akanjs 3.1.0-rc.5 → 3.1.0-rc.7

package/client/href.ts

@@ -0,0 +1,24 @@
+export class Href {
+  static readonly #blocked = new Set(["javascript:", "vbscript:", "data:"]);
+
+  /** External is what the browser takes off-site: any absolute URL with a scheme, and `//`/`\\` network-path
+   * forms it resolves to another host. javascript:, vbscript: and data: never count. */
+  static isExternal(href: string): boolean {
+    
+    if (URL.canParse(href)) return !Href.#blocked.has(new URL(href).protocol);
+
+    return /^[\\/]{2}/.test(href.replace(/[\t\n\r]/g, "").replace(/^[\u0000-\u0020]+/, ""));
+  }
+
+  /** An explicit http(s) scheme in any case; `//host` and `httpbin/x` do not qualify. */
+  static hasWebScheme(href: string): boolean {
+    return /^https?:/i.test(href);
+  }
+
+  /** Canonical absolute URL for an external href: scheme-relative and backslash hosts resolve against the page's
+   * http(s) origin, or https: when the page is a native `app://` shell. */
+  static toExternalUrl(href: string, base: string): string {
+    const baseProtocol = URL.canParse(base) ? new URL(base).protocol : "";
+    return new URL(href, /^https?:$/.test(baseProtocol) ? base : "https://localhost").href;
+  }
+}

package/client/index.ts

@@ -7,6 +7,7 @@ export * from "./csrTypes";
 export * from "./decorators";
 export * from "./device";
 export * from "./frameConfig";
+export * from "./href";
 export * from "./locale";
 export * from "./makePageProto";
 export * from "./mcpView";

package/client/router.ts

@@ -1,6 +1,7 @@
 import { getEnv } from "akanjs/base";
 import { getBasePathFromPathname, Logger, parseAkanI18nEnv, parseBasePaths, trimSlashes } from "akanjs/common";
 import { csrLocation } from "./csrLocation";
+import { Href } from "./href";
 import { isMcpView } from "./mcpView";
 
 export interface RouteOptions {
@@ -158,7 +159,8 @@ export const getPathInfo = (requestUrl: string, lang: string, prefix: string) =>
         ? pathWithSubRoute.slice(prefixLength)
         : pathWithSubRoute;
   const subRoute = prefix ? `/${prefix}` : "";
-  const pathname = path.startsWith("http") ? path : path === "/" ? `/${lang}${subRoute}` : `/${lang}${subRoute}${path}`;
+  
+  const pathname = Href.hasWebScheme(path) ? path : path === "/" ? `/${lang}${subRoute}` : `/${lang}${subRoute}${path}`;
   const href = `${pathname}${search ? `?${search}` : ""}${hash ? `#${hash}` : ""}`;
   return { path, pathname, hash, search, href };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.1.0-rc.5",
+  "version": "3.1.0-rc.7",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/types/client/href.d.ts

@@ -0,0 +1,11 @@
+export declare class Href {
+    #private;
+    /** External is what the browser takes off-site: any absolute URL with a scheme, and `//`/`\\` network-path
+     * forms it resolves to another host. javascript:, vbscript: and data: never count. */
+    static isExternal(href: string): boolean;
+    /** An explicit http(s) scheme in any case; `//host` and `httpbin/x` do not qualify. */
+    static hasWebScheme(href: string): boolean;
+    /** Canonical absolute URL for an external href: scheme-relative and backslash hosts resolve against the page's
+     * http(s) origin, or https: when the page is a native `app://` shell. */
+    static toExternalUrl(href: string, base: string): string;
+}

package/types/client/index.d.ts

@@ -7,6 +7,7 @@ export * from "./csrTypes.d.ts";
 export * from "./decorators.d.ts";
 export * from "./device.d.ts";
 export * from "./frameConfig.d.ts";
+export * from "./href.d.ts";
 export * from "./locale.d.ts";
 export * from "./makePageProto.d.ts";
 export * from "./mcpView.d.ts";

package/ui/Link/Anchor.tsx

@@ -1,6 +1,6 @@
 "use client";
 import { getEnv } from "akanjs/base";
-import { cn, csrLocation, getPathInfo, router, usePage, usePathCtx } from "akanjs/client";
+import { cn, csrLocation, getPathInfo, Href, router, usePage, usePathCtx } from "akanjs/client";
 import { openExternalUrl } from "akanjs/client/native";
 import { Logger } from "akanjs/common";
 import { st } from "akanjs/store";
@@ -50,10 +50,12 @@ export const CsrLink = ({
       onClick={(event) => {
         props.onClick?.(event);
         if (event.defaultPrevented) return;
-        const isExternal = href.startsWith("http") || href.startsWith("mailto:") || href.startsWith("tel:");
+        const isExternal = Href.isExternal(href);
         const url = href.startsWith("#") ? `${csrLocation.pathname}#${hash}` : href;
-        if (isExternal) void openExternalUrl(href).catch(() => window.open(href, "_blank", "noopener,noreferrer"));
-        else if (replace) router.replace(url, { scrollToTop });
+        if (isExternal) {
+          const target = Href.toExternalUrl(href, window.location.href);
+          void openExternalUrl(target).catch(() => window.open(target, "_blank", "noopener,noreferrer"));
+        } else if (replace) router.replace(url, { scrollToTop });
         else router.push(url, { scrollToTop });
       }}
     >
@@ -78,7 +80,7 @@ export const SsrLink = ({
   const { lang } = usePage();
   const pathname = useCurrentPathname();
   const currentPath = getPathInfo(pathname, lang, prefix).path;
-  const isExternal = href.startsWith("http") || href.startsWith("mailto:") || href.startsWith("tel:");
+  const isExternal = Href.isExternal(href);
   const internalPathInfo = getPathInfo(href, lang, prefix);
   const requestHref = getEnv().operationMode === "local" ? internalPathInfo.href : getPathInfo(href, lang, "").href;
   const path = internalPathInfo.path;