@tokenoftrust/cli 3.0.5 → 3.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.0.5",
+  "version": "3.0.7",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/public-binaries.mjs

@@ -5,10 +5,13 @@
  * catalog images, and the source store is never shut down before that check passes. This decides,
  * from a listing of the store's `public/` tree, whether the repo is carrying binaries it must not.
  *
- * Three findings, each naming its remedy:
+ * Findings, each naming its remedy:
  *
- *   - `catalog-images-in-repo` — any file under `public/catalog-images/`, the directory a catalog
- *     image download writes. Decided from paths alone, so a caller without sizes still refuses it.
+ *   - one per entry of {@link FORBIDDEN_PUBLIC_DIRS}: any file under a directory a media download
+ *     writes (`public/catalog-images/` is `catalog-images-in-repo`, `public/blog/wp-content/uploads/`
+ *     is `blog-media-in-repo`). Decided from paths alone, so a caller without sizes still refuses
+ *     it. This list is the one source the validators and the reconcile read; the Gitea
+ *     pre-receive size guard names the same directories.
  *   - `public-binary-oversized` — one raster or media file over {@link PUBLIC_BINARY_LIMITS}
  *     `maxFileBytes`.
  *   - `public-tree-over-budget` — the whole `public/` tree over `maxTotalBytes`.
@@ -28,13 +31,25 @@ export const PUBLIC_BINARY_LIMITS = Object.freeze({
   maxTotalBytes: 32 * 1024 * 1024,
 });
 
-/** The directory under `public/` a catalog image download writes. */
-export const CATALOG_IMAGES_DIR = "catalog-images/";
+/**
+ * The directories under `public/` a media download writes. No file under one may be committed.
+ *
+ * @type {ReadonlyArray<Readonly<{ dir: string, code: string, noun: string }>>}
+ */
+export const FORBIDDEN_PUBLIC_DIRS = Object.freeze([
+  Object.freeze({ dir: "catalog-images/", code: "catalog-images-in-repo", noun: "catalog image" }),
+  Object.freeze({ dir: "blog/wp-content/uploads/", code: "blog-media-in-repo", noun: "blog media" }),
+]);
 
-/** The finding code for files under {@link CATALOG_IMAGES_DIR}. */
-export const CATALOG_IMAGES_FINDING_CODE = "catalog-images-in-repo";
+/** The finding codes decided from paths alone. */
+export const PATH_DECIDED_FINDING_CODES = Object.freeze(new Set(FORBIDDEN_PUBLIC_DIRS.map((d) => d.code)));
+
+/** True for a path (relative to `public/`, `/` separators) under a forbidden directory. */
+export function isForbiddenPublicPath(rel) {
+  return FORBIDDEN_PUBLIC_DIRS.some((d) => rel.startsWith(d.dir));
+}
 
-/** The kit command that moves rehosted catalog image references back to their source URLs. */
+/** The kit command that moves downloaded catalog images and blog media back to their source URLs. */
 export const UNHOST_IMAGES_COMMAND = "node agency-kit/tools/import-catalog.mjs --store <checkout> --unhost-images --write";
 
 const RASTER_OR_MEDIA = /\.(?:jpe?g|png|gif|webp|avif|bmp|tiff?|heic|heif|ico|jxl|mp4|m4v|mov|webm|mkv|avi|mpe?g|mp3|wav|ogg|oga|m4a|aac|flac|opus)$/i;
@@ -51,19 +66,20 @@ export function publicBinaryFindings(entries, limits = {}) {
   const maxFileBytes = limits.maxFileBytes ?? PUBLIC_BINARY_LIMITS.maxFileBytes;
   const maxTotalBytes = limits.maxTotalBytes ?? PUBLIC_BINARY_LIMITS.maxTotalBytes;
   const findings = [];
-  const catalogImages = entries.filter((e) => e.rel.startsWith(CATALOG_IMAGES_DIR));
-  if (catalogImages.length > 0) {
-    const bytes = catalogImages.reduce((n, e) => n + (e.bytes ?? 0), 0);
+  for (const { dir, code, noun } of FORBIDDEN_PUBLIC_DIRS) {
+    const files = entries.filter((e) => e.rel.startsWith(dir));
+    if (files.length === 0) continue;
+    const bytes = files.reduce((n, e) => n + (e.bytes ?? 0), 0);
     findings.push({
-      code: CATALOG_IMAGES_FINDING_CODE,
-      path: `public/${CATALOG_IMAGES_DIR}`,
-      message: `${catalogImages.length} catalog image file(s)${bytes ? ` (${mb(bytes)})` : ""} are committed to the store repo; ` +
+      code,
+      path: `public/${dir}`,
+      message: `${files.length} ${noun} file(s)${bytes ? ` (${mb(bytes)})` : ""} are committed to the store repo; ` +
         "images belong in the platform pool, not the repo; until platform capture owns them, keep each image at its source URL",
       remedy: UNHOST_IMAGES_COMMAND,
     });
   }
   for (const e of entries) {
-    if (e.rel.startsWith(CATALOG_IMAGES_DIR) || e.bytes === undefined) continue;
+    if (isForbiddenPublicPath(e.rel) || e.bytes === undefined) continue;
     if (e.bytes > maxFileBytes && RASTER_OR_MEDIA.test(e.rel)) {
       findings.push({
         code: "public-binary-oversized",

package/src/validate.mjs

@@ -23,7 +23,7 @@ import {
   parseMappingTarget,
   workspacePathForTenantRelative,
 } from "./tot-repo-mappings.mjs";
-import { CATALOG_IMAGES_DIR, publicBinaryFindings } from "./public-binaries.mjs";
+import { isForbiddenPublicPath, publicBinaryFindings } from "./public-binaries.mjs";
 
 export {
   TOT_CONFIG_KEYS,
@@ -459,6 +459,39 @@ export function isSafeRehostedAssetPathForTenant(value, tenantId) {
   return value.startsWith("/shared/") || value.startsWith(`/tenants/${tenantId}/`);
 }
 
+export function isPlatformPoolImagePath(value) {
+  return typeof value === "string" && /^\/_a\/[0-9a-f]{64}(?:\.[a-z0-9]{1,8})?$/.test(value);
+}
+
+const IMAGE_SOURCE_DNS_NAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const IMAGE_SOURCE_BLOCKED_NAME = /(?:^|\.)(?:localhost|localdomain|local|internal|intranet|lan|home|arpa)$/i;
+const IMAGE_SOURCE_IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+
+export function imageSourceUrlRefusal(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048) return "unsupported";
+  let url;
+  try { url = new URL(value); } catch { return "unsupported"; }
+  if (url.protocol !== "https:") return "unsafe-scheme";
+  if (url.username || url.password) return "userinfo";
+  if (url.port) return "nonstandard-port";
+  const hostname = url.hostname;
+  if (!hostname || hostname.includes("%")) return "blocked-address";
+  if (IMAGE_SOURCE_IPV4.test(hostname)) return "ip-literal";
+  const name = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+  if (IMAGE_SOURCE_BLOCKED_NAME.test(name) || !IMAGE_SOURCE_DNS_NAME.test(hostname)) return "blocked-address";
+  return null;
+}
+
+export function isPageBlockImageReference(value, tenantId) {
+  if (typeof value !== "string") return false;
+  if (tenantId === undefined || tenantId === null
+    ? isSafeRehostedAssetPath(value)
+    : isSafeRehostedAssetPathForTenant(value, tenantId)) return true;
+  if (isPlatformPoolImagePath(value)) return true;
+  if (!/^https:\/\//i.test(value) || /[\u0000-\u0020\u007f"'<>\\`]/.test(value)) return false;
+  return imageSourceUrlRefusal(value) === null;
+}
+
 export function isSafeStorefrontHref(value) {
   if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return false;
   if (value.includes("\\") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f]/.test(value)) return false;
@@ -509,11 +542,8 @@ function validateProductSource(value, file, at) {
 }
 
 function validateVisualAsset(value, file, at, out, tenantId) {
-  const safe = tenantId
-    ? isSafeRehostedAssetPathForTenant(value, tenantId)
-    : isSafeRehostedAssetPath(value);
-  if (!safe) {
-    out.push(mk(ERROR, "asset-path", file, `${at} must be a /shared/... asset or belong to the active tenant`));
+  if (!isPageBlockImageReference(value, tenantId || undefined)) {
+    out.push(mk(ERROR, "asset-path", file, `${at} must be a /shared/... or active-tenant asset, a /_a/<sha256> pool reference, or an https source URL on a public host (captured into the pool at preview and publish)`));
   }
 }
 
@@ -1434,8 +1464,8 @@ function checkAsset(src, file, publicDir, tenantId) {
 function findLargePublicAssets(publicDir, rel) {
   const out = [];
   for (const p of walk(publicDir, () => true)) {
-    // public/catalog-images/ is already an error (catalog-images-in-repo); one line, not thousands.
-    if (relative(publicDir, p).split("\\").join("/").startsWith(CATALOG_IMAGES_DIR)) continue;
+    // a forbidden media directory is already an error (catalog-images-in-repo, blog-media-in-repo); one line, not thousands.
+    if (isForbiddenPublicPath(relative(publicDir, p).split("\\").join("/"))) continue;
     const size = statSync(p).size;
     if (size >= LARGE_PUBLIC_ASSET_BYTES) {
       out.push(mk(WARN, "large-public-asset", rel(p), `${(size / 1024).toFixed(0)}KB`));