@vicacha-devs/strapi-plugin-inbox 1.1.0 → 1.1.2

package/dist/server/src/controllers/formHandlers.d.ts

@@ -1,5 +1,6 @@
 import { Core } from '@strapi/strapi';
 import { ControllerCtx } from './inboxController';
+export declare function resolveClientIp(ctx: ControllerCtx): string;
 export declare const createFormHandlers: (strapi: Core.Strapi) => {
     getSettings(ctx: ControllerCtx): Promise<void>;
     updateSettings(ctx: ControllerCtx): Promise<void>;

package/dist/server/src/routes/admin.d.ts

@@ -5,7 +5,12 @@ declare const _default: {
         path: string;
         handler: string;
         config: {
-            policies: never[];
+            policies: (string | {
+                name: string;
+                config: {
+                    actions: string[];
+                };
+            })[];
         };
     }[];
 };

package/dist/server/src/routes/index.d.ts

@@ -18,7 +18,12 @@ declare const _default: {
             path: string;
             handler: string;
             config: {
-                policies: never[];
+                policies: (string | {
+                    name: string;
+                    config: {
+                        actions: string[];
+                    };
+                })[];
             };
         }[];
     };

package/dist/shared/index.d.ts

@@ -1 +1,2 @@
-export * from '../../shared/index.js';
+declare const shared: Record<string, unknown>;
+export default shared;

package/dist/shared/index.js

@@ -104,15 +104,122 @@ const DEFAULT_INBOX_SETTINGS = {
   defaultNotifyEmails: [],
   outboundWebhookUrl: ""
 };
+const SUPPORTED_INTL_CALENDARS = Object.freeze([
+  { id: "gregory", intlCalendar: "gregory", defaultLabel: "Gregorian" },
+  { id: "iso8601", intlCalendar: "iso8601", defaultLabel: "ISO 8601" },
+  {
+    id: "islamic-umalqura",
+    intlCalendar: "islamic-umalqura",
+    defaultLabel: "Hijri (Umm al-Qura)"
+  },
+  {
+    id: "islamic-civil",
+    intlCalendar: "islamic-civil",
+    defaultLabel: "Hijri (Civil)"
+  },
+  {
+    id: "islamic-tbla",
+    intlCalendar: "islamic-tbla",
+    defaultLabel: "Hijri (Tabular)"
+  },
+  { id: "hebrew", intlCalendar: "hebrew", defaultLabel: "Hebrew" },
+  {
+    id: "persian",
+    intlCalendar: "persian",
+    defaultLabel: "Persian (Solar Hijri)"
+  },
+  { id: "buddhist", intlCalendar: "buddhist", defaultLabel: "Buddhist" },
+  { id: "japanese", intlCalendar: "japanese", defaultLabel: "Japanese" },
+  { id: "chinese", intlCalendar: "chinese", defaultLabel: "Chinese Lunar" },
+  { id: "indian", intlCalendar: "indian", defaultLabel: "Indian National" },
+  { id: "coptic", intlCalendar: "coptic", defaultLabel: "Coptic" },
+  { id: "ethiopic", intlCalendar: "ethiopic", defaultLabel: "Ethiopic" }
+]);
+Object.freeze([
+  "none",
+  ...SUPPORTED_INTL_CALENDARS.map((item) => item.id)
+]);
+const BASE_BCP47_REGEX = /^[a-zA-Z]{2,3}(?:-[a-zA-Z0-9]{2,8})*$/;
+function sanitizeCalendarBaseLocale(locale, fallbackLocale = "es") {
+  if (typeof locale !== "string" || !locale.trim()) {
+    return fallbackLocale;
+  }
+  const trimmed = locale.trim();
+  const uIdx = trimmed.toLowerCase().indexOf("-u-");
+  let stripped = uIdx >= 0 ? trimmed.slice(0, uIdx) : trimmed;
+  while (stripped.endsWith("-")) {
+    stripped = stripped.slice(0, -1);
+  }
+  if (!stripped || stripped.length > 35 || !BASE_BCP47_REGEX.test(stripped)) {
+    return fallbackLocale;
+  }
+  return stripped;
+}
+function formatSecondaryDate(isoDateString, calendar = "islamic-umalqura", locale = "es") {
+  if (!isoDateString || calendar === "none") {
+    return { calendar, formatted: "" };
+  }
+  const date = new Date(isoDateString);
+  if (Number.isNaN(date.getTime())) {
+    return { calendar, formatted: isoDateString };
+  }
+  try {
+    const baseLocale = sanitizeCalendarBaseLocale(locale);
+    const formatter = new Intl.DateTimeFormat(`${baseLocale}-u-ca-${calendar}`, {
+      year: "numeric",
+      month: "short",
+      day: "numeric"
+    });
+    const parts = formatter.formatToParts(date);
+    const year = Number(parts.find((p) => p.type === "year")?.value) || void 0;
+    const month = Number(parts.find((p) => p.type === "month")?.value) || void 0;
+    const day = Number(parts.find((p) => p.type === "day")?.value) || void 0;
+    return {
+      calendar,
+      formatted: formatter.format(date),
+      year,
+      month,
+      day
+    };
+  } catch {
+    return {
+      calendar,
+      formatted: date.toISOString().slice(0, 10)
+    };
+  }
+}
 function isValidEmail(value) {
-  if (/\s/.test(value))
+  if (typeof value !== "string" || value.length < 3 || value.length > 254) {
+    return false;
+  }
+  if (/[\u0000-\u0020\u007f]/.test(value) || /\s/.test(value))
     return false;
   const at = value.indexOf("@");
-  if (at < 1 || at !== value.lastIndexOf("@"))
+  if (at < 1 || at > 64 || at !== value.lastIndexOf("@"))
     return false;
+  const local = value.slice(0, at);
+  if (local.startsWith(".") || local.endsWith(".") || local.includes("..")) {
+    return false;
+  }
   const domain = value.slice(at + 1);
-  const dot = domain.indexOf(".");
-  return dot > 0 && dot < domain.length - 1;
+  if (domain.startsWith(".") || domain.endsWith(".") || domain.includes("..")) {
+    return false;
+  }
+  const labels = domain.split(".");
+  if (labels.length < 2)
+    return false;
+  return labels.every((label) => label.length > 0 && label.length <= 63 && !label.startsWith("-") && !label.endsWith("-"));
+}
+const CSV_FORMULA_PREFIX_RE = /^[\s\u0085\u2028\u2029]*[=+\-@|]|^[\t\r\n]/;
+function escapeCsvCell(value) {
+  if (value === null || value === void 0)
+    return "";
+  const raw = typeof value === "object" ? JSON.stringify(value) : String(value);
+  const sanitized = raw.length > 0 && CSV_FORMULA_PREFIX_RE.test(raw) ? `'${raw}` : raw;
+  if (sanitized.includes('"') || sanitized.includes(",") || sanitized.includes("\n") || sanitized.includes("\r")) {
+    return `"${sanitized.replace(/"/g, '""')}"`;
+  }
+  return sanitized;
 }
 function freezeOptions(items) {
   return Object.freeze(items.map((item) => Object.freeze({ ...item })));
@@ -144,6 +251,54 @@ freezeOptions([
   { value: "persian", label: "persian (Solar Hijri)" },
   { value: "none", label: "none (Gregorian Only)" }
 ]);
+class SlidingWindowRateLimiter {
+  hits = /* @__PURE__ */ new Map();
+  maxTrackedKeys;
+  defaultWindowMs;
+  constructor(options) {
+    this.maxTrackedKeys = options?.maxTrackedKeys ?? 1e4;
+    this.defaultWindowMs = options?.defaultWindowMs ?? 60 * 60 * 1e3;
+  }
+  check(ip, bucketKey, limitPerWindow, nowMs = Date.now(), windowMs = this.defaultWindowMs) {
+    if (limitPerWindow <= 0) {
+      return { allowed: true, remaining: 999, retryAfterSeconds: 0 };
+    }
+    if (this.hits.size > this.maxTrackedKeys) {
+      const oldestKey = this.hits.keys().next().value;
+      if (oldestKey !== void 0) {
+        this.hits.delete(oldestKey);
+      }
+    }
+    const key = `${bucketKey}::${ip || "unknown"}`;
+    const cutoff = nowMs - windowMs;
+    const previous = (this.hits.get(key) || []).filter((ts) => ts > cutoff);
+    if (previous.length >= limitPerWindow) {
+      const oldest = previous[0] ?? nowMs;
+      const retryAfterSeconds = Math.max(1, Math.ceil((oldest + windowMs - nowMs) / 1e3));
+      this.hits.set(key, previous);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterSeconds
+      };
+    }
+    previous.push(nowMs);
+    this.hits.set(key, previous);
+    return {
+      allowed: true,
+      remaining: Math.max(0, limitPerWindow - previous.length),
+      retryAfterSeconds: 0
+    };
+  }
+  reset() {
+    this.hits.clear();
+  }
+}
+const FORBIDDEN_OBJECT_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
 const LOCALIZED_REQUIRED_FALLBACK = {
   es: (label) => `${label} es obligatorio`,
   en: (label) => `${label} is required`,
@@ -241,12 +396,23 @@ function checkNumericBoundRule(rule, limit, rawValue, fieldLabel, locale) {
   }
   return null;
 }
+function hasNestedQuantifier(pattern) {
+  return /[+*?}]\s*\)\s*[+*?{]/.test(pattern.replaceAll(/\\./g, ""));
+}
 function checkLengthOrNumberRule(rule, rawValue, strVal, fieldLabel, locale) {
-  if (typeof rule.value !== "number") return null;
-  return checkLengthRule(rule, rule.value, strVal, fieldLabel, locale) ?? checkNumericBoundRule(rule, rule.value, rawValue, fieldLabel, locale);
+  const numRuleVal = typeof rule.value === "number" ? rule.value : typeof rule.value === "string" && rule.value.trim() !== "" ? Number(rule.value) : Number.NaN;
+  if (!Number.isFinite(numRuleVal)) return null;
+  return checkLengthRule(rule, numRuleVal, strVal, fieldLabel, locale) ?? checkNumericBoundRule(rule, numRuleVal, rawValue, fieldLabel, locale);
 }
 function checkPatternOrEmailRule(rule, fieldType, strVal, fieldLabel, locale) {
   if (rule.type === "pattern" && typeof rule.value === "string") {
+    if (strVal.length > 4096 || rule.value.length > 512 || hasNestedQuantifier(rule.value)) {
+      return resolveRuleMessage(
+        rule,
+        locale,
+        `${fieldLabel} format is invalid`
+      );
+    }
     try {
       const regex = new RegExp(rule.value);
       if (!regex.test(strVal)) {
@@ -266,6 +432,13 @@ function checkPatternOrEmailRule(rule, fieldType, strVal, fieldLabel, locale) {
       `${fieldLabel} must be a valid email address`
     );
   }
+  if (rule.type === "url" && fieldType !== "url" && !isValidHttpUrl(strVal)) {
+    return resolveRuleMessage(
+      rule,
+      locale,
+      `${fieldLabel} must be a valid URL`
+    );
+  }
   return null;
 }
 function evaluateCustomRules(field, rawValue, strVal, fieldLabel, locale, rules) {
@@ -300,7 +473,7 @@ function buildRequiredError(rules, locale, fieldLabel) {
   return resolveRuleMessage(reqRule, locale, fallbackFn(fieldLabel));
 }
 function validateSingleField(field, data, locale) {
-  const rawValue = data[field.name] ?? field.defaultValue;
+  const rawValue = Object.hasOwn(data, field.name) ? data[field.name] : field.defaultValue;
   const fieldLabel = resolveFieldLabel(field, locale);
   const rules = field.validation || [];
   if (field.required && isValueEmpty(rawValue)) {
@@ -333,7 +506,9 @@ function validateFormSubmission(fields, data, locale = "en") {
   const errors = {};
   const cleanedData = {};
   for (const field of fields) {
-    if (DECORATIVE_FIELD_TYPES.includes(field.type)) continue;
+    if (DECORATIVE_FIELD_TYPES.includes(field.type) || FORBIDDEN_OBJECT_KEYS.has(field.name)) {
+      continue;
+    }
     const { fieldErrors, cleanedValue } = validateSingleField(
       field,
       data,
@@ -352,45 +527,10 @@ function validateFormSubmission(fields, data, locale = "en") {
   };
 }
 function isHoneypotTriggered(payload, honeypotField = "_website_url") {
-  if (!honeypotField) return false;
+  if (!honeypotField || !Object.hasOwn(payload, honeypotField)) return false;
   const val = payload[honeypotField];
   return typeof val === "string" && val.trim().length > 0;
 }
-class SlidingWindowRateLimiter {
-  hits = /* @__PURE__ */ new Map();
-  check(ip, bucketKey, limitPerHour, nowMs = Date.now()) {
-    if (limitPerHour <= 0) {
-      return { allowed: true, remaining: 999, retryAfterSeconds: 0 };
-    }
-    const windowMs = 60 * 60 * 1e3;
-    const key = `${bucketKey}::${ip || "unknown"}`;
-    const cutoff = nowMs - windowMs;
-    const previous = (this.hits.get(key) || []).filter((ts) => ts > cutoff);
-    if (previous.length >= limitPerHour) {
-      const oldest = previous[0] ?? nowMs;
-      const retryAfterSeconds = Math.max(
-        1,
-        Math.ceil((oldest + windowMs - nowMs) / 1e3)
-      );
-      this.hits.set(key, previous);
-      return {
-        allowed: false,
-        remaining: 0,
-        retryAfterSeconds
-      };
-    }
-    previous.push(nowMs);
-    this.hits.set(key, previous);
-    return {
-      allowed: true,
-      remaining: Math.max(0, limitPerHour - previous.length),
-      retryAfterSeconds: 0
-    };
-  }
-  reset() {
-    this.hits.clear();
-  }
-}
 const defaultRateLimiter = new SlidingWindowRateLimiter();
 function resolveFetchRunner(fetchImpl) {
   return fetchImpl ?? globalThis.fetch;
@@ -749,16 +889,6 @@ function localizeFormForLocale(form, locale) {
     }
   };
 }
-const FORMULA_PREFIXES = ["=", "+", "-", "@", "	", "\r"];
-function escapeCsvCell(value) {
-  if (value === null || value === void 0) return "";
-  const raw = typeof value === "object" ? JSON.stringify(value) : String(value);
-  const sanitized = raw.length > 0 && FORMULA_PREFIXES.includes(raw[0]) ? `'${raw}` : raw;
-  if (sanitized.includes('"') || sanitized.includes(",") || sanitized.includes("\n") || sanitized.includes("\r")) {
-    return `"${sanitized.replace(/"/g, '""')}"`;
-  }
-  return sanitized;
-}
 function collectDataFieldNames(submissions, fields) {
   const dataFieldNames = [];
   const seen = /* @__PURE__ */ new Set();
@@ -821,68 +951,8 @@ function submissionsToCsv(submissions, fields = []) {
   }
   return rows.join("\n");
 }
-const SUPPORTED_INTL_CALENDARS = [
-  { id: "gregory", intlCalendar: "gregory", defaultLabel: "Gregorian" },
-  { id: "iso8601", intlCalendar: "iso8601", defaultLabel: "ISO 8601" },
-  {
-    id: "islamic-umalqura",
-    intlCalendar: "islamic-umalqura",
-    defaultLabel: "Hijri (Umm al-Qura)"
-  },
-  {
-    id: "islamic-civil",
-    intlCalendar: "islamic-civil",
-    defaultLabel: "Hijri (Civil)"
-  },
-  {
-    id: "islamic-tbla",
-    intlCalendar: "islamic-tbla",
-    defaultLabel: "Hijri (Tabular)"
-  },
-  { id: "hebrew", intlCalendar: "hebrew", defaultLabel: "Hebrew" },
-  {
-    id: "persian",
-    intlCalendar: "persian",
-    defaultLabel: "Persian (Solar Hijri)"
-  },
-  { id: "buddhist", intlCalendar: "buddhist", defaultLabel: "Buddhist" },
-  { id: "japanese", intlCalendar: "japanese", defaultLabel: "Japanese" },
-  { id: "chinese", intlCalendar: "chinese", defaultLabel: "Chinese Lunar" },
-  { id: "indian", intlCalendar: "indian", defaultLabel: "Indian National" },
-  { id: "coptic", intlCalendar: "coptic", defaultLabel: "Coptic" },
-  { id: "ethiopic", intlCalendar: "ethiopic", defaultLabel: "Ethiopic" }
-];
 function convertIsoDateToCalendar(isoDateString, calendar = "islamic-umalqura", locale = "en") {
-  if (!isoDateString) {
-    return { calendar, formatted: "" };
-  }
-  const date = new Date(isoDateString);
-  if (Number.isNaN(date.getTime())) {
-    return { calendar, formatted: isoDateString };
-  }
-  try {
-    const formatter = new Intl.DateTimeFormat(`${locale}-u-ca-${calendar}`, {
-      year: "numeric",
-      month: "short",
-      day: "numeric"
-    });
-    const parts = formatter.formatToParts(date);
-    const year = Number(parts.find((p) => p.type === "year")?.value) || void 0;
-    const month = Number(parts.find((p) => p.type === "month")?.value) || void 0;
-    const day = Number(parts.find((p) => p.type === "day")?.value) || void 0;
-    return {
-      calendar,
-      formatted: formatter.format(date),
-      year,
-      month,
-      day
-    };
-  } catch {
-    return {
-      calendar,
-      formatted: date.toISOString().slice(0, 10)
-    };
-  }
+  return formatSecondaryDate(isoDateString, calendar, locale);
 }
 exports.ALERT_BANNER_UID = ALERT_BANNER_UID;
 exports.ALERT_SEVERITIES = ALERT_SEVERITIES;