@vixoniccom/modules 2.25.0-dev.10 → 2.25.0-dev.12

package/.github/agents/aikido-fixer.agent.md

@@ -0,0 +1,149 @@
+---
+description: "Use when: fixing Aikido security issues, resolving security vulnerabilities reported by Aikido or SonarQube, creating fix branches and PRs for security findings, code smells, or bugs. Keywords: aikido, sonarqube, sonar, security, vulnerability, CVE, dependency, fix, PR, pull request, code smell, bug, quality"
+tools: [execute, read, edit, search, web, todo]
+---
+
+You are **Aikido Fixer**, a security and code quality remediation agent specialized in fixing issues reported by [Aikido Security](https://app.aikido.dev) and [SonarQube](https://sonarcloud.io). Your job is to automate the full lifecycle: branch creation → fix → commit → push → PR creation.
+
+## SonarQube Configuration
+
+- **Project Key**: `Vixonic_server-ruffo_AZYWwtBvmhwfQKlMBTIv`
+- **API Token**: Available via the environment variable `$SONAR_TOKEN_API`
+- **API Base URL**: `https://sonarcloud.io/api`
+
+### Fetching SonarQube Issues
+
+Use the SonarQube Web API to list open issues:
+
+```bash
+# List all open issues (bugs, vulnerabilities, code smells)
+curl -s -u "$SONAR_TOKEN_API:" \
+  "https://sonarcloud.io/api/issues/search?componentKeys=Vixonic_server-ruffo_AZYWwtBvmhwfQKlMBTIv&statuses=OPEN,CONFIRMED,REOPENED&ps=100" \
+  | jq '.issues[] | {key, type, severity, message, component, line}'
+
+# Filter by type (BUG, VULNERABILITY, CODE_SMELL)
+curl -s -u "$SONAR_TOKEN_API:" \
+  "https://sonarcloud.io/api/issues/search?componentKeys=Vixonic_server-ruffo_AZYWwtBvmhwfQKlMBTIv&statuses=OPEN,CONFIRMED,REOPENED&types=VULNERABILITY&ps=100" \
+  | jq '.issues[] | {key, type, severity, message, component, line}'
+
+# Filter by severity (BLOCKER, CRITICAL, MAJOR, MINOR, INFO)
+curl -s -u "$SONAR_TOKEN_API:" \
+  "https://sonarcloud.io/api/issues/search?componentKeys=Vixonic_server-ruffo_AZYWwtBvmhwfQKlMBTIv&statuses=OPEN,CONFIRMED,REOPENED&severities=CRITICAL,BLOCKER&ps=100" \
+  | jq '.issues[] | {key, type, severity, message, component, line}'
+```
+
+## Workflow
+
+Follow these steps in order:
+
+### 1. Gather context
+- Ask the user for the issue(s) to fix. They may provide:
+  - A list of vulnerability or code quality descriptions
+  - Aikido issue URLs/IDs or SonarQube issue keys
+  - A general request like "fix all critical Aikido issues" or "fix SonarQube vulnerabilities"
+- If the user provides a URL to Aikido, use the `web` tool to fetch details about the vulnerability.
+- If the user asks about SonarQube issues, use the API commands above to fetch the issue list, then read the affected files to understand the context.
+
+### 2. Prepare the branch
+```bash
+# Switch to any other branch first to allow deleting development
+git checkout main 2>/dev/null || git checkout master 2>/dev/null || true
+
+# Delete local development branch to avoid rebase conflicts
+git branch -D development 2>/dev/null || true
+
+# Fetch latest and recreate development from origin
+git fetch origin
+git checkout -b development origin/development
+
+# Create the fix branch
+git checkout -b fix/aikido-<short-description>
+```
+- **Important**: Always delete and recreate the local `development` branch from `origin/development` to avoid rebase divergence issues.
+- Use a short, descriptive kebab-case name for `<short-description>` based on the vulnerability (e.g., `fix/aikido-prototype-pollution`, `fix/aikido-xss-sanitize`, `fix/aikido-dep-update`).
+- If fixing multiple unrelated issues, create **separate branches and PRs** for each.
+
+### 3. Diagnose and fix
+- Read the relevant source files or `package.json` to understand the issue.
+- Common fix types:
+  - **Dependency vulnerabilities**: Update the affected package in `package.json` and run `npm install` or `npm audit fix`.
+  - **Code vulnerabilities** (XSS, injection, prototype pollution, etc.): Edit the source code to apply the fix.
+  - **Configuration issues**: Update config files (e.g., Dockerfile, webpack, tsconfig).
+- Always verify the fix compiles/lints correctly by running the project's build or lint command.
+
+### 4. Commit and push
+```bash
+git add -A
+git commit -m "fix(security): <concise description of the fix>
+
+Resolves Aikido issue: <issue reference if available>"
+git push origin fix/aikido-<short-description>
+```
+- Use conventional commit format: `fix(security): <description>`
+- Include Aikido issue reference in the commit body when available.
+
+### 5. Create the Pull Request
+```bash
+gh pr create \
+  --base development \
+  --title "fix(security): <concise description>" \
+  --body "## Security Fix
+
+**Aikido Issue**: <reference or description>
+
+### Changes
+- <bullet points of what was changed>
+
+### Verification
+- [ ] Build passes
+- [ ] No new vulnerabilities introduced
+- [ ] Aikido issue should be resolved after merge"
+```
+
+### 6. Wait for CI pipelines and validate
+After creating the PR, monitor the pipeline status. This repo has two relevant checks:
+- **Webpack Ruffo-notifications Build** (runs on all branches)
+- **Sonarqube Analysis** (runs on PRs to `development`)
+
+```bash
+# Wait for checks to complete (timeout 10 minutes)
+gh pr checks <PR_NUMBER> --watch --interval 30 --fail-fast
+```
+
+- If the checks **pass**: inform the user that the PR is ready for review.
+- If the checks **fail**:
+  1. Fetch the failed check logs:
+     ```bash
+     gh run list --branch fix/aikido-<short-description> --limit 5
+     gh run view <RUN_ID> --log-failed
+     ```
+  2. Diagnose the failure and attempt to fix it.
+  3. Commit the fix, push, and re-monitor the checks.
+  4. If after 2 attempts the checks still fail, report the failure details to the user and ask for guidance.
+
+### 7. Report back
+Provide a summary to the user:
+- Branch name
+- What was fixed and how
+- PR URL
+- CI pipeline status (passed/failed with details)
+- Any remaining issues that couldn't be auto-fixed
+
+## Constraints
+- DO NOT modify files unrelated to the security fix.
+- DO NOT force push or use `--no-verify`.
+- DO NOT merge the PR — only create it.
+- DO NOT commit secrets, tokens, or credentials.
+- ALWAYS create the branch from `development`, never from `main` or any other branch.
+- ALWAYS verify the fix compiles before committing.
+- If unsure about a fix, explain the options to the user and ask before proceeding.
+
+## Output Format
+After completing the workflow, return a structured summary:
+
+```
+✅ Branch: fix/aikido-<name>
+✅ Fix: <what was done>
+✅ PR: <URL>
+⚠️ Notes: <any caveats or manual steps needed>
+```

package/.github/workflows/main.yml

@@ -0,0 +1,133 @@
+name: Deploy job
+
+on:
+  pull_request:
+    branches:
+      - master
+    types: [closed]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build and Publish Package
+    runs-on: ubuntu-latest
+    environment: production
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+
+    outputs:
+      version: ${{ steps.extract_version.outputs.version }}
+      deployment-start: ${{ steps.deployment_start.outputs.deployment_start }}
+
+    steps:
+      - name: Log deployment start
+        id: deployment_start
+        run: |
+          echo "deployment_start=$(date +"%Y-%m-%dT%H:%M:%S%:z")" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.PRIVATE_TOKEN_GITHUB }}
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+          scope: '@vixoniccom'
+
+      - name: Configure npm authentication
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+          echo "@vixoniccom:registry=https://registry.npmjs.org/" >> ~/.npmrc
+          echo "registry=https://registry.npmjs.org/" >> ~/.npmrc
+
+      - name: Cache node modules
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Bump version
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          npm run release -- --no-verify
+          git push --follow-tags origin main
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Extract changelog for this release
+        id: changelog
+        run: |
+          BODY=$(awk '/^## \[/{if(p) exit; p=1} p' CHANGELOG.md)
+          echo "body<<EOF" >> $GITHUB_OUTPUT
+          echo "$BODY" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Extract version from package.json
+        id: extract_version
+        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+
+      - name: Build package
+        run: npm run prepublish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Verify build.zip exists
+        run: |
+          if [ ! -f "build.zip" ]; then
+            echo "❌ Error: build.zip not found after build process"
+            exit 1
+          fi
+          echo "✅ build.zip found successfully"
+          ls -la build.zip
+
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
+        with:
+          tag_name: v${{ steps.extract_version.outputs.version }}
+          name: v${{ steps.extract_version.outputs.version }}
+          body: ${{ steps.changelog.outputs.body }}
+          files: build.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.PRIVATE_TOKEN_GITHUB }}
+
+  report-ep:
+    name: Report EP Metrics
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: always()
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.PRIVATE_TOKEN_GITHUB }}
+
+      - uses: vismagroup/Jira-SDOP-Reporter@v1 # NOSONAR - internal Visma action
+        with:
+          token: ${{ github.token }}
+          deployment-start: ${{ needs.build.outputs.deployment-start }}
+          deployment-status: ${{ needs.build.result == 'success' && 'success' || 'failure' }}
+          jira-token: ${{ secrets.JIRA_TOKEN }}
+          jira-issue-summary: "store-modules release v${{ needs.build.outputs.version }}"
+          jira-issue-project: "SDOP"
+          jira-issue-components: |
+            ${{ secrets.EP_JIRA_COMPONENT }}
+          jira-issue-build-info: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

package/.github/workflows/sonarqube.yml

@@ -17,13 +17,13 @@ jobs:
           fetch-depth: 0
 
       - name: SonarQube Scan
-        uses: sonarsource/sonarqube-scan-action@master
+        uses: sonarsource/sonarqube-scan-action@f099b441665cb71b0414100cfaf6d835492cee5f # master
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
       
       - name: SonarQube Quality Gate Check
-        uses: sonarsource/sonarqube-quality-gate-action@master
+        uses: sonarsource/sonarqube-quality-gate-action@cb3ed20f9fec62b4c3b8ad9e77656c6adaade913 # master
         timeout-minutes: 5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.25.0-dev.12](https://github.com/Vixonic/store-modules/compare/v2.25.0-dev.11...v2.25.0-dev.12) (2026-04-21)
+
+## [2.25.0-dev.11](https://github.com/Vixonic/store-modules/compare/v2.25.0-dev.3...v2.25.0-dev.11) (2026-04-21)
+
+
+### Features
+
+* VXD-898 add new service ([d6bd32b](https://github.com/Vixonic/store-modules/commit/d6bd32b7b326bc02f5248778d1d97063d9e4c2c8))
+
 ## [2.25.0-dev.10](https://github.com/Vixonic/store-modules/compare/v2.25.0-dev.2...v2.25.0-dev.10) (2026-04-01)
 
 ## [2.25.0-dev.9](https://github.com/Vixonic/store-modules/compare/v2.25.0-dev.2...v2.25.0-dev.9) (2026-04-01)

package/dist/lib/index.js

@@ -79,9 +79,17 @@ var Configuration = /** @class */ (function () {
         var jsEval = this.durationFormula;
         try {
             var regexp = new RegExp('{{(.*?)}}', 'ig');
-            jsEval = jsEval.replace(regexp, "_values.$1");
-            // tslint:disable-next-line
-            var time = eval(jsEval);
+            jsEval = jsEval.replace(regexp, function (_match, field) {
+                var val = _values[field.trim()];
+                return (typeof val === 'number' && Number.isFinite(val)) ? String(val) : '0';
+            });
+            // Only allow digits, arithmetic operators, spaces, parentheses and decimal points
+            if (!/^[.\d\s+\-*/%()]+$/.test(jsEval)) {
+                console.warn('Computed time error: Invalid characters in time expression:', jsEval);
+                return undefined;
+            }
+            // Input is validated above against an arithmetic-only allowlist before reaching this call. // NOSONAR
+            var time = new Function("return (".concat(jsEval, ");"))(); // NOSONAR
             if (typeof time === 'number') {
                 // validate number
                 if (isNaN(time) || time < 4 || time >= 86400) {

package/dist/lib/inputs/service-input.d.ts

@@ -1,6 +1,6 @@
 import { Input, IInput } from '../base';
 import { ValueError } from '../errors';
-export type ServiceType = 'RSSService' | 'InstagramMediaService' | 'LinkedInCompanyMediaService' | 'FacebookPageService' | 'WeatherService' | 'VixonicStoriesService' | 'TwitterService' | 'TimezoneService' | 'NewTimezoneService' | 'ColabraService' | 'RexmasBirthdayService' | 'RexmasAnniversarieService' | 'RexmasNewEmployeesService' | 'TikTokService' | 'BukBirthdayService' | 'BukAnniversariesService' | 'BukNewEmployeesService' | 'AgendaAppService' | 'AnniversaryAppService' | 'BirthdayAppService' | 'NewEmployeesAppService' | 'CurrencyAppService' | 'SheetsReaderService' | 'TalanaAnniversariesService' | 'TalanaBirthdayService' | 'TalanaNewEmployeesService' | 'YoutubeService' | 'MetalAppService';
+export type ServiceType = 'RSSService' | 'InstagramMediaService' | 'LinkedInCompanyMediaService' | 'FacebookPageService' | 'WeatherService' | 'VixonicStoriesService' | 'TwitterService' | 'TimezoneService' | 'NewTimezoneService' | 'ColabraService' | 'RexmasBirthdayService' | 'RexmasAnniversarieService' | 'RexmasNewEmployeesService' | 'TikTokService' | 'BukBirthdayService' | 'BukAnniversariesService' | 'BukNewEmployeesService' | 'AgendaAppService' | 'AnniversaryAppService' | 'BirthdayAppService' | 'NewEmployeesAppService' | 'CurrencyAppService' | 'SheetsReaderService' | 'TalanaAnniversariesService' | 'TalanaBirthdayService' | 'TalanaNewEmployeesService' | 'YoutubeService' | 'LocalAppSheetsService' | 'MetalAppService';
 export interface IServiceInput extends IInput {
     serviceType: ServiceType;
     required?: boolean;

package/dist/lib/inputs/text-area.js

@@ -50,10 +50,10 @@ var TextArea = /** @class */ (function (_super) {
         if (this.range) {
             if (this.html) {
                 var auxValue = (value === null || value === void 0 ? void 0 : value.replace(/<[^>]*>/g, '').trim()) || '';
-                length = (auxValue === null || auxValue === void 0 ? void 0 : auxValue.length) || 0;
+                length = (auxValue === null || auxValue === void 0 ? void 0 : auxValue.replace(/ /g, '').length) || 0;
             }
             else {
-                length = (value === null || value === void 0 ? void 0 : value.length) || 0;
+                length = (value === null || value === void 0 ? void 0 : value.replace(/ /g, '').length) || 0;
             }
             errors = errors.concat(validation_1.Validator.min(length, this.range.min));
             errors = errors.concat(validation_1.Validator.max(length, this.range.max));

package/dist/lib/inputs/text-input.js

@@ -52,7 +52,7 @@ var TextInput = /** @class */ (function (_super) {
                 errors = errors.concat({ type: 'pattern' });
         }
         if (this.range) {
-            var length = value && value.length || 0;
+            var length = value && value.replace(/ /g, '').length || 0;
             errors = errors.concat(validation_1.Validator.min(length, this.range.min));
             errors = errors.concat(validation_1.Validator.max(length, this.range.max));
         }

package/dist/lib/visibility.js

@@ -7,9 +7,24 @@ function shouldBeVisible(item, _values) {
     var jsEval = item.show;
     try {
         var regexp = new RegExp('{{(.*?)}}', 'ig');
-        jsEval = jsEval.replace(regexp, "_values.$1");
-        // tslint:disable-next-line
-        var show = new Function('_values', "return ".concat(jsEval, ";"))(_values);
+        jsEval = jsEval.replace(regexp, function (_match, field) {
+            var val = _values[field.trim()];
+            if (val === null || val === undefined)
+                return 'null';
+            if (typeof val === 'number' || typeof val === 'boolean')
+                return String(val);
+            if (typeof val === 'string')
+                return JSON.stringify(val);
+            return JSON.stringify(val);
+        });
+        // Only allow safe characters: digits, strings (quotes), comparison/logical/arithmetic operators,
+        // spaces, parentheses, brackets, dots, commas and alphanumeric identifiers (true/false/null).
+        if (!/^[\w\s"'!<>=&|+\-*/%().,[\]?:]+$/.test(jsEval)) {
+            console.warn('Unable to parse expression (unsafe characters):', jsEval);
+            return true;
+        }
+        // Input is validated above against a strict character allowlist before reaching this call. // NOSONAR
+        var show = new Function("return (".concat(jsEval, ");"))(); // NOSONAR
         return !!show;
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vixoniccom/modules",
-  "version": "2.25.0-dev.10",
+  "version": "2.25.0-dev.12",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/.github/workflows/npm-publish.yml

@@ -1,91 +0,0 @@
-name: Publish to NPM
-
-on:
-  push:
-    branches:
-      - master
-      - main
-  pull_request:
-    branches:
-      - master
-      - main
-    types: [closed]
-
-jobs:
-  publish:
-    # Solo ejecutar si es un push a main/master o un merge a main/master
-    if: github.event_name == 'push' || (github.event.pull_request.merged == true && (github.event.pull_request.base.ref == 'master' || github.event.pull_request.base.ref == 'main'))
-    runs-on: ubuntu-latest
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js 20
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@vixoniccom'
-
-      - name: Configure npm authentication
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
-          echo "@vixoniccom:registry=https://registry.npmjs.org/" >> ~/.npmrc
-          echo "registry=https://registry.npmjs.org/" >> ~/.npmrc
-
-      - name: Cache node modules
-        uses: actions/cache@v3
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-
-      - name: Install dependencies
-        run: npm ci
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Build package
-        run: npm run prepublish
-
-      - name: Check if version already exists on npm
-        id: check-version
-        run: |
-          PACKAGE_NAME=$(node -p "require('./package.json').name")
-          PACKAGE_VERSION=$(node -p "require('./package.json').version")
-          
-          echo "Checking if $PACKAGE_NAME@$PACKAGE_VERSION exists on npm..."
-          
-          if npm view "$PACKAGE_NAME@$PACKAGE_VERSION" version 2>/dev/null; then
-            echo "version-exists=true" >> $GITHUB_OUTPUT
-            echo "⚠️  Version $PACKAGE_VERSION already exists on npm"
-          else
-            echo "version-exists=false" >> $GITHUB_OUTPUT
-            echo "✅ Version $PACKAGE_VERSION does not exist on npm - ready to publish"
-          fi
-
-      - name: Publish to npm
-        if: steps.check-version.outputs.version-exists == 'false'
-        run: |
-          echo "Publishing to npm..."
-          npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publication success
-        if: steps.check-version.outputs.version-exists == 'false'
-        run: |
-          PACKAGE_NAME=$(node -p "require('./package.json').name")
-          PACKAGE_VERSION=$(node -p "require('./package.json').version")
-          echo "🎉 Successfully published $PACKAGE_NAME@$PACKAGE_VERSION to npm!"
-
-      - name: Skip publication
-        if: steps.check-version.outputs.version-exists == 'true'
-        run: |
-          PACKAGE_VERSION=$(node -p "require('./package.json').version")
-          echo "⏭️  Skipping publication - version $PACKAGE_VERSION already exists on npm"
-          echo "💡 To publish a new version, update the version in package.json or run 'npm run release'"