    expect(detectLoginInputType("Иван_Петров", 6)).toBe("username");
+    expect(detectLoginInputType("Щукин", 6)).toBe("unknown"); // 5 < 6
+    expect(detectLoginInputType("ЩЩ")).toBe("unknown"); // 2 < 3
+    expect(detectLoginInputType("Иван Петров")).toBe("unknown"); // a space
+  });
+
   it("detects username with minLength=6 (registration)", () => {
     expect(detectLoginInputType("alice", 6)).toBe("unknown"); // too short
     expect(detectLoginInputType("alicew", 6)).toBe("username"); // exactly 6
@@ -126,13 +139,42 @@ describe("normalizePrincipal", () => {
     expect(result.display).toBe("+380501234567");
   });
 
-  it("normalizes username: value=lowercase, display=original casing", () => {
+  // Regression: the client lowercased a username before sending it, so the
+  // server never saw the spelling the user typed and could not keep it as
+  // the display form. The server derives the key, as it does for email.
+  it("sends a username as typed, case kept", () => {
     const result = normalizePrincipal("Alice_Bob");
     expect(result.type).toBe("username");
-    expect(result.value).toBe("alice_bob");
+    expect(result.value).toBe("Alice_Bob");
     expect(result.display).toBe("Alice_Bob");
   });
 
+  // Whitespace is never part of a name and is not repaired: a username with
+  // surrounding spaces is refused, not trimmed into another name.
+  it("refuses a username with surrounding whitespace", () => {
+    for (const input of ["  Alice_Bob ", "Alice_Bob ", "\tAlice_Bob"]) {
+      expect(() => normalizePrincipal(input)).toThrow("Cannot determine");
+    }
+  });
+
+  // Regression: a letter outside a-z made the name no type at all, so the
+  // field refused it before the server could apply its repertoire.
+  it("sends a username in any script as typed", () => {
+    for (const name of ["Иван_Петров", "Ωmega42", "Jürgen"]) {
+      const result = normalizePrincipal(name);
+      expect(result.type).toBe("username");
+      expect(result.value).toBe(name);
+    }
+  });
+
+  it("sends a username unnormalized and counts it after NFC", () => {
+    // "Jürgen" with ü as u + combining diaeresis: 7 code points, 6 in NFC.
+    const decomposed = "Jürgen";
+    const result = normalizePrincipal(decomposed, 6);
+    expect(result.value).toBe(decomposed);
+    expect(() => normalizePrincipal("Щукин", 6)).toThrow("Cannot determine");
+  });
+
   it("rejects username with leading/trailing underscore (detected as unknown)", () => {
     // Leading/trailing _ blocked at detection level → "Cannot determine"
     expect(() => normalizePrincipal("_alice_bob")).toThrow("Cannot determine");

package/src/utils/normalizePrincipal.ts

@@ -1,7 +1,7 @@
 import parsePhoneNumberFromString, {
   isValidPhoneNumber,
 } from "libphonenumber-js";
-import { isValidEmail } from "./validators";
+import { checkEmail } from "./email";
 
 export type LoginInputType = "email" | "phone" | "username" | "unknown";
 
@@ -14,17 +14,18 @@ export interface NormalizedPrincipal {
 }
 
 /**
- * Global username rules:
- *   Display:    ^[a-zA-Z0-9_]{3,32}$ — user's original input, mixed case preserved
- *   Normalized: ^[a-z0-9_]{3,32}$    — lowercase, for storage + uniqueness + login
- *   - cannot start or end with underscore
- *   - no consecutive underscores (__)
- *
- * For detection (prematch) we use a relaxed version:
- *   - accepts minLength (3 for login, 6 for registration)
- *   - case-insensitive (will be lowercased on normalization)
+ * A global username as the user types it: letters of any script, combining
+ * marks, digits and `_`, at most 32 code points in NFC, no `_` at either
+ * end. It is sent exactly as typed (nothing trimmed or normalized); the
+ * server applies its repertoire and minimum and derives the lookup key.
  */
 const USERNAME_MAX_LENGTH = 32;
+const USERNAME_SHAPE = /^[\p{L}\p{M}\p{N}_]+$/u;
+
+/** The length of `name` in code points of its NFC form. */
+function codePoints(name: string): number {
+  return [...name.normalize("NFC")].length;
+}
 
 /**
  * Detect principal type from user input.
@@ -63,11 +64,16 @@ export function detectLoginInputType(
     return "unknown";
   }
 
-  // Global username: no #, no @, no +
-  const re = new RegExp(
-    `^[a-zA-Z0-9_]{${minUsernameLength},${USERNAME_MAX_LENGTH}}$`,
-  );
-  if (re.test(trimmed) && !trimmed.startsWith("_") && !trimmed.endsWith("_")) {
+  // Global username: no #, no @, no +. Judged on the input itself, not the
+  // trimmed form: whitespace is never part of a name and is never repaired.
+  const length = codePoints(input);
+  if (
+    USERNAME_SHAPE.test(input) &&
+    length >= minUsernameLength &&
+    length <= USERNAME_MAX_LENGTH &&
+    !input.startsWith("_") &&
+    !input.endsWith("_")
+  ) {
     return "username";
   }
 
@@ -79,7 +85,7 @@ export function detectLoginInputType(
  *
  * - Email: as typed (trimmed); the server applies the email policy
  * - Phone: E.164 format via libphonenumber-js
- * - Username: lowercase, validate per arch rules
+ * - Username: exactly as typed; a federated one trimmed and lowercased
  *
  * @param minUsernameLength - minimum chars for username (3 for login, 6 for register)
  * Throws if value doesn't pass validation for detected type.
@@ -89,13 +95,18 @@ export function normalizePrincipal(
   minUsernameLength = 3,
 ): NormalizedPrincipal {
   const trimmed = input.trim();
-  const type = detectLoginInputType(trimmed, minUsernameLength);
+  const type = detectLoginInputType(input, minUsernameLength);
 
   switch (type) {
     case "email": {
       // Sent as typed: the server validates it, derives the lookup key and
-      // keeps this spelling as the address to mail.
-      if (!isValidEmail(trimmed)) {
+      // keeps this spelling as the address to mail. Checked here under the
+      // application's namespace (initEmail), as the server would.
+      const check = checkEmail(trimmed);
+      if (check === "pending") {
+        throw new Error("Email check not loaded: call initEmail() first");
+      }
+      if (check === "invalid") {
         throw new Error("Invalid email address");
       }
       return { value: trimmed, display: trimmed, type: "email" };
@@ -135,20 +146,13 @@ export function normalizePrincipal(
         return { value: normalized, display: trimmed, type: "username" };
       }
 
-      // Global username
-      const normalized = trimmed.toLowerCase();
-      const re = new RegExp(
-        `^[a-z0-9_]{${minUsernameLength},${USERNAME_MAX_LENGTH}}$`,
-      );
-      if (
-        !re.test(normalized) ||
-        normalized.startsWith("_") ||
-        normalized.endsWith("_") ||
-        normalized.includes("__")
-      ) {
+      // Global username: detection checked its shape and length on the
+      // input itself; sent exactly as typed, the server normalizes it and
+      // derives the key.
+      if (input.includes("__")) {
         throw new Error("Invalid username");
       }
-      return { value: normalized, display: trimmed, type: "username" };
+      return { value: input, display: input, type: "username" };
     }
 
     default:

package/src/utils/validators.test.ts

@@ -1,6 +1,5 @@
 import { describe, it, expect } from "vitest";
 import {
-  isValidEmail,
   isValidPhone,
   isValidUuid,
   isValidUsername,
@@ -9,28 +8,6 @@ import {
   isRequired,
 } from "./validators";
 
-describe("isValidEmail", () => {
-  it("accepts valid emails", () => {
-    expect(isValidEmail("user@example.com")).toBe(true);
-    expect(isValidEmail("a.b+c@d.co")).toBe(true);
-  });
-  it("rejects invalid emails", () => {
-    expect(isValidEmail("")).toBe(false);
-    expect(isValidEmail("noat")).toBe(false);
-    expect(isValidEmail("@no-local.com")).toBe(false);
-    expect(isValidEmail("spaces in@email.com")).toBe(false);
-    expect(isValidEmail("user@")).toBe(false);
-    expect(isValidEmail("user@exa mple.com")).toBe(false);
-  });
-  // Regression: a dot was required in the domain and quoted local parts were
-  // refused, so the client turned away addresses the server's policy admits.
-  it("leaves admission to the server's email policy", () => {
-    expect(isValidEmail("admin@printer")).toBe(true);
-    expect(isValidEmail('"a b"@example.com')).toBe(true);
-    expect(isValidEmail('"a@b"@example.com')).toBe(true);
-  });
-});
-
 describe("isValidPhone", () => {
   it("accepts E.164 format", () => {
     expect(isValidPhone("+380501234567")).toBe(true);

package/src/utils/validators.ts

@@ -1,20 +1,3 @@
-/**
- * Whether `value` has the shape of one mailbox: a local part and a domain
- * around the last `@`, whitespace only inside a quoted local part. Advisory:
- * the server's email policy decides admission (internal single-label domains
- * and quoted local parts may be admitted), so this refuses only what can
- * never be an address.
- */
-export function isValidEmail(value: string): boolean {
-  const at = value.lastIndexOf("@");
-  if (at <= 0 || at === value.length - 1) return false;
-  const local = value.slice(0, at);
-  const domain = value.slice(at + 1);
-  const quoted =
-    local.length > 1 && local.startsWith('"') && local.endsWith('"');
-  return !/\s/.test(domain) && (quoted || !/\s/.test(local));
-}
-
 /** Phone number validation (E.164 format). */
 export function isValidPhone(value: string): boolean {
   return /^\+[1-9]\d{6,14}$/.test(value);