@things-factory/notification 10.1.248 → 10.1.254

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/notification",
-  "version": "10.1.248",
+  "version": "10.1.254",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,17 +30,17 @@
     "@material/web": "^2.0.0",
     "@operato/layout": "^10.0.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.247",
-    "@things-factory/email-base": "^10.1.247",
-    "@things-factory/i18n-base": "^10.1.247",
-    "@things-factory/organization": "^10.1.247",
-    "@things-factory/setting-base": "^10.1.247",
-    "@things-factory/shell": "^10.1.247",
+    "@things-factory/auth-base": "^10.1.254",
+    "@things-factory/email-base": "^10.1.254",
+    "@things-factory/i18n-base": "^10.1.254",
+    "@things-factory/organization": "^10.1.254",
+    "@things-factory/setting-base": "^10.1.254",
+    "@things-factory/shell": "^10.1.254",
     "clipboard": "^2.0.6",
     "firebase": "^9.14.0",
     "firebase-admin": "^11.3.0",
     "google": "^2.1.0",
     "marked": "^15.0.0"
   },
-  "gitHead": "ca390a4b791d6e8630388167d3da6031034b5a5e"
+  "gitHead": "793e2fd617db5bb917ec892e64956fb690f7e7b0"
 }

package/tests/notice-delivery.test.ts

@@ -5,9 +5,7 @@
  * The channels are fakes: what each one was handed is what is checked.
  */
 import { deliverNotice, type Notice, type NoticeChannelFunctions } from '../server/controllers/notice/deliver-notice'
-import { languageOf, noticeChannels, NOTICE_EMAIL, NOTICE_TEAMS_CHANNEL, teamsMessage } from '../server/controllers/notice/notice-channels'
-import { escapeHtml, noticeEmailForm, renderNoticeMarkdown, safeNoticeHref } from '../server/controllers/notice/notice-email'
-import { brandOf, DEFAULT_BRAND, textColorOn } from '../server/controllers/notice/app-brand'
+import { noticeChannels, NOTICE_EMAIL, NOTICE_TEAMS_CHANNEL, teamsMessage } from '../server/controllers/notice/notice-channels'
 
 type Calls = { push: any[]; mail: any[]; teams: { url: string; body: any }[]; reports: string[] }
 
@@ -58,12 +56,6 @@ describe('notice channels a domain turns on', () => {
     expect(noticeChannels({ 'Notice::teamsWebhook': 'https://x.example/hook' })).toEqual({ email: false, teamsChannelWebhook: undefined })
   })
 
-  test('a person reads their language; a person without one reads the default', () => {
-    expect(languageOf('ko-KR', 'en')).toBe('ko')
-    expect(languageOf('zh_CN', 'en')).toBe('zh')
-    expect(languageOf(null, 'ko-KR')).toBe('ko')
-    expect(languageOf(undefined, undefined)).toBe('en')
-  })
 })
 
 describe('delivering a notice', () => {
@@ -168,22 +160,6 @@ describe('delivering a notice', () => {
 describe('what a notice carries', () => {
   const words = { subject: '[결재 요청] <b>A&B</b>', body: 'line "one"\nline two', action: '열기', note: '결재함에서 확인' }
 
-  test('the mail shows values as text', () => {
-    const html = noticeEmailForm({ lang: 'ko', words, link: 'https://x.example/a?b=1&c="2"' })
-
-    expect(html).toContain('&lt;b&gt;A&amp;B&lt;/b&gt;')
-    expect(html).not.toContain('<b>A&B</b>')
-    expect(html).toContain('href="https://x.example/a?b=1&amp;c=&quot;2&quot;"')
-    expect(escapeHtml(`'`)).toBe('&#39;')
-  })
-
-  test('with no link the mail shows the note instead of a button', () => {
-    const html = noticeEmailForm({ lang: 'ko', words })
-
-    expect(html).not.toContain('href=')
-    expect(html).toContain('결재함에서 확인')
-  })
-
   test('the Teams message is one Adaptive Card for the channel, the link as its action', () => {
     const message = teamsMessage({ words, link: 'https://x.example/a' })
 
@@ -200,48 +176,6 @@ describe('what a notice carries', () => {
 })
 
 describe('a Markdown body in the mail (an announcement)', () => {
-  const BASE = 'https://office.example.com/domain/hatiolab/'
-
-  test('it is rendered as mail HTML', () => {
-    const html = renderNoticeMarkdown('# Title\n\n**bold** and a list:\n\n- one\n- two', BASE)
-
-    expect(html).toContain('<h1>Title</h1>')
-    expect(html).toContain('<strong>bold</strong>')
-    expect(html).toContain('<li>one</li>')
-  })
-
-  test('raw HTML is shown as text, never as markup', () => {
-    const html = renderNoticeMarkdown('<script>alert(1)</script>\n\nhi <img src=x onerror=alert(1)> <b>b</b>', BASE)
-
-    expect(html).not.toMatch(/<script|<img|<b>/)
-    expect(html).toContain('&lt;script&gt;')
-  })
-
-  test('links go to http(s), mailto and app addresses only', () => {
-    expect(safeNoticeHref('https://hatiolab.com/a', BASE)).toBe('https://hatiolab.com/a')
-    expect(safeNoticeHref('mailto:hr@hatiolab.com', BASE)).toBe('mailto:hr@hatiolab.com')
-    expect(safeNoticeHref('announcement-view?id=1', BASE)).toBe(`${BASE}announcement-view?id=1`)
-
-    for (const bad of ['javascript:alert(1)', ' JaVaScRiPt:alert(1)', 'java\tscript:alert(1)', 'data:text/html,<b>x</b>', 'vbscript:x', 'file:///etc/passwd']) {
-      expect(safeNoticeHref(bad, BASE)).toBeUndefined()
-    }
-  })
-
-  test('an app address has nowhere to go without the domain’s address', () => {
-    expect(safeNoticeHref('announcement-view?id=1')).toBeUndefined()
-    expect(safeNoticeHref('https://hatiolab.com/a')).toBe('https://hatiolab.com/a')
-  })
-
-  test('a link that is not allowed keeps its text and loses its address; an image is a link, never loaded', () => {
-    const html = renderNoticeMarkdown('[click](javascript:alert(1)) [form](announcement-view?id=1) ![logo](https://cdn.example.com/l.png)', BASE)
-
-    expect(html).not.toContain('javascript:')
-    expect(html).toContain('click')
-    expect(html).toContain(`<a href="${BASE}announcement-view?id=1">form</a>`)
-    expect(html).not.toContain('<img')
-    expect(html).toContain('<a href="https://cdn.example.com/l.png">logo</a>')
-  })
-
   test('the mail renders a Markdown notice; push shows the summary; the type stays as given', async () => {
     const { channels, calls } = fakeChannels({ [NOTICE_EMAIL]: 'on' })
     await deliverNotice(
@@ -329,55 +263,6 @@ describe('a notice to everyone in the domain (broadcast)', () => {
 })
 
 describe('whose mail it is', () => {
-  const words = { subject: '[공지] 점검', body: '본문', action: '열기', note: '알림함에서 확인' }
-
-  test('the brand is the manifest\'s name, tagline and brand colour; the theme colour stands in for a missing brand colour', () => {
-    expect(brandOf({ name: 'operato office', tagline: 'Reimagining Business.', brand_color: '#059669', theme_color: '#262e38' })).toEqual({
-      name: 'operato office',
-      tagline: 'Reimagining Business.',
-      color: '#059669'
-    })
-    expect(brandOf({ name: 'Operato Plant', theme_color: '#0E8A56' })).toEqual({ name: 'Operato Plant', tagline: undefined, color: '#0e8a56' })
-    expect(brandOf({ name: ' ', brand_color: 'green', theme_color: '#abc' })).toEqual({ name: DEFAULT_BRAND.name, tagline: undefined, color: '#aabbcc' })
-    expect(brandOf(undefined)).toEqual({ name: DEFAULT_BRAND.name, tagline: undefined, color: DEFAULT_BRAND.color })
-  })
-
-  test('the text on the brand colour is white while it keeps 3:1, black below', () => {
-    expect(textColorOn('#059669')).toBe('#ffffff')
-    expect(textColorOn('#262e38')).toBe('#ffffff')
-    expect(textColorOn('#34d399')).toBe('#000000')
-    expect(textColorOn('#ffffff')).toBe('#000000')
-  })
-
-  test('the mail names the application and its tagline, and its band and button are the brand colour - no logo image', () => {
-    const brand = { name: 'operato <office>', tagline: 'Reimagining Business.', color: '#059669' }
-    const html = noticeEmailForm({ lang: 'ko', words, link: 'https://x.example/a', brand })
-
-    expect(html).toContain('operato &lt;office&gt;')
-    expect(html).toContain('Reimagining Business.')
-    expect(html).not.toContain('<img')
-    expect(html).not.toContain('#22a6a7')
-    expect(html.match(/background-color:#059669/g)).toHaveLength(2)
-    expect(html).toContain('border-top:2px solid #059669')
-
-    const plain = noticeEmailForm({ lang: 'ko', words })
-    expect(plain).toContain(`>${DEFAULT_BRAND.name}<`)
-    expect(plain).toContain(`background-color:${DEFAULT_BRAND.color}`)
-  })
-
-  test('the colours hold where a mail program drops styles: each sits on its table cell as bgcolor, the mail says it is light, the tagline has its own cell', () => {
-    const brand = { name: 'operato office', tagline: 'Reimagining Business.', color: '#059669' }
-    const html = noticeEmailForm({ lang: 'ko', words, link: 'https://x.example/a', brand })
-
-    expect(html).toContain('<meta name="color-scheme" content="light" />')
-    expect(html.match(/<td bgcolor="#059669"/g)).toHaveLength(2)
-    expect(html).toContain('<td bgcolor="#3d5874"')
-    expect(html).toContain('<td bgcolor="#ffffff"')
-    expect(html).toMatch(/operato office<\/td>\s*<td[^>]*>&nbsp;Reimagining Business\.<\/td>/)
-    expect(html).not.toMatch(/margin-left/)
-    expect(html).not.toMatch(/<div style="background-color/)
-  })
-
   test('the real channels carry the brand to the mail', async () => {
     const { channels, calls } = fakeChannels({ [NOTICE_EMAIL]: 'on' }, { brand: { name: 'Brand X', tagline: 'Tag Y', color: '#1d4ed8' } })
     await deliverNotice(notice(), channels)

package/tests/push-tokens.test.ts

@@ -0,0 +1,190 @@
+/*
+ * Web push reaches a person at every browser that registered an FCM token for them, sent one token at a time over
+ * FCM HTTP v1. A token FCM says is gone is forgotten.
+ *
+ * Until 2026-11-05 a person was reached through a legacy FCM device group, keyed by a server key no config set and
+ * that Google shut down in 2024 - register made no group and notify found none, so web push reached no one.
+ *
+ * FCM is a fake: what it was handed is what is checked. Reads dist-server (entities need tsc's decorator metadata) -
+ * run the package's build:server first.
+ */
+import { DataSource } from 'typeorm'
+
+import { NamingStrategy, addDataSource, entities as shellEntities } from '@things-factory/shell'
+import { User, entities as authEntities } from '@things-factory/auth-base'
+import { config } from '@things-factory/env'
+
+const mockMessaging = {
+  multicasts: [] as any[],
+  answer: (tokens: string[]) => tokens.map(() => ({ success: true }) as any),
+  async sendEachForMulticast(message: any) {
+    this.multicasts.push(message)
+    const responses = this.answer(message.tokens)
+    return { responses, successCount: responses.filter(r => r.success).length, failureCount: responses.filter(r => !r.success).length }
+  },
+  async send() {
+    return 'sent'
+  }
+}
+
+jest.mock('firebase-admin/app', () => ({ initializeApp: () => ({}), cert: (account: any) => account }))
+jest.mock('firebase-admin/messaging', () => ({ getMessaging: () => mockMessaging }))
+
+let dataSource: DataSource
+let fcm: any
+let notifierOf: any
+let deliverNotice: any
+let NotificationToken: any
+let kim: User
+let lee: User
+
+const tokensOf = async (user: User) =>
+  (await dataSource.getRepository(NotificationToken).find({ where: { user: { id: user.id } } })).map((one: any) => one.token).sort()
+
+beforeAll(async () => {
+  config.set('notification', { fcm: { serviceAccount: { project_id: 'test' } } })
+  fcm = require('../dist-server/controllers/fcm.js')
+  NotificationToken = require('../dist-server/service/notification-token/notification-token.js').NotificationToken
+  notifierOf = require('../dist-server/middlewares/notification-middleware.js').notifierOf
+  deliverNotice = require('../dist-server/controllers/notice/deliver-notice.js').deliverNotice
+
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities, ...authEntities, NotificationToken],
+    logging: false
+  })
+  await dataSource.initialize()
+  addDataSource('default', dataSource)
+
+  const users = dataSource.getRepository(User)
+  kim = await users.save({ name: 'kim', username: 'kim', email: 'kim@test.com' } as any)
+  lee = await users.save({ name: 'lee', username: 'lee', email: 'lee@test.com' } as any)
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+beforeEach(async () => {
+  await dataSource.getRepository(NotificationToken).clear()
+  mockMessaging.multicasts = []
+  mockMessaging.answer = tokens => tokens.map(() => ({ success: true }))
+})
+
+describe('registering a browser', () => {
+  test('keeps each browser of a person, once', async () => {
+    expect(await fcm.register(kim, { subscription: 'kim-phone' })).toBe(true)
+    await fcm.register(kim, { subscription: 'kim-laptop' })
+    await fcm.register(kim, { subscription: 'kim-phone' })
+
+    expect(await tokensOf(kim)).toEqual(['kim-laptop', 'kim-phone'])
+  })
+
+  test('a browser someone else signs in on and turns notices on for moves to them', async () => {
+    await fcm.register(kim, { subscription: 'shared-tablet' })
+    await fcm.register(lee, { subscription: 'shared-tablet' })
+
+    expect(await tokensOf(kim)).toEqual([])
+    expect(await tokensOf(lee)).toEqual(['shared-tablet'])
+  })
+
+  test('turning notices off forgets the browser - only for the person holding it', async () => {
+    await fcm.register(kim, { subscription: 'kim-phone' })
+
+    await fcm.unregister(lee, { subscription: 'kim-phone' })
+    expect(await tokensOf(kim)).toEqual(['kim-phone'])
+
+    await fcm.unregister(kim, { subscription: 'kim-phone' })
+    expect(await tokensOf(kim)).toEqual([])
+  })
+})
+
+describe('pushing to people', () => {
+  test('goes to every browser of each receiver over HTTP v1, with data as strings', async () => {
+    await fcm.register(kim, { subscription: 'kim-phone' })
+    await fcm.register(kim, { subscription: 'kim-laptop' })
+    await fcm.register(lee, { subscription: 'lee-phone' })
+
+    await fcm.notify({
+      receivers: [kim.id],
+      title: '결재 차례',
+      body: '지출결의 1건',
+      data: { type: 'approval', url: 'https://office.example.com/domain/hatiolab/activity-approval/a-1', timestamp: 1, missing: undefined }
+    })
+
+    expect(mockMessaging.multicasts).toHaveLength(1)
+    const [sent] = mockMessaging.multicasts
+    expect([...sent.tokens].sort()).toEqual(['kim-laptop', 'kim-phone'])
+    expect(sent.notification).toEqual({ title: '결재 차례', body: '지출결의 1건' })
+    expect(sent.data).toEqual({ type: 'approval', url: 'https://office.example.com/domain/hatiolab/activity-approval/a-1', timestamp: '1' })
+  })
+
+  test('a person with no browser registered is not pushed to', async () => {
+    await fcm.notify({ receivers: [lee.id], title: 't', body: 'b', data: {} })
+
+    expect(mockMessaging.multicasts).toEqual([])
+  })
+
+  test('a token FCM says is gone is forgotten; one that failed for another reason is kept', async () => {
+    await fcm.register(kim, { subscription: 'kim-old-phone' })
+    await fcm.register(kim, { subscription: 'kim-phone' })
+    mockMessaging.answer = tokens =>
+      tokens.map(token =>
+        token === 'kim-old-phone'
+          ? { success: false, error: { code: 'messaging/registration-token-not-registered', message: 'gone' } }
+          : { success: false, error: { code: 'messaging/internal-error', message: 'try later' } }
+      )
+
+    await fcm.notify({ receivers: [kim.id], title: 't', body: 'b', data: {} })
+
+    expect(await tokensOf(kim)).toEqual(['kim-phone'])
+  })
+})
+
+/*
+ * The service worker that opens a web push knows no domain: a page relative to the domain resolved against it loses
+ * /domain/<x>/ and a tap lands nowhere. A notice sent with no request (a scheduled reminder) has no full link either.
+ */
+describe('the page a web push opens', () => {
+  const domain = { subdomain: 'hatiolab', extType: 'domain' }
+
+  test('a notice sent with no request opens its page within the domain, from the origin', async () => {
+    await fcm.register(kim, { subscription: 'kim-phone' })
+
+    await deliverNotice(
+      {
+        type: 'approval-overdue',
+        receivers: [{ id: kim.id }],
+        words: () => ({ subject: '늦은 결재', body: '1건' }),
+        address: 'activity-approval/a-1',
+        label: 'overdue reminder'
+      },
+      { attributes: async () => ({}), push: notifierOf(domain), mail: async () => undefined, teams: async () => ({ ok: true }), report: () => {} }
+    )
+
+    expect(mockMessaging.multicasts.map(sent => sent.data.url)).toEqual(['/domain/hatiolab/activity-approval/a-1'])
+  })
+
+  test('the open screen is told the page within its domain, as it navigates', async () => {
+    const { pubsub } = require('@things-factory/shell')
+    const published = jest.spyOn(pubsub, 'publish').mockImplementation(async () => undefined)
+
+    await notifierOf(domain)({ receivers: [kim.id], title: 't', url: 'activity-approval/a-1', mode: 'foreground' })
+
+    expect((published.mock.calls[0][1] as any).notification.url).toBe('activity-approval/a-1')
+    published.mockRestore()
+  })
+
+  test('an address with a scheme or from the origin is handed on as it is', async () => {
+    await fcm.register(kim, { subscription: 'kim-phone' })
+
+    await notifierOf(domain)({ receivers: [kim.id], title: 't', url: 'https://example.com/x' })
+    await notifierOf(domain)({ receivers: [kim.id], title: 't', url: '/domain/other/y' })
+
+    expect(mockMessaging.multicasts.map(sent => sent.data.url)).toEqual(['https://example.com/x', '/domain/other/y'])
+  })
+})

package/dist-server/controllers/notice/app-brand.d.ts

@@ -1,17 +0,0 @@
-export type AppBrand = {
-    name: string;
-    tagline?: string;
-    /** `#rrggbb`. */
-    color: string;
-};
-/** What the notice mail had before an application said its own. */
-export declare const DEFAULT_BRAND: AppBrand;
-/** The brand a manifest declares, each part it leaves out the default's. */
-export declare function brandOf(manifest: any): AppBrand;
-/**
- * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text
- * (WCAG 1.4.3) - black below that.
- */
-export declare function textColorOn(color: string): '#000000' | '#ffffff';
-/** The running application's brand; the default when it ships no manifest or one that cannot be read. */
-export declare function appBrand(): AppBrand;

package/dist-server/controllers/notice/app-brand.js

@@ -1,61 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_BRAND = void 0;
-exports.brandOf = brandOf;
-exports.textColorOn = textColorOn;
-exports.appBrand = appBrand;
-const tslib_1 = require("tslib");
-/*
- * Whose mail it is - the application's brand name, tagline and colour, read from its web manifest
- * (`assets/manifest.json`), the one identity file every application ships and the image keeps. `name` is the brand
- * name; `tagline` and `brand_color` are the application's own members (a browser passes over members it does not
- * know); with no `brand_color` the manifest's `theme_color` stands in. Read once.
- */
-const fs_1 = tslib_1.__importDefault(require("fs"));
-const path_1 = tslib_1.__importDefault(require("path"));
-const env_1 = require("@things-factory/env");
-/** What the notice mail had before an application said its own. */
-exports.DEFAULT_BRAND = { name: 'Operato', color: '#22a6a7' };
-const HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
-/** A 3-digit colour as its 6 digits; anything not a hex colour is not a colour. */
-function hexOf(value) {
-    if (typeof value !== 'string' || !HEX.test(value.trim()))
-        return undefined;
-    const hex = value.trim().toLowerCase();
-    return hex.length === 4 ? `#${[...hex.slice(1)].map(digit => digit + digit).join('')}` : hex;
-}
-const textOf = (value) => (typeof value === 'string' && value.trim() ? value.trim() : undefined);
-/** The brand a manifest declares, each part it leaves out the default's. */
-function brandOf(manifest) {
-    return {
-        name: textOf(manifest?.name) ?? exports.DEFAULT_BRAND.name,
-        tagline: textOf(manifest?.tagline),
-        color: hexOf(manifest?.brand_color) ?? hexOf(manifest?.theme_color) ?? exports.DEFAULT_BRAND.color
-    };
-}
-/**
- * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text
- * (WCAG 1.4.3) - black below that.
- */
-function textColorOn(color) {
-    const channel = (at) => {
-        const value = parseInt(color.slice(at, at + 2), 16) / 255;
-        return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4;
-    };
-    const luminance = 0.2126 * channel(1) + 0.7152 * channel(3) + 0.0722 * channel(5);
-    return 1.05 / (luminance + 0.05) >= 3 ? '#ffffff' : '#000000';
-}
-let read;
-/** The running application's brand; the default when it ships no manifest or one that cannot be read. */
-function appBrand() {
-    if (!read) {
-        try {
-            read = brandOf(JSON.parse(fs_1.default.readFileSync(path_1.default.resolve(env_1.appRootPath, 'assets', 'manifest.json'), 'utf8')));
-        }
-        catch {
-            read = exports.DEFAULT_BRAND;
-        }
-    }
-    return read;
-}
-//# sourceMappingURL=app-brand.js.map

package/dist-server/controllers/notice/app-brand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-brand.js","sourceRoot":"","sources":["../../../server/controllers/notice/app-brand.ts"],"names":[],"mappings":";;;AAiCA,0BAMC;AAMD,kCAOC;AAKD,4BASC;;AAlED;;;;;GAKG;AACH,oDAAmB;AACnB,wDAAuB;AAEvB,6CAAiD;AASjD,mEAAmE;AACtD,QAAA,aAAa,GAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAE5E,MAAM,GAAG,GAAG,iCAAiC,CAAA;AAE7C,mFAAmF;AACnF,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9F,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAEzG,4EAA4E;AAC5E,SAAgB,OAAO,CAAC,QAAa;IACnC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,qBAAa,CAAC,IAAI;QAClD,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,qBAAa,CAAC,KAAK;KAC3F,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;QACzD,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAA;IAC5E,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC;AAED,IAAI,IAA0B,CAAA;AAE9B,yGAAyG;AACzG,SAAgB,QAAQ;IACtB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,OAAO,CAAC,iBAAW,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,qBAAa,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["/*\n * Whose mail it is - the application's brand name, tagline and colour, read from its web manifest\n * (`assets/manifest.json`), the one identity file every application ships and the image keeps. `name` is the brand\n * name; `tagline` and `brand_color` are the application's own members (a browser passes over members it does not\n * know); with no `brand_color` the manifest's `theme_color` stands in. Read once.\n */\nimport fs from 'fs'\nimport path from 'path'\n\nimport { appRootPath } from '@things-factory/env'\n\nexport type AppBrand = {\n  name: string\n  tagline?: string\n  /** `#rrggbb`. */\n  color: string\n}\n\n/** What the notice mail had before an application said its own. */\nexport const DEFAULT_BRAND: AppBrand = { name: 'Operato', color: '#22a6a7' }\n\nconst HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i\n\n/** A 3-digit colour as its 6 digits; anything not a hex colour is not a colour. */\nfunction hexOf(value: unknown): string | undefined {\n  if (typeof value !== 'string' || !HEX.test(value.trim())) return undefined\n  const hex = value.trim().toLowerCase()\n  return hex.length === 4 ? `#${[...hex.slice(1)].map(digit => digit + digit).join('')}` : hex\n}\n\nconst textOf = (value: unknown) => (typeof value === 'string' && value.trim() ? value.trim() : undefined)\n\n/** The brand a manifest declares, each part it leaves out the default's. */\nexport function brandOf(manifest: any): AppBrand {\n  return {\n    name: textOf(manifest?.name) ?? DEFAULT_BRAND.name,\n    tagline: textOf(manifest?.tagline),\n    color: hexOf(manifest?.brand_color) ?? hexOf(manifest?.theme_color) ?? DEFAULT_BRAND.color\n  }\n}\n\n/**\n * The text colour on `color`: white while it keeps 3:1 against it - the band and the button carry large bold text\n * (WCAG 1.4.3) - black below that.\n */\nexport function textColorOn(color: string): '#000000' | '#ffffff' {\n  const channel = (at: number) => {\n    const value = parseInt(color.slice(at, at + 2), 16) / 255\n    return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4\n  }\n  const luminance = 0.2126 * channel(1) + 0.7152 * channel(3) + 0.0722 * channel(5)\n  return 1.05 / (luminance + 0.05) >= 3 ? '#ffffff' : '#000000'\n}\n\nlet read: AppBrand | undefined\n\n/** The running application's brand; the default when it ships no manifest or one that cannot be read. */\nexport function appBrand(): AppBrand {\n  if (!read) {\n    try {\n      read = brandOf(JSON.parse(fs.readFileSync(path.resolve(appRootPath, 'assets', 'manifest.json'), 'utf8')))\n    } catch {\n      read = DEFAULT_BRAND\n    }\n  }\n  return read\n}\n"]}

package/dist-server/controllers/notice/notice-email.d.ts

@@ -1,32 +0,0 @@
-import { type AppBrand } from './app-brand.js';
-import type { NoticeWords } from './notice-channels.js';
-/** Every value goes into the HTML through this - a subject like `<b>` or `A&B` stays text. */
-export declare function escapeHtml(value: unknown): string;
-/**
- * Where a link in a notice may go: http(s) and mailto as written, and an address of the app (no scheme) under `base`,
- * the domain's own address. With no base an app address has nowhere to go and is dropped, as is every other scheme -
- * `javascript:` in any spelling the URL parser reads as one.
- */
-export declare function safeNoticeHref(href: string | null | undefined, base?: string): string | undefined;
-/**
- * Markdown as mail HTML, rendered here on the server. Raw HTML in the text is shown as text, never as markup; a link or
- * an image becomes a link only to an address `safeNoticeHref` allows, and an image is not loaded - it is shown as a
- * link with its alt text, so a mail does not fetch from wherever its writer pointed.
- */
-export declare function renderNoticeMarkdown(markdown: string, base?: string): string;
-/**
- * The notice mail (ADR-0164) - the head, band, button and foot of the auth mails, so a person knows the sender. The head
- * names the application that sends it with its tagline, and the band and button are in its brand colour (`appBrand`).
- * Without a link (a notice sent with no request to take the address from) the button gives way to the note.
- */
-export declare function noticeEmailForm({ lang, words, link, format, base, brand }: {
-    lang: string;
-    words: NoticeWords;
-    link?: string;
-    /** How the body is written - an announcement's is Markdown. */
-    format?: 'text' | 'markdown';
-    /** The domain's address, under which an app address in a Markdown body is resolved. */
-    base?: string;
-    /** The application sending it. */
-    brand?: AppBrand;
-}): string;

package/dist-server/controllers/notice/notice-email.js

@@ -1,153 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.escapeHtml = escapeHtml;
-exports.safeNoticeHref = safeNoticeHref;
-exports.renderNoticeMarkdown = renderNoticeMarkdown;
-exports.noticeEmailForm = noticeEmailForm;
-const marked_1 = require("marked");
-const app_brand_js_1 = require("./app-brand.js");
-/** Every value goes into the HTML through this - a subject like `<b>` or `A&B` stays text. */
-function escapeHtml(value) {
-    return String(value ?? '')
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
-/** The schemes a link in a notice may take; anything else is shown as its text. */
-const SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
-const NO_BASE = 'https://no-base.invalid/';
-/**
- * Where a link in a notice may go: http(s) and mailto as written, and an address of the app (no scheme) under `base`,
- * the domain's own address. With no base an app address has nowhere to go and is dropped, as is every other scheme -
- * `javascript:` in any spelling the URL parser reads as one.
- */
-function safeNoticeHref(href, base) {
-    const raw = String(href ?? '').trim();
-    if (!raw)
-        return undefined;
-    let url;
-    try {
-        url = new URL(raw, base || NO_BASE);
-    }
-    catch {
-        return undefined;
-    }
-    if (!SAFE_PROTOCOLS.has(url.protocol))
-        return undefined;
-    if (url.origin === new URL(NO_BASE).origin)
-        return undefined;
-    return url.href;
-}
-/**
- * Markdown as mail HTML, rendered here on the server. Raw HTML in the text is shown as text, never as markup; a link or
- * an image becomes a link only to an address `safeNoticeHref` allows, and an image is not loaded - it is shown as a
- * link with its alt text, so a mail does not fetch from wherever its writer pointed.
- */
-function renderNoticeMarkdown(markdown, base) {
-    const marked = new marked_1.Marked({
-        gfm: true,
-        breaks: true,
-        async: false,
-        renderer: {
-            html({ text }) {
-                return escapeHtml(text);
-            },
-            link({ href, title, tokens }) {
-                const label = this.parser.parseInline(tokens);
-                const safe = safeNoticeHref(href, base);
-                return safe ? `<a href="${escapeHtml(safe)}"${title ? ` title="${escapeHtml(title)}"` : ''}>${label}</a>` : label;
-            },
-            image({ href, text }) {
-                const safe = safeNoticeHref(href, base);
-                return safe ? `<a href="${escapeHtml(safe)}">${escapeHtml(text || safe)}</a>` : escapeHtml(text);
-            }
-        }
-    });
-    return marked.parse(String(markdown ?? ''));
-}
-/**
- * The notice mail (ADR-0164) - the head, band, button and foot of the auth mails, so a person knows the sender. The head
- * names the application that sends it with its tagline, and the band and button are in its brand colour (`appBrand`).
- * Without a link (a notice sent with no request to take the address from) the button gives way to the note.
- */
-function noticeEmailForm({ lang, words, link, format = 'text', base, brand = app_brand_js_1.DEFAULT_BRAND }) {
-    const color = escapeHtml(brand.color);
-    const onColor = (0, app_brand_js_1.textColorOn)(brand.color);
-    /*
-     * Laid out as tables, each colour on its cell as `bgcolor` as well as in its style: mail programs drop a box's
-     * margins and backgrounds, and one in dark mode repaints what it was not told is light - so the mail says it is light.
-     */
-    const action = link
-        ? `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="border-collapse:separate">
-              <tr>
-                <td bgcolor="${color}" style="background-color:${color};border-radius:7px;padding:8px 16px">
-                  <a href="${escapeHtml(link)}" style="color:${onColor};font-size:18px;font-weight:bold;text-decoration:none"
-                    ><font color="${onColor}">${escapeHtml(words.action)}</font></a
-                  >
-                </td>
-              </tr>
-            </table>`
-        : `<span style="color:#555555">${escapeHtml(words.note)}</span>`;
-    return `
-  <html lang="${escapeHtml(lang)}">
-    <head>
-      <meta charset="utf-8" />
-      <meta name="color-scheme" content="light" />
-      <meta name="supported-color-schemes" content="light" />
-      <title>${escapeHtml(words.subject)}</title>
-      <meta name="author" content="hatiolab" />
-      <meta name="google" content="notranslate"/>
-      <style>:root { color-scheme: light; supported-color-schemes: light; }</style>
-    </head>
-
-    <body style="margin:0;padding:0" bgcolor="#f6f6f6">
-      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#f6f6f6" style="background-color:#f6f6f6;border-collapse:collapse">
-        <!--header begin-->
-        <tr>
-          <td bgcolor="#ffffff" style="background-color:#ffffff;border-top:2px solid ${color};padding:10px 20px">
-            <table role="presentation" cellpadding="0" cellspacing="0" border="0">
-              <tr>
-                <td style="font-size:20px;font-weight:bold;color:#1f2933;white-space:nowrap">${escapeHtml(brand.name)}</td>${brand.tagline
-        ? `
-                <td style="padding-left:12px;font-size:13px;color:#6b7280">&nbsp;${escapeHtml(brand.tagline)}</td>`
-        : ''}
-              </tr>
-            </table>
-          </td>
-        </tr>
-        <!--header end-->
-
-        <!--title begin-->
-        <tr>
-          <td bgcolor="${color}" style="background-color:${color};padding:14px 20px 12px 60px;color:${onColor};font-size:24px;font-weight:bold"
-            ><font color="${onColor}">${escapeHtml(words.subject)}</font></td
-          >
-        </tr>
-        <!--title end-->
-
-        <!--body begin-->
-        <tr>
-          <td style="padding:10px 20px;line-height:1.5;font-size:16px;color:#1f2933">${format === 'markdown' ? renderNoticeMarkdown(words.body, base) : `<div style="white-space:pre-line">${escapeHtml(words.body)}</div>`}</td>
-        </tr>
-        <tr>
-          <td style="padding:6px 20px 20px 20px;font-size:16px">
-            ${action}
-          </td>
-        </tr>
-        <!--body end-->
-
-        <!--footer begin-->
-        <tr>
-          <td bgcolor="#3d5874" style="background-color:#3d5874;padding:8px 20px 6px 20px;font-size:12px;color:#efefef"
-            ><font color="#efefef">© Hatio, Lab. Inc. All rights reserved.</font></td
-          >
-        </tr>
-        <!--footer end-->
-      </table>
-    </body>
-  </html>
-  `;
-}
-//# sourceMappingURL=notice-email.js.map