@things-factory/notification 10.1.247 → 10.1.250

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/notification",
-  "version": "10.1.247",
+  "version": "10.1.250",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,11 +30,11 @@
     "@material/web": "^2.0.0",
     "@operato/layout": "^10.0.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.247",
-    "@things-factory/email-base": "^10.1.247",
-    "@things-factory/i18n-base": "^10.1.247",
-    "@things-factory/organization": "^10.1.247",
-    "@things-factory/setting-base": "^10.1.247",
+    "@things-factory/auth-base": "^10.1.250",
+    "@things-factory/email-base": "^10.1.250",
+    "@things-factory/i18n-base": "^10.1.250",
+    "@things-factory/organization": "^10.1.250",
+    "@things-factory/setting-base": "^10.1.250",
     "@things-factory/shell": "^10.1.247",
     "clipboard": "^2.0.6",
     "firebase": "^9.14.0",
@@ -42,5 +42,5 @@
     "google": "^2.1.0",
     "marked": "^15.0.0"
   },
-  "gitHead": "3c672029b2ef4a09f3370d37e5d225392856a602"
+  "gitHead": "4fdb6d24ef24f43d9e158d4c6d6396ad3097bb9e"
 }

package/tests/notice-delivery.test.ts

@@ -5,9 +5,7 @@
  * The channels are fakes: what each one was handed is what is checked.
  */
 import { deliverNotice, type Notice, type NoticeChannelFunctions } from '../server/controllers/notice/deliver-notice'
-import { languageOf, noticeChannels, NOTICE_EMAIL, NOTICE_TEAMS_CHANNEL, teamsMessage } from '../server/controllers/notice/notice-channels'
-import { escapeHtml, noticeEmailForm, renderNoticeMarkdown, safeNoticeHref } from '../server/controllers/notice/notice-email'
-import { brandOf, DEFAULT_BRAND, textColorOn } from '../server/controllers/notice/app-brand'
+import { noticeChannels, NOTICE_EMAIL, NOTICE_TEAMS_CHANNEL, teamsMessage } from '../server/controllers/notice/notice-channels'
 
 type Calls = { push: any[]; mail: any[]; teams: { url: string; body: any }[]; reports: string[] }
 
@@ -58,12 +56,6 @@ describe('notice channels a domain turns on', () => {
     expect(noticeChannels({ 'Notice::teamsWebhook': 'https://x.example/hook' })).toEqual({ email: false, teamsChannelWebhook: undefined })
   })
 
-  test('a person reads their language; a person without one reads the default', () => {
-    expect(languageOf('ko-KR', 'en')).toBe('ko')
-    expect(languageOf('zh_CN', 'en')).toBe('zh')
-    expect(languageOf(null, 'ko-KR')).toBe('ko')
-    expect(languageOf(undefined, undefined)).toBe('en')
-  })
 })
 
 describe('delivering a notice', () => {
@@ -168,22 +160,6 @@ describe('delivering a notice', () => {
 describe('what a notice carries', () => {
   const words = { subject: '[결재 요청] <b>A&B</b>', body: 'line "one"\nline two', action: '열기', note: '결재함에서 확인' }
 
-  test('the mail shows values as text', () => {
-    const html = noticeEmailForm({ lang: 'ko', words, link: 'https://x.example/a?b=1&c="2"' })
-
-    expect(html).toContain('&lt;b&gt;A&amp;B&lt;/b&gt;')
-    expect(html).not.toContain('<b>A&B</b>')
-    expect(html).toContain('href="https://x.example/a?b=1&amp;c=&quot;2&quot;"')
-    expect(escapeHtml(`'`)).toBe('&#39;')
-  })
-
-  test('with no link the mail shows the note instead of a button', () => {
-    const html = noticeEmailForm({ lang: 'ko', words })
-
-    expect(html).not.toContain('href=')
-    expect(html).toContain('결재함에서 확인')
-  })
-
   test('the Teams message is one Adaptive Card for the channel, the link as its action', () => {
     const message = teamsMessage({ words, link: 'https://x.example/a' })
 
@@ -200,48 +176,6 @@ describe('what a notice carries', () => {
 })
 
 describe('a Markdown body in the mail (an announcement)', () => {
-  const BASE = 'https://office.example.com/domain/hatiolab/'
-
-  test('it is rendered as mail HTML', () => {
-    const html = renderNoticeMarkdown('# Title\n\n**bold** and a list:\n\n- one\n- two', BASE)
-
-    expect(html).toContain('<h1>Title</h1>')
-    expect(html).toContain('<strong>bold</strong>')
-    expect(html).toContain('<li>one</li>')
-  })
-
-  test('raw HTML is shown as text, never as markup', () => {
-    const html = renderNoticeMarkdown('<script>alert(1)</script>\n\nhi <img src=x onerror=alert(1)> <b>b</b>', BASE)
-
-    expect(html).not.toMatch(/<script|<img|<b>/)
-    expect(html).toContain('&lt;script&gt;')
-  })
-
-  test('links go to http(s), mailto and app addresses only', () => {
-    expect(safeNoticeHref('https://hatiolab.com/a', BASE)).toBe('https://hatiolab.com/a')
-    expect(safeNoticeHref('mailto:hr@hatiolab.com', BASE)).toBe('mailto:hr@hatiolab.com')
-    expect(safeNoticeHref('announcement-view?id=1', BASE)).toBe(`${BASE}announcement-view?id=1`)
-
-    for (const bad of ['javascript:alert(1)', ' JaVaScRiPt:alert(1)', 'java\tscript:alert(1)', 'data:text/html,<b>x</b>', 'vbscript:x', 'file:///etc/passwd']) {
-      expect(safeNoticeHref(bad, BASE)).toBeUndefined()
-    }
-  })
-
-  test('an app address has nowhere to go without the domain’s address', () => {
-    expect(safeNoticeHref('announcement-view?id=1')).toBeUndefined()
-    expect(safeNoticeHref('https://hatiolab.com/a')).toBe('https://hatiolab.com/a')
-  })
-
-  test('a link that is not allowed keeps its text and loses its address; an image is a link, never loaded', () => {
-    const html = renderNoticeMarkdown('[click](javascript:alert(1)) [form](announcement-view?id=1) ![logo](https://cdn.example.com/l.png)', BASE)
-
-    expect(html).not.toContain('javascript:')
-    expect(html).toContain('click')
-    expect(html).toContain(`<a href="${BASE}announcement-view?id=1">form</a>`)
-    expect(html).not.toContain('<img')
-    expect(html).toContain('<a href="https://cdn.example.com/l.png">logo</a>')
-  })
-
   test('the mail renders a Markdown notice; push shows the summary; the type stays as given', async () => {
     const { channels, calls } = fakeChannels({ [NOTICE_EMAIL]: 'on' })
     await deliverNotice(
@@ -329,42 +263,6 @@ describe('a notice to everyone in the domain (broadcast)', () => {
 })
 
 describe('whose mail it is', () => {
-  const words = { subject: '[공지] 점검', body: '본문', action: '열기', note: '알림함에서 확인' }
-
-  test('the brand is the manifest\'s name, tagline and brand colour; the theme colour stands in for a missing brand colour', () => {
-    expect(brandOf({ name: 'operato office', tagline: 'Reimagining Business.', brand_color: '#059669', theme_color: '#262e38' })).toEqual({
-      name: 'operato office',
-      tagline: 'Reimagining Business.',
-      color: '#059669'
-    })
-    expect(brandOf({ name: 'Operato Plant', theme_color: '#0E8A56' })).toEqual({ name: 'Operato Plant', tagline: undefined, color: '#0e8a56' })
-    expect(brandOf({ name: ' ', brand_color: 'green', theme_color: '#abc' })).toEqual({ name: DEFAULT_BRAND.name, tagline: undefined, color: '#aabbcc' })
-    expect(brandOf(undefined)).toEqual({ name: DEFAULT_BRAND.name, tagline: undefined, color: DEFAULT_BRAND.color })
-  })
-
-  test('the text on the brand colour is white while it keeps 3:1, black below', () => {
-    expect(textColorOn('#059669')).toBe('#ffffff')
-    expect(textColorOn('#262e38')).toBe('#ffffff')
-    expect(textColorOn('#34d399')).toBe('#000000')
-    expect(textColorOn('#ffffff')).toBe('#000000')
-  })
-
-  test('the mail names the application and its tagline, and its band and button are the brand colour - no logo image', () => {
-    const brand = { name: 'operato <office>', tagline: 'Reimagining Business.', color: '#059669' }
-    const html = noticeEmailForm({ lang: 'ko', words, link: 'https://x.example/a', brand })
-
-    expect(html).toContain('operato &lt;office&gt;')
-    expect(html).toContain('Reimagining Business.')
-    expect(html).not.toContain('<img')
-    expect(html).not.toContain('#22a6a7')
-    expect(html.match(/background-color:#059669/g)).toHaveLength(2)
-    expect(html).toContain('border-top:2px solid #059669')
-
-    const plain = noticeEmailForm({ lang: 'ko', words })
-    expect(plain).toContain(`>${DEFAULT_BRAND.name}<`)
-    expect(plain).toContain(`background-color:${DEFAULT_BRAND.color}`)
-  })
-
   test('the real channels carry the brand to the mail', async () => {
     const { channels, calls } = fakeChannels({ [NOTICE_EMAIL]: 'on' }, { brand: { name: 'Brand X', tagline: 'Tag Y', color: '#1d4ed8' } })
     await deliverNotice(notice(), channels)

package/dist-server/controllers/notice/app-brand.d.ts

@@ -1,17 +0,0 @@
-export type AppBrand = {
-    name: string;
-    tagline?: string;
-    /** `#rrggbb`. */
-    color: string;
-};
-/** What the notice mail had before an application said its own. */
-export declare const DEFAULT_BRAND: AppBrand;
-/** The brand a manifest declares, each part it leaves out the default's. */
-export declare function brandOf(manifest: any): AppBrand;
-/**
- * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text
- * (WCAG 1.4.3) - black below that.
- */
-export declare function textColorOn(color: string): '#000000' | '#ffffff';
-/** The running application's brand; the default when it ships no manifest or one that cannot be read. */
-export declare function appBrand(): AppBrand;

package/dist-server/controllers/notice/app-brand.js

@@ -1,61 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_BRAND = void 0;
-exports.brandOf = brandOf;
-exports.textColorOn = textColorOn;
-exports.appBrand = appBrand;
-const tslib_1 = require("tslib");
-/*
- * Whose mail it is - the application's brand name, tagline and colour, read from its web manifest
- * (`assets/manifest.json`), the one identity file every application ships and the image keeps. `name` is the brand
- * name; `tagline` and `brand_color` are the application's own members (a browser passes over members it does not
- * know); with no `brand_color` the manifest's `theme_color` stands in. Read once.
- */
-const fs_1 = tslib_1.__importDefault(require("fs"));
-const path_1 = tslib_1.__importDefault(require("path"));
-const env_1 = require("@things-factory/env");
-/** What the notice mail had before an application said its own. */
-exports.DEFAULT_BRAND = { name: 'Operato', color: '#22a6a7' };
-const HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
-/** A 3-digit colour as its 6 digits; anything not a hex colour is not a colour. */
-function hexOf(value) {
-    if (typeof value !== 'string' || !HEX.test(value.trim()))
-        return undefined;
-    const hex = value.trim().toLowerCase();
-    return hex.length === 4 ? `#${[...hex.slice(1)].map(digit => digit + digit).join('')}` : hex;
-}
-const textOf = (value) => (typeof value === 'string' && value.trim() ? value.trim() : undefined);
-/** The brand a manifest declares, each part it leaves out the default's. */
-function brandOf(manifest) {
-    return {
-        name: textOf(manifest?.name) ?? exports.DEFAULT_BRAND.name,
-        tagline: textOf(manifest?.tagline),
-        color: hexOf(manifest?.brand_color) ?? hexOf(manifest?.theme_color) ?? exports.DEFAULT_BRAND.color
-    };
-}
-/**
- * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text
- * (WCAG 1.4.3) - black below that.
- */
-function textColorOn(color) {
-    const channel = (at) => {
-        const value = parseInt(color.slice(at, at + 2), 16) / 255;
-        return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4;
-    };
-    const luminance = 0.2126 * channel(1) + 0.7152 * channel(3) + 0.0722 * channel(5);
-    return 1.05 / (luminance + 0.05) >= 3 ? '#ffffff' : '#000000';
-}
-let read;
-/** The running application's brand; the default when it ships no manifest or one that cannot be read. */
-function appBrand() {
-    if (!read) {
-        try {
-            read = brandOf(JSON.parse(fs_1.default.readFileSync(path_1.default.resolve(env_1.appRootPath, 'assets', 'manifest.json'), 'utf8')));
-        }
-        catch {
-            read = exports.DEFAULT_BRAND;
-        }
-    }
-    return read;
-}
-//# sourceMappingURL=app-brand.js.map

package/dist-server/controllers/notice/app-brand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-brand.js","sourceRoot":"","sources":["../../../server/controllers/notice/app-brand.ts"],"names":[],"mappings":";;;AAiCA,0BAMC;AAMD,kCAOC;AAKD,4BASC;;AAlED;;;;;GAKG;AACH,oDAAmB;AACnB,wDAAuB;AAEvB,6CAAiD;AASjD,mEAAmE;AACtD,QAAA,aAAa,GAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAE5E,MAAM,GAAG,GAAG,iCAAiC,CAAA;AAE7C,mFAAmF;AACnF,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9F,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAEzG,4EAA4E;AAC5E,SAAgB,OAAO,CAAC,QAAa;IACnC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,qBAAa,CAAC,IAAI;QAClD,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,qBAAa,CAAC,KAAK;KAC3F,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;QACzD,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAA;IAC5E,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC;AAED,IAAI,IAA0B,CAAA;AAE9B,yGAAyG;AACzG,SAAgB,QAAQ;IACtB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,OAAO,CAAC,iBAAW,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,qBAAa,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["/*\n * Whose mail it is - the application's brand name, tagline and colour, read from its web manifest\n * (`assets/manifest.json`), the one identity file every application ships and the image keeps. `name` is the brand\n * name; `tagline` and `brand_color` are the application's own members (a browser passes over members it does not\n * know); with no `brand_color` the manifest's `theme_color` stands in. Read once.\n */\nimport fs from 'fs'\nimport path from 'path'\n\nimport { appRootPath } from '@things-factory/env'\n\nexport type AppBrand = {\n  name: string\n  tagline?: string\n  /** `#rrggbb`. */\n  color: string\n}\n\n/** What the notice mail had before an application said its own. */\nexport const DEFAULT_BRAND: AppBrand = { name: 'Operato', color: '#22a6a7' }\n\nconst HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i\n\n/** A 3-digit colour as its 6 digits; anything not a hex colour is not a colour. */\nfunction hexOf(value: unknown): string | undefined {\n  if (typeof value !== 'string' || !HEX.test(value.trim())) return undefined\n  const hex = value.trim().toLowerCase()\n  return hex.length === 4 ? `#${[...hex.slice(1)].map(digit => digit + digit).join('')}` : hex\n}\n\nconst textOf = (value: unknown) => (typeof value === 'string' && value.trim() ? value.trim() : undefined)\n\n/** The brand a manifest declares, each part it leaves out the default's. */\nexport function brandOf(manifest: any): AppBrand {\n  return {\n    name: textOf(manifest?.name) ?? DEFAULT_BRAND.name,\n    tagline: textOf(manifest?.tagline),\n    color: hexOf(manifest?.brand_color) ?? hexOf(manifest?.theme_color) ?? DEFAULT_BRAND.color\n  }\n}\n\n/**\n * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text\n * (WCAG 1.4.3) - black below that.\n */\nexport function textColorOn(color: string): '#000000' | '#ffffff' {\n  const channel = (at: number) => {\n    const value = parseInt(color.slice(at, at + 2), 16) / 255\n    return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4\n  }\n  const luminance = 0.2126 * channel(1) + 0.7152 * channel(3) + 0.0722 * channel(5)\n  return 1.05 / (luminance + 0.05) >= 3 ? '#ffffff' : '#000000'\n}\n\nlet read: AppBrand | undefined\n\n/** The running application's brand; the default when it ships no manifest or one that cannot be read. */\nexport function appBrand(): AppBrand {\n  if (!read) {\n    try {\n      read = brandOf(JSON.parse(fs.readFileSync(path.resolve(appRootPath, 'assets', 'manifest.json'), 'utf8')))\n    } catch {\n      read = DEFAULT_BRAND\n    }\n  }\n  return read\n}\n"]}

package/dist-server/controllers/notice/notice-email.d.ts

@@ -1,32 +0,0 @@
-import { type AppBrand } from './app-brand.js';
-import type { NoticeWords } from './notice-channels.js';
-/** Every value goes into the HTML through this - a subject like `<b>` or `A&B` stays text. */
-export declare function escapeHtml(value: unknown): string;
-/**
- * Where a link in a notice may go: http(s) and mailto as written, and an address of the app (no scheme) under `base`,
- * the domain's own address. With no base an app address has nowhere to go and is dropped, as is every other scheme -
- * `javascript:` in any spelling the URL parser reads as one.
- */
-export declare function safeNoticeHref(href: string | null | undefined, base?: string): string | undefined;
-/**
- * Markdown as mail HTML, rendered here on the server. Raw HTML in the text is shown as text, never as markup; a link or
- * an image becomes a link only to an address `safeNoticeHref` allows, and an image is not loaded - it is shown as a
- * link with its alt text, so a mail does not fetch from wherever its writer pointed.
- */
-export declare function renderNoticeMarkdown(markdown: string, base?: string): string;
-/**
- * The notice mail (ADR-0164) - the head, band, button and foot of the auth mails, so a person knows the sender. The head
- * names the application that sends it with its tagline, and the band and button are in its brand colour (`appBrand`).
- * Without a link (a notice sent with no request to take the address from) the button gives way to the note.
- */
-export declare function noticeEmailForm({ lang, words, link, format, base, brand }: {
-    lang: string;
-    words: NoticeWords;
-    link?: string;
-    /** How the body is written - an announcement's is Markdown. */
-    format?: 'text' | 'markdown';
-    /** The domain's address, under which an app address in a Markdown body is resolved. */
-    base?: string;
-    /** The application sending it. */
-    brand?: AppBrand;
-}): string;

package/dist-server/controllers/notice/notice-email.js

@@ -1,129 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.escapeHtml = escapeHtml;
-exports.safeNoticeHref = safeNoticeHref;
-exports.renderNoticeMarkdown = renderNoticeMarkdown;
-exports.noticeEmailForm = noticeEmailForm;
-const marked_1 = require("marked");
-const app_brand_js_1 = require("./app-brand.js");
-/** Every value goes into the HTML through this - a subject like `<b>` or `A&B` stays text. */
-function escapeHtml(value) {
-    return String(value ?? '')
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
-/** The schemes a link in a notice may take; anything else is shown as its text. */
-const SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
-const NO_BASE = 'https://no-base.invalid/';
-/**
- * Where a link in a notice may go: http(s) and mailto as written, and an address of the app (no scheme) under `base`,
- * the domain's own address. With no base an app address has nowhere to go and is dropped, as is every other scheme -
- * `javascript:` in any spelling the URL parser reads as one.
- */
-function safeNoticeHref(href, base) {
-    const raw = String(href ?? '').trim();
-    if (!raw)
-        return undefined;
-    let url;
-    try {
-        url = new URL(raw, base || NO_BASE);
-    }
-    catch {
-        return undefined;
-    }
-    if (!SAFE_PROTOCOLS.has(url.protocol))
-        return undefined;
-    if (url.origin === new URL(NO_BASE).origin)
-        return undefined;
-    return url.href;
-}
-/**
- * Markdown as mail HTML, rendered here on the server. Raw HTML in the text is shown as text, never as markup; a link or
- * an image becomes a link only to an address `safeNoticeHref` allows, and an image is not loaded - it is shown as a
- * link with its alt text, so a mail does not fetch from wherever its writer pointed.
- */
-function renderNoticeMarkdown(markdown, base) {
-    const marked = new marked_1.Marked({
-        gfm: true,
-        breaks: true,
-        async: false,
-        renderer: {
-            html({ text }) {
-                return escapeHtml(text);
-            },
-            link({ href, title, tokens }) {
-                const label = this.parser.parseInline(tokens);
-                const safe = safeNoticeHref(href, base);
-                return safe ? `<a href="${escapeHtml(safe)}"${title ? ` title="${escapeHtml(title)}"` : ''}>${label}</a>` : label;
-            },
-            image({ href, text }) {
-                const safe = safeNoticeHref(href, base);
-                return safe ? `<a href="${escapeHtml(safe)}">${escapeHtml(text || safe)}</a>` : escapeHtml(text);
-            }
-        }
-    });
-    return marked.parse(String(markdown ?? ''));
-}
-/**
- * The notice mail (ADR-0164) - the head, band, button and foot of the auth mails, so a person knows the sender. The head
- * names the application that sends it with its tagline, and the band and button are in its brand colour (`appBrand`).
- * Without a link (a notice sent with no request to take the address from) the button gives way to the note.
- */
-function noticeEmailForm({ lang, words, link, format = 'text', base, brand = app_brand_js_1.DEFAULT_BRAND }) {
-    const color = escapeHtml(brand.color);
-    const onColor = (0, app_brand_js_1.textColorOn)(brand.color);
-    const action = link
-        ? `<a
-            href="${escapeHtml(link)}"
-            style="display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:${color};padding:7px 15px;color:${onColor};font-size:18px;font-weight:bold;text-decoration:none;"
-            >${escapeHtml(words.action)}</a
-          >`
-        : `<span style="display:block;color:#555">${escapeHtml(words.note)}</span>`;
-    return `
-  <html lang="${escapeHtml(lang)}">
-    <head>
-      <meta charset="utf-8" />
-      <title>${escapeHtml(words.subject)}</title>
-      <meta name="author" content="hatiolab" />
-      <meta name="google" content="notranslate"/>
-    </head>
-
-    <body>
-      <div style="background-color:#f6f6f6">
-        <!--header begin-->
-        <div style="background-color:#fff;padding:10px 20px;border-top:2px solid ${color};">
-          <span style="font-size:20px;font-weight:bold;color:#1f2933">${escapeHtml(brand.name)}</span>${brand.tagline ? `<span style="margin-left:10px;font-size:13px;color:#6b7280">${escapeHtml(brand.tagline)}</span>` : ''}
-        </div>
-        <!--header end-->
-
-        <!--title begin-->
-        <div style="background-color:${color};padding:12px 10px 10px 10px;min-height:50px;">
-          <span style="display:block;color:${onColor};font-size:24px;font-weight:bold;margin-left:40px"
-            >${escapeHtml(words.subject)}</span
-          >
-        </div>
-        <!--title end-->
-
-        <!--body begin-->
-        ${format === 'markdown'
-        ? `<div style="padding:10px 20px;line-height:1.5;font-size:16px">${renderNoticeMarkdown(words.body, base)}</div>`
-        : `<p style="padding:10px 20px;line-height:1.5;font-size:16px;white-space:pre-line">${escapeHtml(words.body)}</p>`}
-        <p style="padding:0 20px 10px 20px;font-size:16px">
-          ${action}
-        </p>
-        <!--body end-->
-
-        <!--footer begin-->
-        <div style="background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef">
-          © Hatio, Lab. Inc. All rights reserved.
-        </div>
-        <!--footer end-->
-      </div>
-    </body>
-  </html>
-  `;
-}
-//# sourceMappingURL=notice-email.js.map

package/dist-server/controllers/notice/notice-email.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"notice-email.js","sourceRoot":"","sources":["../../../server/controllers/notice/notice-email.ts"],"names":[],"mappings":";;AAMA,gCAOC;AAWD,wCAcC;AAOD,oDAsBC;AAOD,0CA2EC;AArJD,mCAA+B;AAE/B,iDAA0E;AAG1E,8FAA8F;AAC9F,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,mFAAmF;AACnF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AAC9D,MAAM,OAAO,GAAG,0BAA0B,CAAA;AAE1C;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAA+B,EAAE,IAAa;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAE1B,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,QAAgB,EAAE,IAAa;IAClE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC;QACxB,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE;YACR,IAAI,CAAC,EAAE,IAAI,EAAE;gBACX,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACvC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;YACnH,CAAC;YACD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAClB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACvC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAClG,CAAC;SACF;KACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAW,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,MAAM,EACf,IAAI,EACJ,KAAK,GAAG,4BAAa,EAWtB;IACC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC;oBACc,UAAU,CAAC,IAAI,CAAC;mGAC+D,KAAK,2BAA2B,OAAO;eAC3H,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3B;QACR,CAAC,CAAC,0CAA0C,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAA;IAE7E,OAAO;gBACO,UAAU,CAAC,IAAI,CAAC;;;eAGjB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;;;;;;;;mFAQ2C,KAAK;wEAChB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAClF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+DAA+D,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EACtH;;;;;uCAK6B,KAAK;6CACC,OAAO;eACrC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;;;;;;UAO9B,MAAM,KAAK,UAAU;QACnB,CAAC,CAAC,iEAAiE,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ;QACjH,CAAC,CAAC,oFAAoF,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAChH;;YAEI,MAAM;;;;;;;;;;;;GAYf,CAAA;AACH,CAAC","sourcesContent":["import { Marked } from 'marked'\n\nimport { DEFAULT_BRAND, textColorOn, type AppBrand } from './app-brand.js'\nimport type { NoticeWords } from './notice-channels.js'\n\n/** Every value goes into the HTML through this - a subject like `<b>` or `A&B` stays text. */\nexport function escapeHtml(value: unknown): string {\n  return String(value ?? '')\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#39;')\n}\n\n/** The schemes a link in a notice may take; anything else is shown as its text. */\nconst SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])\nconst NO_BASE = 'https://no-base.invalid/'\n\n/**\n * Where a link in a notice may go: http(s) and mailto as written, and an address of the app (no scheme) under `base`,\n * the domain's own address. With no base an app address has nowhere to go and is dropped, as is every other scheme -\n * `javascript:` in any spelling the URL parser reads as one.\n */\nexport function safeNoticeHref(href: string | null | undefined, base?: string): string | undefined {\n  const raw = String(href ?? '').trim()\n  if (!raw) return undefined\n\n  let url: URL\n  try {\n    url = new URL(raw, base || NO_BASE)\n  } catch {\n    return undefined\n  }\n\n  if (!SAFE_PROTOCOLS.has(url.protocol)) return undefined\n  if (url.origin === new URL(NO_BASE).origin) return undefined\n  return url.href\n}\n\n/**\n * Markdown as mail HTML, rendered here on the server. Raw HTML in the text is shown as text, never as markup; a link or\n * an image becomes a link only to an address `safeNoticeHref` allows, and an image is not loaded - it is shown as a\n * link with its alt text, so a mail does not fetch from wherever its writer pointed.\n */\nexport function renderNoticeMarkdown(markdown: string, base?: string): string {\n  const marked = new Marked({\n    gfm: true,\n    breaks: true,\n    async: false,\n    renderer: {\n      html({ text }) {\n        return escapeHtml(text)\n      },\n      link({ href, title, tokens }) {\n        const label = this.parser.parseInline(tokens)\n        const safe = safeNoticeHref(href, base)\n        return safe ? `<a href=\"${escapeHtml(safe)}\"${title ? ` title=\"${escapeHtml(title)}\"` : ''}>${label}</a>` : label\n      },\n      image({ href, text }) {\n        const safe = safeNoticeHref(href, base)\n        return safe ? `<a href=\"${escapeHtml(safe)}\">${escapeHtml(text || safe)}</a>` : escapeHtml(text)\n      }\n    }\n  })\n\n  return marked.parse(String(markdown ?? '')) as string\n}\n\n/**\n * The notice mail (ADR-0164) - the head, band, button and foot of the auth mails, so a person knows the sender. The head\n * names the application that sends it with its tagline, and the band and button are in its brand colour (`appBrand`).\n * Without a link (a notice sent with no request to take the address from) the button gives way to the note.\n */\nexport function noticeEmailForm({\n  lang,\n  words,\n  link,\n  format = 'text',\n  base,\n  brand = DEFAULT_BRAND\n}: {\n  lang: string\n  words: NoticeWords\n  link?: string\n  /** How the body is written - an announcement's is Markdown. */\n  format?: 'text' | 'markdown'\n  /** The domain's address, under which an app address in a Markdown body is resolved. */\n  base?: string\n  /** The application sending it. */\n  brand?: AppBrand\n}) {\n  const color = escapeHtml(brand.color)\n  const onColor = textColorOn(brand.color)\n  const action = link\n    ? `<a\n            href=\"${escapeHtml(link)}\"\n            style=\"display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:${color};padding:7px 15px;color:${onColor};font-size:18px;font-weight:bold;text-decoration:none;\"\n            >${escapeHtml(words.action)}</a\n          >`\n    : `<span style=\"display:block;color:#555\">${escapeHtml(words.note)}</span>`\n\n  return `\n  <html lang=\"${escapeHtml(lang)}\">\n    <head>\n      <meta charset=\"utf-8\" />\n      <title>${escapeHtml(words.subject)}</title>\n      <meta name=\"author\" content=\"hatiolab\" />\n      <meta name=\"google\" content=\"notranslate\"/>\n    </head>\n\n    <body>\n      <div style=\"background-color:#f6f6f6\">\n        <!--header begin-->\n        <div style=\"background-color:#fff;padding:10px 20px;border-top:2px solid ${color};\">\n          <span style=\"font-size:20px;font-weight:bold;color:#1f2933\">${escapeHtml(brand.name)}</span>${\n            brand.tagline ? `<span style=\"margin-left:10px;font-size:13px;color:#6b7280\">${escapeHtml(brand.tagline)}</span>` : ''\n          }\n        </div>\n        <!--header end-->\n\n        <!--title begin-->\n        <div style=\"background-color:${color};padding:12px 10px 10px 10px;min-height:50px;\">\n          <span style=\"display:block;color:${onColor};font-size:24px;font-weight:bold;margin-left:40px\"\n            >${escapeHtml(words.subject)}</span\n          >\n        </div>\n        <!--title end-->\n\n        <!--body begin-->\n        ${\n          format === 'markdown'\n            ? `<div style=\"padding:10px 20px;line-height:1.5;font-size:16px\">${renderNoticeMarkdown(words.body, base)}</div>`\n            : `<p style=\"padding:10px 20px;line-height:1.5;font-size:16px;white-space:pre-line\">${escapeHtml(words.body)}</p>`\n        }\n        <p style=\"padding:0 20px 10px 20px;font-size:16px\">\n          ${action}\n        </p>\n        <!--body end-->\n\n        <!--footer begin-->\n        <div style=\"background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef\">\n          © Hatio, Lab. Inc. All rights reserved.\n        </div>\n        <!--footer end-->\n      </div>\n    </body>\n  </html>\n  `\n}\n"]}