@tellescope/sdk 1.256.15 → 2.0.0-beta.0

package/lib/cjs/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.js

@@ -0,0 +1,297 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rich_text_answer_sanitized_on_write_tests = exports.rich_text_answer_sanitized_on_write_checks = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var setup_isolated_1 = require("../../setup_isolated");
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+/**
+ * Form "Rich Text" answers must be sanitized when they are stored, not only when they are rendered.
+ *
+ * A Rich Text answer is HTML authored by whoever fills the form — including an unauthenticated
+ * visitor on a public intake page — and it is stored verbatim by the generic write path (the only
+ * thing it strips is `<script>`). Every read path re-sanitizes before `dangerouslySetInnerHTML`,
+ * but the staff-side rich text *editor* did not: `@tellescope/react-components`'s `RichTextInput`
+ * fed the stored answer straight into `html-to-draftjs`, whose `<iframe>` handling produces a
+ * Draft.js EMBEDDED_LINK block that `react-draft-wysiwyg` renders as a real, unsandboxed iframe.
+ * So an enduser could submit `<iframe src="javascript:…">` in an answer and have it execute in the
+ * session of the staff member who opened that response for editing (enduser -> staff stored XSS,
+ * i.e. a PHI-egress class). The editor was fixed to sanitize before parsing; this test covers the
+ * second layer: the answer is sanitized once, on write, so exports, PDFs, integrations, AI
+ * summaries and any future consumer inherit it instead of each having to remember.
+ *
+ * Every client write of answers goes through `formResponseValidator` — generic create/update
+ * (endusers may PATCH `responses`), `submit_form_response` and `save_field_response` — so all three
+ * are exercised here. The server-side writers that bypass validation (Formsort, Healthie sync, AI
+ * form filling) never construct a `'Rich Text'` answer; see the note on the validator in
+ * `@tellescope/validation`.
+ *
+ * The negative checks are paired with positive ones: formatting and legitimate external links must
+ * survive, or a "sanitized" result could just mean the answer was discarded. The last two checks
+ * guard the two ways this change could break normal use: an empty answer must round-trip
+ * unchanged (the portal compares against `''` / `'<p></p>'`), and a long answer must not be
+ * rejected because the sanitizer's own `target`/`rel` additions pushed it over the length limit.
+ */
+var rich_text_answer_sanitized_on_write_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, PAYLOAD, dangerous, record_sanitized, tenant, sdk_2, form_1, field_1, enduser_1, authToken, enduserSDK, prepare, answer, stored_answer_1, submitted, submittedValue, partial, _a, _b, patched, _c, _d, resubmitted, again, empties, roundTrips, _i, _e, value, _f, _g, _h, _j, _k, _l, emptiesOk, LINKS, longAnswer, longResponse_1, longResult, longOk, e_1;
+    return __generator(this, function (_m) {
+        switch (_m.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                PAYLOAD = '<p>hi <b>bold</b> <a href="https://x.io">l</a></p>'
+                    + '<iframe src="javascript:alert(1)"></iframe>'
+                    + '<img src="x" onerror="alert(1)">'
+                    + '<script>alert(1)</script>'
+                    + '<a href="javascript:alert(2)">j</a>';
+                dangerous = function (stored) { return [
+                    ['<iframe', stored.toLowerCase().includes('<iframe')],
+                    ['onerror', stored.toLowerCase().includes('onerror')],
+                    ['<script', stored.toLowerCase().includes('<script')],
+                    ['javascript:', stored.toLowerCase().includes('javascript:')],
+                ].filter(function (_a) {
+                    var present = _a[1];
+                    return present;
+                }).map(function (_a) {
+                    var name = _a[0];
+                    return name;
+                }); };
+                record_sanitized = function (label, stored) {
+                    if (typeof stored !== 'string') {
+                        record(label, false, "no answer stored (got ".concat(JSON.stringify(stored), ")"));
+                        return;
+                    }
+                    var bad = dangerous(stored);
+                    var keptFormatting = stored.includes('<b>bold</b>');
+                    var keptLink = stored.includes('href="https://x.io"') && stored.includes('rel="noopener noreferrer"');
+                    record(label, bad.length === 0 && keptFormatting && keptLink, bad.length !== 0 ? "dangerous markup stored: ".concat(bad.join(', '), " \u2014 ").concat(stored.slice(0, 300))
+                        : !keptFormatting ? "formatting did not survive \u2014 ".concat(stored.slice(0, 300))
+                            : !keptLink ? "external link lost its href or rel \u2014 ".concat(stored.slice(0, 300))
+                                : "stored sanitized: ".concat(stored.slice(0, 300)));
+                };
+                _m.label = 1;
+            case 1:
+                _m.trys.push([1, , 29, 34]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({ name: "RichText ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 })];
+            case 2:
+                tenant = _m.sent();
+                sdk_2 = tenant.sdk;
+                return [4 /*yield*/, sdk_2.api.forms.createOne({ title: "rich text ".concat(RAND()) })];
+            case 3:
+                form_1 = _m.sent();
+                return [4 /*yield*/, sdk_2.api.form_fields.createOne({
+                        formId: form_1.id, title: 'Tell us more', type: 'Rich Text', previousFields: [{ type: 'root', info: {} }],
+                    })];
+            case 4:
+                field_1 = _m.sent();
+                return [4 /*yield*/, sdk_2.api.endusers.createOne({
+                        email: "richtext-".concat(RAND(), "@tellescope.com"), fname: 'Rich', lname: 'Text',
+                    })
+                    // generate_auth_token rather than .authenticate — repeated logins hit the rate limiter.
+                ];
+            case 5:
+                enduser_1 = _m.sent();
+                return [4 /*yield*/, sdk_2.api.endusers.generate_auth_token({ id: enduser_1.id })];
+            case 6:
+                authToken = (_m.sent()).authToken;
+                enduserSDK = new sdk_1.EnduserSession({ host: host, businessId: tenant.businessId, authToken: authToken });
+                prepare = function () { return sdk_2.api.form_responses.prepare_form_response({ formId: form_1.id, enduserId: enduser_1.id }); };
+                answer = function (value) { return ({
+                    fieldId: field_1.id, fieldTitle: field_1.title, answer: { type: 'Rich Text', value: value },
+                }); };
+                stored_answer_1 = function (formResponseId) { return __awaiter(void 0, void 0, void 0, function () {
+                    var formResponse, response;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0: return [4 /*yield*/, sdk_2.api.form_responses.getOne(formResponseId)];
+                            case 1:
+                                formResponse = _b.sent();
+                                response = (formResponse.responses || []).find(function (r) { return r.fieldId === field_1.id; });
+                                return [2 /*return*/, (_a = response === null || response === void 0 ? void 0 : response.answer) === null || _a === void 0 ? void 0 : _a.value];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, prepare()];
+            case 7:
+                submitted = _m.sent();
+                return [4 /*yield*/, enduserSDK.api.form_responses.submit_form_response({
+                        accessCode: submitted.accessCode, responses: [answer(PAYLOAD)],
+                    })];
+            case 8:
+                _m.sent();
+                return [4 /*yield*/, stored_answer_1(submitted.response.id)];
+            case 9:
+                submittedValue = _m.sent();
+                record_sanitized('1: submit_form_response stores a sanitized answer', submittedValue);
+                return [4 /*yield*/, prepare()];
+            case 10:
+                partial = _m.sent();
+                return [4 /*yield*/, enduserSDK.api.form_responses.save_field_response({
+                        accessCode: partial.accessCode, response: answer(PAYLOAD),
+                    })];
+            case 11:
+                _m.sent();
+                _a = record_sanitized;
+                _b = ['2: save_field_response stores a sanitized answer'];
+                return [4 /*yield*/, stored_answer_1(partial.response.id)];
+            case 12:
+                _a.apply(void 0, _b.concat([_m.sent()]));
+                return [4 /*yield*/, prepare()];
+            case 13:
+                patched = _m.sent();
+                return [4 /*yield*/, enduserSDK.api.form_responses.updateOne(patched.response.id, { responses: [answer(PAYLOAD)] })];
+            case 14:
+                _m.sent();
+                _c = record_sanitized;
+                _d = ['3: enduser PATCH of responses stores a sanitized answer'];
+                return [4 /*yield*/, stored_answer_1(patched.response.id)];
+            case 15:
+                _c.apply(void 0, _d.concat([_m.sent()]));
+                if (!(typeof submittedValue === 'string')) return [3 /*break*/, 19];
+                return [4 /*yield*/, prepare()];
+            case 16:
+                resubmitted = _m.sent();
+                return [4 /*yield*/, enduserSDK.api.form_responses.submit_form_response({
+                        accessCode: resubmitted.accessCode, responses: [answer(submittedValue)],
+                    })];
+            case 17:
+                _m.sent();
+                return [4 /*yield*/, stored_answer_1(resubmitted.response.id)];
+            case 18:
+                again = _m.sent();
+                record('4: re-submitting a sanitized answer is idempotent', again === submittedValue, again === submittedValue ? 'unchanged on the second pass' : "changed \u2014 ".concat(String(again).slice(0, 300)));
+                return [3 /*break*/, 20];
+            case 19:
+                record('4: re-submitting a sanitized answer is idempotent', false, 'skipped: check 1 stored nothing');
+                _m.label = 20;
+            case 20: return [4 /*yield*/, prepare()];
+            case 21:
+                empties = _m.sent();
+                roundTrips = [];
+                _i = 0, _e = ['<p></p>', ''];
+                _m.label = 22;
+            case 22:
+                if (!(_i < _e.length)) return [3 /*break*/, 26];
+                value = _e[_i];
+                return [4 /*yield*/, enduserSDK.api.form_responses.save_field_response({
+                        accessCode: empties.accessCode, response: answer(value),
+                    })];
+            case 23:
+                _m.sent();
+                _g = (_f = roundTrips).push;
+                _j = (_h = "".concat(JSON.stringify(value), " -> ")).concat;
+                _l = (_k = JSON).stringify;
+                return [4 /*yield*/, stored_answer_1(empties.response.id)];
+            case 24:
+                _g.apply(_f, [_j.apply(_h, [_l.apply(_k, [_m.sent()])])]);
+                _m.label = 25;
+            case 25:
+                _i++;
+                return [3 /*break*/, 22];
+            case 26:
+                emptiesOk = roundTrips[0] === '"<p></p>" -> "<p></p>"' && roundTrips[1] === '"" -> ""';
+                record('5: empty and <p></p> answers round-trip unchanged', emptiesOk, roundTrips.join(', '));
+                LINKS = 12;
+                longAnswer = "<p>".concat('a'.repeat(24400), "</p>")
+                    + "<a href=\"https://example.com/a\">link</a>".repeat(LINKS);
+                return [4 /*yield*/, prepare()];
+            case 27:
+                longResponse_1 = _m.sent();
+                return [4 /*yield*/, enduserSDK.api.form_responses.submit_form_response({
+                        accessCode: longResponse_1.accessCode, responses: [answer(longAnswer)],
+                    }).then(function () { return stored_answer_1(longResponse_1.response.id); })
+                        .catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 28:
+                longResult = _m.sent();
+                longOk = typeof longResult === 'string'
+                    && longResult.split('rel="noopener noreferrer"').length - 1 === LINKS;
+                record('6: a ~24.9k answer with external links is accepted after sanitizing', longOk, longOk ? "stored ".concat(longResult.length, " characters with ").concat(LINKS, " rel-tagged links (submitted ").concat(longAnswer.length, ")")
+                    : "submitted ".concat(longAnswer.length, " characters \u2014 ").concat(String(longResult).slice(0, 300)));
+                return [3 /*break*/, 34];
+            case 29:
+                if (!tenant) return [3 /*break*/, 33];
+                _m.label = 30;
+            case 30:
+                _m.trys.push([30, 32, , 33]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 31:
+                _m.sent();
+                return [3 /*break*/, 33];
+            case 32:
+                e_1 = _m.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 33];
+            case 33: return [7 /*endfinally*/];
+            case 34: return [2 /*return*/, checks];
+        }
+    });
+}); };
+exports.rich_text_answer_sanitized_on_write_checks = rich_text_answer_sanitized_on_write_checks;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+var rich_text_answer_sanitized_on_write_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Rich Text answers sanitized on write'];
+                return [4 /*yield*/, (0, exports.rich_text_answer_sanitized_on_write_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+exports.rich_text_answer_sanitized_on_write_tests = rich_text_answer_sanitized_on_write_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    (0, exports.rich_text_answer_sanitized_on_write_tests)()
+        .then(function () {
+        console.log("✅ rich text answer sanitization test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ rich text answer sanitization test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=rich-text-answer-sanitized-on-write.test.js.map

package/lib/cjs/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text-answer-sanitized-on-write.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAA6C;AAC7C,uDAI6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,IAAM,0CAA0C,GAAG;;;;;gBAClD,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAE/F,OAAO,GAAG,oDAAoD;sBAChE,6CAA6C;sBAC7C,kCAAkC;sBAClC,2BAA2B;sBAC3B,qCAAqC,CAAA;gBAEnC,SAAS,GAAG,UAAC,MAAc,IAAK,OAAC;oBACrC,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrD,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrD,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrD,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;iBACtC,CAAC,MAAM,CAAC,UAAC,EAAW;wBAAR,OAAO,QAAA;oBAAM,OAAA,OAAO;gBAAP,CAAO,CAAC,CAAC,GAAG,CAAC,UAAC,EAAM;wBAAL,IAAI,QAAA;oBAAM,OAAA,IAAI;gBAAJ,CAAI,CAAC,EAL1C,CAK0C,CAAA;gBAE1E,gBAAgB,GAAG,UAAC,KAAa,EAAE,MAA0B;oBACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;wBAC9B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,gCAAyB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAG,CAAC,CAAA;wBACxE,OAAM;qBACP;oBACD,IAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;oBAC7B,IAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;oBACrD,IAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;oBAEvG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,IAAI,QAAQ,EAC1D,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mCAA4B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE;wBACzF,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,4CAAgC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE;4BAC1E,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oDAAwC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE;gCAC5E,CAAC,CAAC,4BAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,CAC9C,CAAA;gBACH,CAAC,CAAA;;;;gBAKU,qBAAM,IAAA,sCAAqB,EAAC,EAAE,IAAI,EAAE,mBAAY,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAA5G,MAAM,GAAG,SAAmG,CAAA;gBACtG,QAAM,MAAM,CAAC,GAAG,CAAA;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAa,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gBAAtE,SAAO,SAA+D;gBAC9D,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBACxG,CAAC,EAAA;;gBAFI,UAAQ,SAEZ;gBACc,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC/C,KAAK,EAAE,mBAAY,IAAI,EAAE,oBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;qBACzE,CAAC;oBACF,wFAAwF;kBADtF;;gBAFI,YAAU,SAEd;gBAEoB,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAA5E,SAAS,GAAK,CAAA,SAA8D,CAAA,UAAnE;gBACX,UAAU,GAAG,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,WAAA,EAAE,CAAC,CAAA;gBAEnF,OAAO,GAAG,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,CAAC,EAAxF,CAAwF,CAAA;gBACxG,MAAM,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC;oBACjC,OAAO,EAAE,OAAK,CAAC,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,KAAK,OAAA,EAAE;iBAC1F,CAAC,EAFgC,CAEhC,CAAA;gBAEI,kBAAgB,UAAO,cAAsB;;;;;oCAC5B,qBAAM,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,EAAA;;gCAAlE,YAAY,GAAG,SAAmD;gCAClE,QAAQ,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,OAAK,CAAC,EAAE,EAAtB,CAAsB,CAAC,CAAA;gCACjF,sBAAO,MAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAyC,0CAAE,KAAK,EAAA;;;qBACnE,CAAA;gBAIiB,qBAAM,OAAO,EAAE,EAAA;;gBAA3B,SAAS,GAAG,SAAe;gBACjC,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBACvD,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;qBAC/D,CAAC,EAAA;;gBAFF,SAEE,CAAA;gBACqB,qBAAM,eAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;gBAA3D,cAAc,GAAG,SAA0C;gBACjE,gBAAgB,CAAC,mDAAmD,EAAE,cAAc,CAAC,CAAA;gBAIrE,qBAAM,OAAO,EAAE,EAAA;;gBAAzB,OAAO,GAAG,SAAe;gBAC/B,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC;wBACtD,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;qBAC1D,CAAC,EAAA;;gBAFF,SAEE,CAAA;gBACF,KAAA,gBAAgB,CAAA;sBAAC,kDAAkD;gBAAE,qBAAM,eAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;gBAA7G,4BAAqE,SAAwC,GAAC,CAAA;gBAI9F,qBAAM,OAAO,EAAE,EAAA;;gBAAzB,OAAO,GAAG,SAAe;gBAC/B,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAA;;gBAApG,SAAoG,CAAA;gBACpG,KAAA,gBAAgB,CAAA;sBAAC,yDAAyD;gBAAE,qBAAM,eAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;gBAApH,4BAA4E,SAAwC,GAAC,CAAA;qBAIjH,CAAA,OAAO,cAAc,KAAK,QAAQ,CAAA,EAAlC,yBAAkC;gBAChB,qBAAM,OAAO,EAAE,EAAA;;gBAA7B,WAAW,GAAG,SAAe;gBACnC,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBACvD,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;qBACxE,CAAC,EAAA;;gBAFF,SAEE,CAAA;gBACY,qBAAM,eAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;gBAApD,KAAK,GAAG,SAA4C;gBAC1D,MAAM,CAAC,mDAAmD,EAAE,KAAK,KAAK,cAAc,EAClF,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,yBAAa,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC,CAAA;;;gBAEzG,MAAM,CAAC,mDAAmD,EAAE,KAAK,EAAE,iCAAiC,CAAC,CAAA;;qBAKvF,qBAAM,OAAO,EAAE,EAAA;;gBAAzB,OAAO,GAAG,SAAe;gBACzB,UAAU,GAAa,EAAE,CAAA;sBACI,EAAf,MAAC,SAAS,EAAE,EAAE,CAAC;;;qBAAf,CAAA,cAAe,CAAA;gBAAxB,KAAK;gBACd,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC;wBACtD,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;qBACxD,CAAC,EAAA;;gBAFF,SAEE,CAAA;gBACF,KAAA,CAAA,KAAA,UAAU,CAAA,CAAC,IAAI,CAAA;qCAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAO,KAAA,CAAA,KAAA,IAAI,CAAA,CAAC,SAAS,CAAA;gBAAC,qBAAM,eAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;gBAAtG,cAAgB,cAA+B,cAAe,SAAwC,EAAC,EAAE,EAAC,CAAA;;;gBAJxF,IAAe,CAAA;;;gBAM7B,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,wBAAwB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAA;gBAC5F,MAAM,CAAC,mDAAmD,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBAMvF,KAAK,GAAG,EAAE,CAAA;gBACV,UAAU,GAAG,aAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAM;sBAC5C,4CAA0C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACvC,qBAAM,OAAO,EAAE,EAAA;;gBAA9B,iBAAe,SAAe;gBACjB,qBAAM,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBAC1E,UAAU,EAAE,cAAY,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;qBACrE,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,eAAa,CAAC,cAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAvC,CAAuC,CAAC;yBACpD,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAH7C,UAAU,GAAG,SAGgC;gBAE7C,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ;uBACxC,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,KAAK,CAAA;gBACvE,MAAM,CAAC,qEAAqE,EAAE,MAAM,EAClF,MAAM,CAAC,CAAC,CAAC,iBAAU,UAAU,CAAC,MAAM,8BAAoB,KAAK,0CAAgC,UAAU,CAAC,MAAM,MAAG;oBAC1G,CAAC,CAAC,oBAAa,UAAU,CAAC,MAAM,gCAAiB,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC,CAAA;;;qBAIzF,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAzIY,QAAA,0CAA0C,8CAyItD;AAED,kFAAkF;AAC3E,IAAM,yCAAyC,GAAG;;;;;gBACvD,KAAA,8BAAa,CAAA;sBAAC,sCAAsC;gBAAE,qBAAM,IAAA,kDAA0C,GAAE,EAAA;;gBAAxG,4BAAsD,SAAkD,GAAC,CAAA;;;;KAC1G,CAAA;AAFY,QAAA,yCAAyC,6CAErD;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,iDAAyC,GAAE;SACxC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-user-html-with-iframes.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,qCAAqC,qBAiKjD,CAAA"}
+{"version":3,"file":"sanitize-user-html-with-iframes.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,qCAAqC,qBAoKjD,CAAA"}

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js

@@ -179,7 +179,10 @@ var sanitize_user_html_with_iframes_tests = function () { return __awaiter(void
         emptySandbox = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" sandbox=\"\"></iframe>");
         if (emptySandbox.includes('allow-'))
             fail("empty sandbox was replaced with the permissive default: ".concat(emptySandbox));
-        if (!/\ssandbox(\s|>)/.test(emptySandbox))
+        // Accepts either spelling — a bare `sandbox` and `sandbox=""` are identical per the HTML spec,
+        // and which one sanitize-html emits has changed between releases. What must never happen is the
+        // attribute disappearing, which leaves the frame with no sandbox at all.
+        if (!/\ssandbox(=""|\s|>)/.test(emptySandbox))
             fail("empty sandbox attribute lost entirely: ".concat(emptySandbox));
         noref = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" referrerpolicy=\"no-referrer\"></iframe>");
         if (!noref.includes('referrerpolicy="no-referrer"'))

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-user-html-with-iframes.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAuJ;AAEvJ,0FAA0F;AAC1F,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,kGAAkG;AAClG,mGAAmG;AACnG,wEAAwE;AACxE,oFAAoF;AACpF,+FAA+F;AAC/F,EAAE;AACF,yFAAyF;AACzF,+IAA+I;AAE/I,IAAM,IAAI,GAAG,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;AAEtD,uGAAuG;AACvG,kFAAkF;AAClF,IAAM,wCAAwC,GAAG,UAAC,GAAW;IAC3D,IAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,IAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAG,uCAAuC;WAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAmB,yCAAyC;AAC1F,CAAC,CAAA;AAED,kGAAkG;AAClG,gGAAgG;AAChG,IAAM,wBAAwB,GAAG;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,wBAAwB;CACzB,CAAA;AAEM,IAAM,qCAAqC,GAAG;;;QACnD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAKrE,WAAW,GAAuB;YACtC,CAAC,aAAa,EAAE,gDAA8C,CAAC;YAC/D,CAAC,YAAY,EAAE,iCAA+B,CAAC;YAC/C,CAAC,qBAAqB,EAAE,0EAAoE,CAAC;YAC7F,CAAC,kBAAkB,EAAE,gDAA8C,CAAC;YACpE,CAAC,yBAAyB,EAAE,wCAAsC,CAAC;YACnE,CAAC,iBAAiB,EAAE,gCAA8B,CAAC;YACnD,CAAC,qBAAqB,EAAE,uCAAqC,CAAC;YAC9D,CAAC,6BAA6B,EAAE,6CAA2C,CAAC;YAC5E,CAAC,YAAY,EAAE,2BAA2B,CAAC;YAC3C,CAAC,0BAA0B,EAAE,oCAAkC,CAAC;YAChE,CAAC,oBAAoB,EAAE,kCAAgC,CAAC;YACxD,CAAC,iBAAiB,EAAE,2CAAyC,CAAC;YAC9D,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;YAC3G,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;YAC/F,CAAC,4BAA4B,EAAE,iEAA+D,CAAC;YAC/F,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;YACzE,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;YAC7D,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;YAC/D,CAAC,0BAA0B,EAAE,mDAA+C,CAAC;YAC7E,CAAC,iBAAiB,EAAE,sCAAoC,CAAC;YACzD,CAAC,qBAAqB,EAAE,4DAA0D,CAAC;YACnF,CAAC,2BAA2B,EAAE,2CAAyC,CAAC;YACxE,CAAC,2BAA2B,EAAE,6CAA2C,CAAC;SAC3E,CAAA;QACD,WAAyC,EAAX,2BAAW,EAAX,yBAAW,EAAX,IAAW,EAAE;YAAhC,sBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,+BAAwB,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SACpG;QAKK,OAAO,GAAuB;YAClC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC5C,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;YAC9D,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;YAC3C,8EAA8E;YAC9E,2FAA2F;YAC3F,+CAA+C;YAC/C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;YAC9C,CAAC,eAAe,EAAE,kBAAkB,CAAC;YACrC,CAAC,eAAe,EAAE,UAAU,CAAC;YAC7B,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;YAC/C,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;YACtD,CAAC,aAAa,EAAE,UAAU,CAAC;YAC3B,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAA;QACD,WAAiC,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;YAAxB,kBAAW,EAAV,cAAI,EAAE,GAAG,QAAA;YACb,GAAG,GAAG,IAAA,2CAA+B,EAAC,wBAAgB,GAAG,iBAAa,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,mCAA4B,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC/F;QAGK,QAAQ,GAAG,IAAA,2CAA+B,EAAC,2CAAyC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,mDAA4C,QAAQ,CAAE,CAAC,CAAA;QACpG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,mCAA4B,QAAQ,CAAE,CAAC,CAAA;QAGtF,MAAM,GAAG,IAAA,2CAA+B,EAAC,sFAAkF,CAAC,CAAA;QAClI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,+BAAwB,MAAM,CAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,iDAA0C,MAAM,CAAE,CAAC,CAAA;QAGjG,QAAQ,GAAG,IAAA,2CAA+B,EAAC,mGAA2F,CAAC,CAAA;QAC7I,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,gCAAyB,QAAQ,CAAE,CAAC,CAAA;QAC1F,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,yCAAkC,QAAQ,CAAE,CAAC,CAAA;QACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAiD,QAAQ,CAAE,CAAC,CAAA;QAMjG,EAAE,GAAG,IAAA,2CAA+B,EAAC,4GAAoG,CAAC,CAAA;QAChJ,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QACtG,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QAC3G,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAyB,EAAE,CAAE,CAAC,CAAA;QAElF,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAY,kCAAsB,OAAG,CAAC;YAAE,IAAI,CAAC,8BAAuB,EAAE,CAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,kCAA2B,EAAE,CAAE,CAAC,CAAA;QACxF,WAA4C,EAAxB,qDAAwB,EAAxB,sCAAwB,EAAxB,IAAwB,EAAE;YAAnC,KAAK;YACd,IAAI,kCAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wCAAiC,KAAK,eAAK,kCAAsB,CAAE,CAAC,CAAA;SACtH;QACD,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,CAAC,kCAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,IAAI,CAAC,6EAAsE,kCAAsB,CAAE,CAAC,CAAA;QAIzJ,aAAa,GAAG,IAAA,2CAA+B,EAAC,wEAAoE,CAAC,CAAA;QAC3H,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,IAAI,CAAC,sCAA+B,aAAa,CAAE,CAAC,CAAA;QAGtG,YAAY,GAAG,IAAA,2CAA+B,EAAC,2DAAuD,CAAC,CAAA;QAC7G,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kEAA2D,YAAY,CAAE,CAAC,CAAA;QACpH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,iDAA0C,YAAY,CAAE,CAAC,CAAA;QAGnG,KAAK,GAAG,IAAA,2CAA+B,EAAC,6EAAyE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,IAAI,CAAC,6CAAsC,KAAK,CAAE,CAAC,CAAA;QAGlG,SAAS,GAAG,IAAA,2CAA+B,EAAC,kGAA8F,CAAC,CAAA;QACjJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,oCAA6B,SAAS,CAAE,CAAC,CAAA;QAKtG,OAAO,GAAG,IAAA,2CAA+B,EAAC,mDAAiD,CAAC,CAAA;QAClG,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,mCAA4B,OAAO,CAAE,CAAC,CAAA;QAE5I,KAAK,GAAG,IAAA,2CAA+B,EAAC,4HAAwH,CAAC,CAAA;QACvK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,KAAK,CAAE,CAAC,CAAA;QAEjH,IAAI,GAAG,IAAA,2CAA+B,EAAC,oDAAkD,CAAC,CAAA;QAChG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;QAErG,IAAI,GAAG,IAAA,2CAA+B,EAAC,0CAAwC,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,IAAI,CAAC,8BAAuB,IAAI,CAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,sCAA+B,IAAI,CAAE,CAAC,CAAA;QAEnF,GAAG,GAAG,IAAA,2CAA+B,EAAC,uEAAiE,CAAC,CAAA;QAC9G,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,GAAG,CAAE,CAAC,CAAA;QAEjH,OAAO,GAAG,IAAA,2CAA+B,EAAC,kDAAgD,CAAC,CAAA;QACjG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,gCAAyB,OAAO,CAAE,CAAC,CAAA;QAE3E,GAAG,GAAG,IAAA,2CAA+B,EAAC,wGAAsG,CAAC,CAAA;QACnJ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,+BAAwB,GAAG,CAAE,CAAC,CAAA;QAKlI,MAAM,GAAG,IAAA,8BAAkB,EAAC,6DAA2D,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,uDAAgD,MAAM,CAAE,CAAC,CAAA;QAKtG,aAAa,GAAG,qGAAmG,CAAA;QACnH,SAAS,GAAG,IAAA,8CAAkC,EAAC,aAAa,EAAE;YAClE,OAAO,EAAE,EAAE,KAAK,EAAE,sDAAoD,EAAS;YAC/E,SAAS,EAAE,EAAE;YACb,0BAA0B,EAAE,IAAI;YAChC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACI,QAAQ,GAAG,IAAA,2CAA+B,EAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,8CAAuC,QAAQ,CAAE,CAAC,CAAA;QAC1H,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,oDAA6C,QAAQ,CAAE,CAAC,CAAA;QACnG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,uDAAgD,QAAQ,CAAE,CAAC,CAAA;QAEnI,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;;;KAC7E,CAAA;AAjKY,QAAA,qCAAqC,yCAiKjD;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,6CAAqC,GAAE;SACpC,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,UAAC,GAAG,IAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CAC9E"}
+{"version":3,"file":"sanitize-user-html-with-iframes.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAuJ;AAEvJ,0FAA0F;AAC1F,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,kGAAkG;AAClG,mGAAmG;AACnG,wEAAwE;AACxE,oFAAoF;AACpF,+FAA+F;AAC/F,EAAE;AACF,yFAAyF;AACzF,+IAA+I;AAE/I,IAAM,IAAI,GAAG,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;AAEtD,uGAAuG;AACvG,kFAAkF;AAClF,IAAM,wCAAwC,GAAG,UAAC,GAAW;IAC3D,IAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,IAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAG,uCAAuC;WAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAmB,yCAAyC;AAC1F,CAAC,CAAA;AAED,kGAAkG;AAClG,gGAAgG;AAChG,IAAM,wBAAwB,GAAG;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,wBAAwB;CACzB,CAAA;AAEM,IAAM,qCAAqC,GAAG;;;QACnD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAKrE,WAAW,GAAuB;YACtC,CAAC,aAAa,EAAE,gDAA8C,CAAC;YAC/D,CAAC,YAAY,EAAE,iCAA+B,CAAC;YAC/C,CAAC,qBAAqB,EAAE,0EAAoE,CAAC;YAC7F,CAAC,kBAAkB,EAAE,gDAA8C,CAAC;YACpE,CAAC,yBAAyB,EAAE,wCAAsC,CAAC;YACnE,CAAC,iBAAiB,EAAE,gCAA8B,CAAC;YACnD,CAAC,qBAAqB,EAAE,uCAAqC,CAAC;YAC9D,CAAC,6BAA6B,EAAE,6CAA2C,CAAC;YAC5E,CAAC,YAAY,EAAE,2BAA2B,CAAC;YAC3C,CAAC,0BAA0B,EAAE,oCAAkC,CAAC;YAChE,CAAC,oBAAoB,EAAE,kCAAgC,CAAC;YACxD,CAAC,iBAAiB,EAAE,2CAAyC,CAAC;YAC9D,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;YAC3G,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;YAC/F,CAAC,4BAA4B,EAAE,iEAA+D,CAAC;YAC/F,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;YACzE,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;YAC7D,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;YAC/D,CAAC,0BAA0B,EAAE,mDAA+C,CAAC;YAC7E,CAAC,iBAAiB,EAAE,sCAAoC,CAAC;YACzD,CAAC,qBAAqB,EAAE,4DAA0D,CAAC;YACnF,CAAC,2BAA2B,EAAE,2CAAyC,CAAC;YACxE,CAAC,2BAA2B,EAAE,6CAA2C,CAAC;SAC3E,CAAA;QACD,WAAyC,EAAX,2BAAW,EAAX,yBAAW,EAAX,IAAW,EAAE;YAAhC,sBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,+BAAwB,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SACpG;QAKK,OAAO,GAAuB;YAClC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC5C,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;YAC9D,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;YAC3C,8EAA8E;YAC9E,2FAA2F;YAC3F,+CAA+C;YAC/C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;YAC9C,CAAC,eAAe,EAAE,kBAAkB,CAAC;YACrC,CAAC,eAAe,EAAE,UAAU,CAAC;YAC7B,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;YAC/C,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;YACtD,CAAC,aAAa,EAAE,UAAU,CAAC;YAC3B,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAA;QACD,WAAiC,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;YAAxB,kBAAW,EAAV,cAAI,EAAE,GAAG,QAAA;YACb,GAAG,GAAG,IAAA,2CAA+B,EAAC,wBAAgB,GAAG,iBAAa,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,mCAA4B,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC/F;QAGK,QAAQ,GAAG,IAAA,2CAA+B,EAAC,2CAAyC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,mDAA4C,QAAQ,CAAE,CAAC,CAAA;QACpG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,mCAA4B,QAAQ,CAAE,CAAC,CAAA;QAGtF,MAAM,GAAG,IAAA,2CAA+B,EAAC,sFAAkF,CAAC,CAAA;QAClI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,+BAAwB,MAAM,CAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,iDAA0C,MAAM,CAAE,CAAC,CAAA;QAGjG,QAAQ,GAAG,IAAA,2CAA+B,EAAC,mGAA2F,CAAC,CAAA;QAC7I,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,gCAAyB,QAAQ,CAAE,CAAC,CAAA;QAC1F,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,yCAAkC,QAAQ,CAAE,CAAC,CAAA;QACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAiD,QAAQ,CAAE,CAAC,CAAA;QAMjG,EAAE,GAAG,IAAA,2CAA+B,EAAC,4GAAoG,CAAC,CAAA;QAChJ,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QACtG,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QAC3G,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAyB,EAAE,CAAE,CAAC,CAAA;QAElF,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAY,kCAAsB,OAAG,CAAC;YAAE,IAAI,CAAC,8BAAuB,EAAE,CAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,kCAA2B,EAAE,CAAE,CAAC,CAAA;QACxF,WAA4C,EAAxB,qDAAwB,EAAxB,sCAAwB,EAAxB,IAAwB,EAAE;YAAnC,KAAK;YACd,IAAI,kCAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wCAAiC,KAAK,eAAK,kCAAsB,CAAE,CAAC,CAAA;SACtH;QACD,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,CAAC,kCAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,IAAI,CAAC,6EAAsE,kCAAsB,CAAE,CAAC,CAAA;QAIzJ,aAAa,GAAG,IAAA,2CAA+B,EAAC,wEAAoE,CAAC,CAAA;QAC3H,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,IAAI,CAAC,sCAA+B,aAAa,CAAE,CAAC,CAAA;QAGtG,YAAY,GAAG,IAAA,2CAA+B,EAAC,2DAAuD,CAAC,CAAA;QAC7G,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kEAA2D,YAAY,CAAE,CAAC,CAAA;QACpH,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,iDAA0C,YAAY,CAAE,CAAC,CAAA;QAGvG,KAAK,GAAG,IAAA,2CAA+B,EAAC,6EAAyE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,IAAI,CAAC,6CAAsC,KAAK,CAAE,CAAC,CAAA;QAGlG,SAAS,GAAG,IAAA,2CAA+B,EAAC,kGAA8F,CAAC,CAAA;QACjJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,oCAA6B,SAAS,CAAE,CAAC,CAAA;QAKtG,OAAO,GAAG,IAAA,2CAA+B,EAAC,mDAAiD,CAAC,CAAA;QAClG,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,mCAA4B,OAAO,CAAE,CAAC,CAAA;QAE5I,KAAK,GAAG,IAAA,2CAA+B,EAAC,4HAAwH,CAAC,CAAA;QACvK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,KAAK,CAAE,CAAC,CAAA;QAEjH,IAAI,GAAG,IAAA,2CAA+B,EAAC,oDAAkD,CAAC,CAAA;QAChG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;QAErG,IAAI,GAAG,IAAA,2CAA+B,EAAC,0CAAwC,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,IAAI,CAAC,8BAAuB,IAAI,CAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,sCAA+B,IAAI,CAAE,CAAC,CAAA;QAEnF,GAAG,GAAG,IAAA,2CAA+B,EAAC,uEAAiE,CAAC,CAAA;QAC9G,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,GAAG,CAAE,CAAC,CAAA;QAEjH,OAAO,GAAG,IAAA,2CAA+B,EAAC,kDAAgD,CAAC,CAAA;QACjG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,gCAAyB,OAAO,CAAE,CAAC,CAAA;QAE3E,GAAG,GAAG,IAAA,2CAA+B,EAAC,wGAAsG,CAAC,CAAA;QACnJ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,+BAAwB,GAAG,CAAE,CAAC,CAAA;QAKlI,MAAM,GAAG,IAAA,8BAAkB,EAAC,6DAA2D,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,uDAAgD,MAAM,CAAE,CAAC,CAAA;QAKtG,aAAa,GAAG,qGAAmG,CAAA;QACnH,SAAS,GAAG,IAAA,8CAAkC,EAAC,aAAa,EAAE;YAClE,OAAO,EAAE,EAAE,KAAK,EAAE,sDAAoD,EAAS;YAC/E,SAAS,EAAE,EAAE;YACb,0BAA0B,EAAE,IAAI;YAChC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACI,QAAQ,GAAG,IAAA,2CAA+B,EAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,8CAAuC,QAAQ,CAAE,CAAC,CAAA;QAC1H,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,oDAA6C,QAAQ,CAAE,CAAC,CAAA;QACnG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,uDAAgD,QAAQ,CAAE,CAAC,CAAA;QAEnI,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;;;KAC7E,CAAA;AApKY,QAAA,qCAAqC,yCAoKjD;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,6CAAqC,GAAE;SACpC,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,UAAC,GAAG,IAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CAC9E"}

package/lib/cjs/tests/api_tests/templated_message_date_fields.test.d.ts

@@ -0,0 +1,3 @@
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const templated_message_date_field_tests: () => Promise<void>;
+//# sourceMappingURL=templated_message_date_fields.test.d.ts.map

package/lib/cjs/tests/api_tests/templated_message_date_fields.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templated_message_date_fields.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/templated_message_date_fields.test.ts"],"names":[],"mappings":"AAgIA,kFAAkF;AAClF,eAAO,MAAM,kCAAkC,qBAE9C,CAAA"}

package/lib/cjs/tests/api_tests/templated_message_date_fields.test.js

@@ -0,0 +1,202 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.templated_message_date_field_tests = void 0;
+require('source-map-support').install();
+var setup_isolated_1 = require("../setup_isolated");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Coverage for how `get_templated_message` renders enduser field values that LOOK like dates.
+ *
+ * The rule: a value stored as text renders as the author stored it. `message_templating.ts` only
+ * reformats an actual `Date` object, and a custom field is always a string.
+ *
+ * This exists because that rule was silently broken IN PRODUCTION, and had been for a long time.
+ * The templating code read `if (fieldValue instanceof Date || isDate(fieldValue))`. Validator
+ * 13.11.0's `isDate` was timezone-dependent — it compared a UTC-parsed date against a local-time
+ * `.getDate()` — so it returned false on a US developer's machine but TRUE in UTC, which is what
+ * the servers run. A date of birth stored as "1985-03-12" therefore took the Date branch in
+ * production, was parsed as UTC midnight and localized to the enduser's timezone, and rendered in a
+ * patient-facing SMS or email as "3/11/1985, 7:00:00 PM" — the PREVIOUS day, with a time nobody
+ * entered. A January date lost a year: "2024-01-01" rendered "12/31/2023".
+ *
+ * The validator bump did not cause this; it made it reproducible locally, which is how it surfaced.
+ * Removing the `isDate` half of the condition fixes it in every timezone.
+ *
+ * This is the ONE intentional production behavior change in an otherwise behavior-neutral
+ * dependency PR, made deliberately rather than shipping wrong dates to patients for another
+ * cycle. Every other validator touched here was pinned to production's existing behavior.
+ *
+ * So the assertions below are about the day not moving and no clock time appearing, which is what a
+ * patient would actually notice. A pure-function test could not have caught this: the function that
+ * does the work is module-private and the endpoint is the real surface.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/templated_message_date_fields
+ */
+/** Values a customer realistically stores in a date-ish custom field, and what must come back. */
+var DATE_SHAPED_VALUES = [
+    { label: 'ISO date (the shape that regressed)', value: '1985-03-12' },
+    { label: 'ISO date, recent', value: '2024-01-01' },
+    { label: 'slash-separated date', value: '1999/12/31' },
+    { label: 'MM-DD-YYYY (the dateOfBirth format)', value: '03-12-1985' },
+    { label: 'ISO datetime string', value: '2024-06-15T14:30:00.000Z' },
+    { label: 'leap day', value: '2000-02-29' },
+];
+/** A rendered date-only value must not have grown a clock time or a timezone abbreviation. */
+var LOOKS_REFORMATTED = /\d{1,2}:\d{2}|\bAM\b|\bPM\b|\bE[SD]T\b|\bUTC\b|\bGMT\b/;
+var templated_message_date_field_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, tenant, sdk, userId, fields, enduser, i, _a, label, value, plaintext, dob, control;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({ users: [{ isAdmin: true }] })];
+            case 1:
+                tenant = _b.sent();
+                _b.label = 2;
+            case 2:
+                _b.trys.push([2, , 10, 12]);
+                sdk = tenant.sdk;
+                userId = tenant.users[0].id;
+                fields = Object.fromEntries(DATE_SHAPED_VALUES.map(function (c, i) { return ["DateField".concat(i), c.value]; }));
+                return [4 /*yield*/, sdk.api.endusers.createOne({
+                        fname: 'Date',
+                        lname: 'Fields',
+                        timezone: 'America/New_York',
+                        fields: fields,
+                    })];
+            case 3:
+                enduser = _b.sent();
+                i = 0;
+                _b.label = 4;
+            case 4:
+                if (!(i < DATE_SHAPED_VALUES.length)) return [3 /*break*/, 7];
+                _a = DATE_SHAPED_VALUES[i], label = _a.label, value = _a.value;
+                return [4 /*yield*/, sdk.api.templates.get_templated_message({
+                        enduserId: enduser.id,
+                        userId: userId,
+                        channel: 'Chat',
+                        message: "[{{enduser.DateField".concat(i, "}}]"),
+                    })];
+            case 5:
+                plaintext = (_b.sent()).plaintext;
+                checks.push({
+                    label: "".concat(label, " renders exactly as stored"),
+                    pass: plaintext === "[".concat(value, "]"),
+                    detail: "stored ".concat(JSON.stringify(value), ", rendered ").concat(JSON.stringify(plaintext)),
+                });
+                // A second, independent signal for the specific symptom, so this still catches a shifted
+                // rendering even if the equality check above is ever loosened. Only meaningful for values
+                // that carry no time of their own — an ISO datetime legitimately contains one.
+                if (!LOOKS_REFORMATTED.test(value)) {
+                    checks.push({
+                        label: "".concat(label, " does not gain a clock time"),
+                        pass: !LOOKS_REFORMATTED.test(plaintext),
+                        detail: "rendered ".concat(JSON.stringify(plaintext)),
+                    });
+                }
+                _b.label = 6;
+            case 6:
+                i++;
+                return [3 /*break*/, 4];
+            case 7: return [4 /*yield*/, sdk.api.templates.get_templated_message({
+                    enduserId: enduser.id,
+                    userId: userId,
+                    channel: 'Chat',
+                    message: "DOB: {{enduser.DateField0}}",
+                })];
+            case 8:
+                dob = (_b.sent()).plaintext;
+                checks.push({
+                    label: 'a date of birth does not render as the previous day',
+                    pass: dob.includes('1985-03-12') && !dob.includes('3/11/1985'),
+                    detail: "rendered ".concat(JSON.stringify(dob)),
+                });
+                return [4 /*yield*/, sdk.api.templates.get_templated_message({
+                        enduserId: enduser.id,
+                        userId: userId,
+                        channel: 'Chat',
+                        message: "{{enduser.fname}} {{enduser.lname}}",
+                    })];
+            case 9:
+                control = (_b.sent()).plaintext;
+                checks.push({
+                    label: 'control: non-date fields are still templated at all',
+                    pass: control === 'Date Fields',
+                    detail: "rendered ".concat(JSON.stringify(control)),
+                });
+                return [2 /*return*/, checks];
+            case 10: return [4 /*yield*/, tenant.teardown()];
+            case 11:
+                _b.sent();
+                return [7 /*endfinally*/];
+            case 12: return [2 /*return*/];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+var templated_message_date_field_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Templated message date-shaped fields'];
+                return [4 /*yield*/, templated_message_date_field_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+exports.templated_message_date_field_tests = templated_message_date_field_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    (0, exports.templated_message_date_field_tests)()
+        .then(function () {
+        console.log("✅ Templated message date field test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Templated message date field test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=templated_message_date_fields.test.js.map

package/lib/cjs/tests/api_tests/templated_message_date_fields.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templated_message_date_fields.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/templated_message_date_fields.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oDAI0B;AAE1B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,kGAAkG;AAClG,IAAM,kBAAkB,GAAG;IACzB,EAAE,KAAK,EAAE,qCAAqC,EAAE,KAAK,EAAE,YAAY,EAAE;IACrE,EAAE,KAAK,EAAE,kBAAkB,EAAqB,KAAK,EAAE,YAAY,EAAE;IACrE,EAAE,KAAK,EAAE,sBAAsB,EAAiB,KAAK,EAAE,YAAY,EAAE;IACrE,EAAE,KAAK,EAAE,qCAAqC,EAAE,KAAK,EAAE,YAAY,EAAE;IACrE,EAAE,KAAK,EAAE,qBAAqB,EAAkB,KAAK,EAAE,0BAA0B,EAAE;IACnF,EAAE,KAAK,EAAE,UAAU,EAA6B,KAAK,EAAE,YAAY,EAAE;CACtE,CAAA;AAED,8FAA8F;AAC9F,IAAM,iBAAiB,GAAG,wDAAwD,CAAA;AAElF,IAAM,mCAAmC,GAAG;;;;;gBACpC,MAAM,GAAY,EAAE,CAAA;gBACX,qBAAM,IAAA,sCAAqB,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAApE,MAAM,GAAG,SAA2D;;;;gBAGhE,GAAG,GAAK,MAAM,IAAX,CAAW;gBAChB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;gBAE3B,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,mBAAY,CAAC,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAA1B,CAA0B,CAAC,CAAC,CAAA;gBAC/E,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC/C,KAAK,EAAE,MAAM;wBACb,KAAK,EAAE,QAAQ;wBACf,QAAQ,EAAE,kBAAkB;wBAC5B,MAAM,QAAA;qBACP,CAAC,EAAA;;gBALI,OAAO,GAAG,SAKd;gBAEO,CAAC,GAAG,CAAC;;;qBAAE,CAAA,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAA;gBACrC,KAAmB,kBAAkB,CAAC,CAAC,CAAC,EAAtC,KAAK,WAAA,EAAE,KAAK,WAAA,CAA0B;gBACxB,qBAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC;wBAClE,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrB,MAAM,QAAA;wBACN,OAAO,EAAE,MAAM;wBACf,OAAO,EAAE,8BAAuB,CAAC,QAAK;qBACvC,CAAC,EAAA;;gBALM,SAAS,GAAK,CAAA,SAKpB,CAAA,UALe;gBAOjB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,UAAG,KAAK,+BAA4B;oBAC3C,IAAI,EAAE,SAAS,KAAK,WAAI,KAAK,MAAG;oBAChC,MAAM,EAAE,iBAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,wBAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAE;iBACjF,CAAC,CAAA;gBACF,yFAAyF;gBACzF,0FAA0F;gBAC1F,+EAA+E;gBAC/E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,UAAG,KAAK,gCAA6B;wBAC5C,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;wBACxC,MAAM,EAAE,mBAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAE;qBAChD,CAAC,CAAA;iBACH;;;gBAvB4C,CAAC,EAAE,CAAA;;oBA2BvB,qBAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,MAAM,QAAA;oBACN,OAAO,EAAE,MAAM;oBACf,OAAO,EAAE,6BAA6B;iBACvC,CAAC,EAAA;;gBALiB,GAAG,GAAK,CAAA,SAKzB,CAAA,UALoB;gBAMtB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qDAAqD;oBAC5D,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC9D,MAAM,EAAE,mBAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAE;iBAC1C,CAAC,CAAA;gBAI6B,qBAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC;wBAC3E,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrB,MAAM,QAAA;wBACN,OAAO,EAAE,MAAM;wBACf,OAAO,EAAE,qCAAqC;qBAC/C,CAAC,EAAA;;gBALiB,OAAO,GAAK,CAAA,SAK7B,CAAA,UALwB;gBAM1B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qDAAqD;oBAC5D,IAAI,EAAE,OAAO,KAAK,aAAa;oBAC/B,MAAM,EAAE,mBAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAE;iBAC9C,CAAC,CAAA;gBAEF,sBAAO,MAAM,EAAA;qBAEb,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;;KAE1B,CAAA;AAED,kFAAkF;AAC3E,IAAM,kCAAkC,GAAG;;;;;gBAChD,KAAA,8BAAa,CAAA;sBAAC,sCAAsC;gBAAE,qBAAM,mCAAmC,EAAE,EAAA;;gBAAjG,4BAAsD,SAA2C,GAAC,CAAA;;;;KACnG,CAAA;AAFY,QAAA,kCAAkC,sCAE9C;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,0CAAkC,GAAE;SACjC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAA;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/templated_message_link_in_href.test.d.ts

@@ -0,0 +1,3 @@
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const templated_message_link_in_href_tests: () => Promise<void>;
+//# sourceMappingURL=templated_message_link_in_href.test.d.ts.map

package/lib/cjs/tests/api_tests/templated_message_link_in_href.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templated_message_link_in_href.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/templated_message_link_in_href.test.ts"],"names":[],"mappings":"AAyKA,kFAAkF;AAClF,eAAO,MAAM,oCAAoC,qBAEhD,CAAA"}