@tinacms/astro 0.0.1 → 0.3.0

package/src/sanitize.ts

@@ -0,0 +1,64 @@
+/**
+ * Sanitizes a CMS-supplied href, returning a safe URL or the fallback.
+ * Blocks dangerous schemes (javascript:, data:, vbscript:) and
+ * protocol-relative URLs (//evil.com). Allows relative paths, http(s),
+ * and mailto:.
+ */
+export function sanitizeHref(value: unknown, fallback = '#'): string {
+  if (typeof value !== 'string') return fallback;
+  const trimmed = value.trim();
+  if (!trimmed) return fallback;
+  const lower = trimmed.toLowerCase();
+  if (
+    lower.startsWith('javascript:') ||
+    lower.startsWith('data:') ||
+    lower.startsWith('vbscript:')
+  ) {
+    return fallback;
+  }
+  if (
+    (trimmed.startsWith('/') && !trimmed.startsWith('//')) ||
+    trimmed.startsWith('./') ||
+    trimmed.startsWith('../') ||
+    trimmed.startsWith('#')
+  ) {
+    return trimmed;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (
+      url.protocol === 'http:' ||
+      url.protocol === 'https:' ||
+      url.protocol === 'mailto:'
+    ) {
+      return trimmed;
+    }
+  } catch {
+    return fallback;
+  }
+  return fallback;
+}
+
+/**
+ * Validates a CMS-supplied image src, returning the src string if safe or ''
+ * if it is empty, not a string, or uses a non-http(s)/relative scheme.
+ */
+export function sanitizeImageSrc(src: unknown): string {
+  if (typeof src !== 'string') return '';
+  const trimmed = src.trim();
+  if (!trimmed) return '';
+  if (
+    trimmed.startsWith('./') ||
+    trimmed.startsWith('../') ||
+    (trimmed.startsWith('/') && !trimmed.startsWith('//'))
+  ) {
+    return trimmed;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol === 'http:' || url.protocol === 'https:') return trimmed;
+  } catch {
+    return '';
+  }
+  return '';
+}

package/src/tina-field.ts

@@ -0,0 +1 @@
+export * from '@tinacms/bridge/tina-field';

package/src/types.ts

@@ -0,0 +1,97 @@
+/**
+ * Plate AST node types Tina returns from rich-text fields. Mirrors the shape
+ * documented in `packages/@tinacms/mdx/src/parse/plate.ts` — kept inline so
+ * the Astro renderer can stay framework-free and not pull @tinacms/mdx into
+ * the page bundle.
+ */
+
+/**
+ * Astro doesn't publicly export `AstroComponentFactory`, so we use a
+ * structural placeholder. The consumer's Astro pipeline performs the real
+ * compile-time check that whatever they pass is a valid component.
+ */
+export type AstroComponent = (...args: never[]) => unknown;
+
+export type TinaRichTextRoot = {
+  type: 'root';
+  children: TinaRichTextNode[];
+};
+
+export type TinaRichTextNode =
+  | BlockElement
+  | InlineElement
+  | TextElement
+  | MdxElement;
+
+export type LinkElement = {
+  type: 'a';
+  url: string;
+  title?: string;
+  children: InlineElement[];
+};
+
+export type ImageElement = {
+  type: 'img';
+  url: string;
+  alt?: string;
+  caption?: string;
+};
+
+export type CodeBlockElement = {
+  type: 'code_block';
+  lang?: string;
+  value?: string;
+  children?: { children: TextElement[] }[];
+};
+
+export type BlockElement =
+  | { type: 'p'; children: InlineElement[] }
+  | {
+      type: 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
+      children: InlineElement[];
+    }
+  | { type: 'blockquote'; children: TinaRichTextNode[] }
+  | { type: 'ul' | 'ol'; children: TinaRichTextNode[] }
+  | { type: 'li'; children: TinaRichTextNode[] }
+  | { type: 'lic'; children: InlineElement[] }
+  | { type: 'hr' }
+  | { type: 'break' }
+  | ImageElement
+  | CodeBlockElement
+  | { type: 'maybe_mdx' }
+  | { type: 'html'; value: string }
+  | { type: 'invalid_markdown'; value: string };
+
+export type InlineElement =
+  | TextElement
+  | LinkElement
+  | { type: 'html_inline'; value: string }
+  | MdxElement;
+
+export type TextElement = {
+  type: 'text';
+  text: string;
+  bold?: boolean;
+  italic?: boolean;
+  underline?: boolean;
+  strikethrough?: boolean;
+  code?: boolean;
+  highlight?: boolean;
+  highlightColor?: string;
+};
+
+export type MdxElement = {
+  type: 'mdxJsxFlowElement' | 'mdxJsxTextElement';
+  name: string;
+  props: Record<string, unknown>;
+  children?: TinaRichTextNode[];
+};
+
+export type TinaRichTextContent =
+  | TinaRichTextRoot
+  | TinaRichTextNode[]
+  | null
+  | undefined;
+
+/** A map of mdxJsx name (or default tag override) → Astro component. */
+export type CustomComponentsMap = Record<string, AstroComponent>;

package/src/vite.ts

@@ -0,0 +1,40 @@
+import type { Plugin } from 'vite';
+
+/**
+ * Dev-only Vite plugin that redirects `/admin` (and `/admin/`) to
+ * `/admin/index.html`.
+ *
+ * In `astro dev`, the admin SPA is served straight from `public/admin/` and
+ * Vite does not resolve a directory index for it, so a bare `/admin` request
+ * 404s. This plugin makes `/admin` land on the SPA the same way it does in a
+ * production build. It only applies to the dev server (`apply: 'serve'`); a
+ * built site serves `public/admin/index.html` itself.
+ *
+ * @example
+ * // astro.config.mjs
+ * import { tinaAdminDevRedirect } from '@tinacms/astro/vite';
+ *
+ * export default defineConfig({
+ *   vite: { plugins: [tinaAdminDevRedirect()] },
+ * });
+ */
+export function tinaAdminDevRedirect(): Plugin {
+  return {
+    name: 'tina-admin-dev-redirect',
+    apply: 'serve',
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        const path = (req.url || '').split('?')[0];
+        if (path === '/admin' || path === '/admin/') {
+          res.statusCode = 302;
+          res.setHeader('Location', '/admin/index.html');
+          res.end();
+          return;
+        }
+        next();
+      });
+    },
+  };
+}
+
+export default tinaAdminDevRedirect;

package/dist/preview.d.ts

@@ -1 +0,0 @@
-export * from "../src/preview"

package/dist/preview.js

@@ -1 +0,0 @@
-export * from "@tinacms/bridge/preview";