@tuturuuu/utils 0.0.3 → 0.6.0

package/src/html-sanitizer.ts

@@ -0,0 +1,155 @@
+/**
+ * Simple HTML sanitizer for event descriptions
+ * Allows only safe tags and attributes to prevent XSS attacks
+ */
+
+// Allowed HTML tags for event descriptions
+const ALLOWED_TAGS = [
+  'p',
+  'br',
+  'strong',
+  'b',
+  'em',
+  'i',
+  'u',
+  'a',
+  'ul',
+  'ol',
+  'li',
+  'span',
+  'div',
+];
+
+// Allowed attributes for each tag
+const ALLOWED_ATTRIBUTES: Record<string, string[]> = {
+  a: ['href', 'title', 'target', 'rel'],
+  span: ['class'],
+  div: ['class'],
+};
+
+// URL protocols that are safe
+const SAFE_URL_PROTOCOLS = ['http:', 'https:', 'mailto:'];
+
+/**
+ * Sanitize a URL to prevent javascript: and data: URLs
+ */
+function sanitizeUrl(url: string): string | null {
+  try {
+    const trimmed = url.trim();
+
+    // Allow relative URLs
+    if (
+      trimmed.startsWith('/') ||
+      trimmed.startsWith('./') ||
+      trimmed.startsWith('../')
+    ) {
+      return trimmed;
+    }
+
+    // Check protocol for absolute URLs
+    const urlObj = new URL(trimmed, window.location.origin);
+    if (SAFE_URL_PROTOCOLS.includes(urlObj.protocol)) {
+      return trimmed;
+    }
+
+    return null;
+  } catch {
+    // If URL parsing fails, it's probably not a valid URL
+    return null;
+  }
+}
+
+/**
+ * Sanitize HTML content by stripping dangerous tags and attributes
+ * This is a simple implementation - for production, consider using DOMPurify
+ */
+export function sanitizeHtml(html: string): string {
+  if (!html) return '';
+
+  // Create a temporary DOM element to parse HTML
+  const temp = document.createElement('div');
+  temp.innerHTML = html;
+
+  // Recursive function to sanitize nodes
+  function sanitizeNode(node: Node): Node | null {
+    // Text nodes are always safe
+    if (node.nodeType === Node.TEXT_NODE) {
+      return node.cloneNode(true);
+    }
+
+    // Only process element nodes
+    if (node.nodeType !== Node.ELEMENT_NODE) {
+      return null;
+    }
+
+    const element = node as Element;
+    const tagName = element.tagName.toLowerCase();
+
+    // Check if tag is allowed
+    if (!ALLOWED_TAGS.includes(tagName)) {
+      // For disallowed tags, keep their text content but not the tag itself
+      const textContent = element.textContent || '';
+      return document.createTextNode(textContent);
+    }
+
+    // Create a new element with the same tag
+    const newElement = document.createElement(tagName);
+
+    // Copy allowed attributes
+    const allowedAttrs = ALLOWED_ATTRIBUTES[tagName] || [];
+    for (const attr of allowedAttrs) {
+      const value = element.getAttribute(attr);
+      if (value) {
+        // Special handling for URLs in href
+        if (attr === 'href') {
+          const sanitizedUrl = sanitizeUrl(value);
+          if (sanitizedUrl) {
+            newElement.setAttribute(attr, sanitizedUrl);
+            // Add rel="noopener noreferrer" for external links for security
+            if (sanitizedUrl.startsWith('http')) {
+              newElement.setAttribute('rel', 'noopener noreferrer');
+              newElement.setAttribute('target', '_blank');
+            }
+          }
+        } else {
+          newElement.setAttribute(attr, value);
+        }
+      }
+    }
+
+    // Recursively sanitize child nodes
+    for (const child of Array.from(element.childNodes)) {
+      const sanitizedChild = sanitizeNode(child);
+      if (sanitizedChild) {
+        newElement.appendChild(sanitizedChild);
+      }
+    }
+
+    return newElement;
+  }
+
+  // Sanitize all child nodes
+  const sanitizedDiv = document.createElement('div');
+  for (const child of Array.from(temp.childNodes)) {
+    const sanitizedChild = sanitizeNode(child);
+    if (sanitizedChild) {
+      sanitizedDiv.appendChild(sanitizedChild);
+    }
+  }
+
+  return sanitizedDiv.innerHTML;
+}
+
+/**
+ * Convert plain text to HTML, preserving line breaks
+ */
+export function textToHtml(text: string): string {
+  return text.replace(/\n/g, '<br>');
+}
+
+/**
+ * Check if a string contains HTML tags
+ */
+export function containsHtml(str: string): boolean {
+  return /<[^>]+>/g.test(str);
+}

package/src/internal-domains.ts

@@ -0,0 +1,497 @@
+import {
+  getTuturuuuPortlessAppOrigin,
+  TUTURUUU_PORTLESS_APP_HOSTS,
+} from './portless';
+
+export const PRODUCTION_INTERNAL_APP_DOMAINS = [
+  {
+    name: 'apps',
+    url: 'https://apps.tuturuuu.com',
+  },
+  {
+    name: 'platform',
+    url: 'https://tuturuuu.com',
+  },
+  {
+    name: 'cms',
+    url: 'https://cms.tuturuuu.com',
+  },
+  {
+    name: 'calendar',
+    url: 'https://calendar.tuturuuu.com',
+  },
+  {
+    name: 'chat',
+    url: 'https://chat.tuturuuu.com',
+  },
+  {
+    name: 'drive',
+    url: 'https://drive.tuturuuu.com',
+  },
+  {
+    name: 'mail',
+    url: 'https://mail.tuturuuu.com',
+  },
+  {
+    name: 'meet',
+    url: 'https://meet.tuturuuu.com',
+  },
+  {
+    name: 'qr',
+    url: 'https://qr.tuturuuu.com',
+  },
+  {
+    name: 'nova',
+    url: 'https://nova.ai.vn',
+  },
+  {
+    name: 'mira',
+    url: 'https://mira.tuturuuu.com',
+  },
+  {
+    name: 'rewise',
+    url: 'https://rewise.me',
+  },
+  {
+    name: 'tasks',
+    url: 'https://tasks.tuturuuu.com',
+  },
+  {
+    name: 'finance',
+    url: 'https://finance.tuturuuu.com',
+  },
+  {
+    name: 'inventory',
+    url: 'https://inventory.tuturuuu.com',
+  },
+  {
+    name: 'storefront',
+    url: 'https://storefront.tuturuuu.com',
+  },
+  {
+    name: 'track',
+    url: 'https://track.tuturuuu.com',
+  },
+  {
+    name: 'learn',
+    url: 'https://learn.tuturuuu.com',
+  },
+  {
+    name: 'teach',
+    url: 'https://teach.tuturuuu.com',
+  },
+  {
+    name: 'hive',
+    url: 'https://hive.tuturuuu.com',
+  },
+  {
+    name: 'mind',
+    url: 'https://mind.tuturuuu.com',
+  },
+] as const;
+
+export const PORTLESS_INTERNAL_APP_DOMAINS = [
+  {
+    name: 'apps',
+    url: getTuturuuuPortlessAppOrigin('apps'),
+  },
+  {
+    name: 'platform',
+    url: getTuturuuuPortlessAppOrigin('platform'),
+  },
+  {
+    name: 'cms',
+    url: getTuturuuuPortlessAppOrigin('cms'),
+  },
+  {
+    name: 'calendar',
+    url: getTuturuuuPortlessAppOrigin('calendar'),
+  },
+  {
+    name: 'chat',
+    url: getTuturuuuPortlessAppOrigin('chat'),
+  },
+  {
+    name: 'drive',
+    url: getTuturuuuPortlessAppOrigin('drive'),
+  },
+  {
+    name: 'mail',
+    url: getTuturuuuPortlessAppOrigin('mail'),
+  },
+  {
+    name: 'meet',
+    url: getTuturuuuPortlessAppOrigin('meet'),
+  },
+  {
+    name: 'qr',
+    url: getTuturuuuPortlessAppOrigin('qr'),
+  },
+  {
+    name: 'nova',
+    url: getTuturuuuPortlessAppOrigin('nova'),
+  },
+  {
+    name: 'rewise',
+    url: getTuturuuuPortlessAppOrigin('rewise'),
+  },
+  {
+    name: 'tasks',
+    url: getTuturuuuPortlessAppOrigin('tasks'),
+  },
+  {
+    name: 'finance',
+    url: getTuturuuuPortlessAppOrigin('finance'),
+  },
+  {
+    name: 'inventory',
+    url: getTuturuuuPortlessAppOrigin('inventory'),
+  },
+  {
+    name: 'storefront',
+    url: getTuturuuuPortlessAppOrigin('storefront'),
+  },
+  {
+    name: 'track',
+    url: getTuturuuuPortlessAppOrigin('track'),
+  },
+  {
+    name: 'learn',
+    url: getTuturuuuPortlessAppOrigin('learn'),
+  },
+  {
+    name: 'teach',
+    url: getTuturuuuPortlessAppOrigin('teach'),
+  },
+  {
+    name: 'hive',
+    url: getTuturuuuPortlessAppOrigin('hive'),
+  },
+  {
+    name: 'mind',
+    url: getTuturuuuPortlessAppOrigin('mind'),
+  },
+] as const;
+
+export const LOCALHOST_INTERNAL_APP_DOMAINS = [
+  {
+    name: 'apps',
+    url: 'http://localhost:7818',
+  },
+  {
+    name: 'cms',
+    url: 'http://localhost:7811',
+  },
+  {
+    name: 'calendar',
+    url: 'http://localhost:7806',
+  },
+  {
+    name: 'chat',
+    url: 'http://localhost:7821',
+  },
+  {
+    name: 'drive',
+    url: 'http://localhost:7817',
+  },
+  {
+    name: 'mail',
+    url: 'http://localhost:7820',
+  },
+  {
+    name: 'meet',
+    url: 'http://localhost:7807',
+  },
+  {
+    name: 'qr',
+    url: 'http://localhost:7819',
+  },
+  {
+    name: 'platform',
+    url: 'http://localhost:7803',
+  },
+  {
+    name: 'rewise',
+    url: 'http://localhost:7804',
+  },
+  {
+    name: 'nova',
+    url: 'http://localhost:7805',
+  },
+  {
+    name: 'tasks',
+    url: 'http://localhost:7809',
+  },
+  {
+    name: 'finance',
+    url: 'http://localhost:7808',
+  },
+  {
+    name: 'inventory',
+    url: 'http://localhost:7815',
+  },
+  {
+    name: 'storefront',
+    url: 'http://localhost:7822',
+  },
+  {
+    name: 'track',
+    url: 'http://localhost:7810',
+  },
+  {
+    name: 'learn',
+    url: 'http://localhost:7812',
+  },
+  {
+    name: 'teach',
+    url: 'http://localhost:7813',
+  },
+  {
+    name: 'hive',
+    url: 'http://localhost:7814',
+  },
+  {
+    name: 'mind',
+    url: 'http://localhost:7816',
+  },
+] as const;
+
+export const DEV_INTERNAL_APP_DOMAINS = [
+  ...PORTLESS_INTERNAL_APP_DOMAINS,
+  ...LOCALHOST_INTERNAL_APP_DOMAINS,
+] as const;
+
+export const APP_DOMAIN_MAP = [
+  ...PRODUCTION_INTERNAL_APP_DOMAINS,
+  ...DEV_INTERNAL_APP_DOMAINS,
+] as const;
+
+export type AppName = (typeof APP_DOMAIN_MAP)[number]['name'];
+
+export type AppDomain = {
+  kind?: 'external' | 'internal';
+  name: string;
+  url: string;
+};
+
+export type AppDomainUrlMatch = AppDomain & {
+  canonicalUrl: string;
+};
+
+export function getPortlessInternalAppUrl(appName: AppName) {
+  return appName in TUTURUUU_PORTLESS_APP_HOSTS
+    ? getTuturuuuPortlessAppOrigin(
+        appName as keyof typeof TUTURUUU_PORTLESS_APP_HOSTS
+      )
+    : null;
+}
+
+export function getLocalInternalAppUrl(appName: AppName, legacyUrl: string) {
+  return getPortlessInternalAppUrl(appName) ?? legacyUrl;
+}
+
+function parseExternalAppDomainEntry(entry: string): AppDomain | null {
+  const trimmed = entry.trim();
+
+  if (!trimmed) {
+    return null;
+  }
+
+  const separatorIndex = trimmed.indexOf(':');
+
+  if (separatorIndex <= 0) {
+    return null;
+  }
+
+  const name = trimmed.slice(0, separatorIndex).trim().toLowerCase();
+  const url = trimmed.slice(separatorIndex + 1).trim();
+
+  if (!/^[a-z0-9_-]{1,64}$/u.test(name)) {
+    return null;
+  }
+
+  try {
+    return {
+      kind: 'external',
+      name,
+      url: new URL(url).origin,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function getConfiguredExternalAppDomains(): AppDomain[] {
+  const configured =
+    process.env.NEXT_PUBLIC_TUTURUUU_EXTERNAL_APP_DOMAINS ??
+    process.env.TUTURUUU_EXTERNAL_APP_DOMAINS;
+
+  if (!configured?.trim()) {
+    return [];
+  }
+
+  return configured
+    .split(/[,\n]/u)
+    .map(parseExternalAppDomainEntry)
+    .filter((entry): entry is AppDomain => Boolean(entry));
+}
+
+export function getAppDomainMap(): AppDomain[] {
+  return [
+    ...APP_DOMAIN_MAP.map((domain) => ({
+      ...domain,
+      kind: 'internal' as const,
+    })),
+    ...getConfiguredExternalAppDomains(),
+  ];
+}
+
+function parseHttpUrl(value: string) {
+  try {
+    const url = new URL(value);
+
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      return null;
+    }
+
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+function canUpgradeToRegisteredHttpsOrigin(value: URL, registeredUrl: URL) {
+  return (
+    registeredUrl.protocol === 'https:' &&
+    value.protocol === 'http:' &&
+    value.hostname === registeredUrl.hostname &&
+    value.port === registeredUrl.port
+  );
+}
+
+const PORTLESS_APP_HOSTS = new Set(Object.values(TUTURUUU_PORTLESS_APP_HOSTS));
+
+function canUseLocalPortlessProxyPort(value: URL, registeredUrl: URL) {
+  return (
+    value.protocol === registeredUrl.protocol &&
+    !registeredUrl.port &&
+    Boolean(value.port) &&
+    PORTLESS_APP_HOSTS.has(registeredUrl.hostname)
+  );
+}
+
+function hasCompatiblePortlessPort(value: URL, registeredUrl: URL) {
+  return (
+    value.port === registeredUrl.port ||
+    canUseLocalPortlessProxyPort(value, registeredUrl)
+  );
+}
+
+function matchesPortlessProxyOrigin(value: URL, registeredUrl: URL) {
+  return (
+    canUseLocalPortlessProxyPort(value, registeredUrl) &&
+    value.hostname === registeredUrl.hostname
+  );
+}
+
+function matchesPrefixedPortlessOrigin(value: URL, registeredUrl: URL) {
+  if (
+    value.protocol !== registeredUrl.protocol ||
+    !hasCompatiblePortlessPort(value, registeredUrl) ||
+    !PORTLESS_APP_HOSTS.has(registeredUrl.hostname) ||
+    PORTLESS_APP_HOSTS.has(value.hostname)
+  ) {
+    return false;
+  }
+
+  const suffix = `.${registeredUrl.hostname}`;
+
+  if (!value.hostname.endsWith(suffix)) {
+    return false;
+  }
+
+  const prefix = value.hostname.slice(0, -suffix.length);
+
+  return Boolean(prefix) && !prefix.includes('.');
+}
+
+function serializeUrl(value: URL) {
+  return value.pathname === '/' && !value.search && !value.hash
+    ? value.origin
+    : value.toString();
+}
+
+function matchesAppDomainUrl(value: URL, domain: AppDomain) {
+  const registeredUrl = parseHttpUrl(domain.url);
+
+  if (!registeredUrl) {
+    return false;
+  }
+
+  if (value.origin === registeredUrl.origin) {
+    return true;
+  }
+
+  if (
+    domain.kind === 'internal' &&
+    (matchesPortlessProxyOrigin(value, registeredUrl) ||
+      matchesPrefixedPortlessOrigin(value, registeredUrl))
+  ) {
+    return true;
+  }
+
+  return domain.kind === 'internal'
+    ? canUpgradeToRegisteredHttpsOrigin(value, registeredUrl)
+    : false;
+}
+
+function canonicalizeAppDomainUrl(value: URL, domain: AppDomain) {
+  const registeredUrl = parseHttpUrl(domain.url);
+
+  if (
+    registeredUrl &&
+    domain.kind === 'internal' &&
+    (canUpgradeToRegisteredHttpsOrigin(value, registeredUrl) ||
+      matchesPortlessProxyOrigin(value, registeredUrl))
+  ) {
+    const canonicalUrl = new URL(value.toString());
+    canonicalUrl.protocol = registeredUrl.protocol;
+    canonicalUrl.hostname = registeredUrl.hostname;
+    canonicalUrl.port = registeredUrl.port;
+    return serializeUrl(canonicalUrl);
+  }
+
+  return serializeUrl(value);
+}
+
+export function getAppDomainByUrl(value: string): AppDomainUrlMatch | null {
+  const url = parseHttpUrl(value);
+
+  if (!url) {
+    return null;
+  }
+
+  const domain = getAppDomainMap().find((entry) =>
+    matchesAppDomainUrl(url, entry)
+  );
+
+  return domain
+    ? {
+        ...domain,
+        canonicalUrl: canonicalizeAppDomainUrl(url, domain),
+      }
+    : null;
+}
+
+export function getInternalAppDomainByUrl(
+  value: string
+): AppDomainUrlMatch | null {
+  const appDomain = getAppDomainByUrl(value);
+
+  return appDomain?.kind === 'internal' ? appDomain : null;
+}
+
+export const INTERNAL_DOMAINS = [
+  ...PRODUCTION_INTERNAL_APP_DOMAINS,
+  ...DEV_INTERNAL_APP_DOMAINS,
+].map((domain) => domain.url);