handsontable 18.0.0 → 18.1.0-rc11

package/helpers/mixed.js

@@ -9,6 +9,24 @@ function _export(target, all) {
     });
 }
 _export(exports, {
+    get _BLOCKING_MODAL_STATES () {
+        return _BLOCKING_MODAL_STATES;
+    },
+    get _LICENSE_EXPIRED_TITLE () {
+        return _LICENSE_EXPIRED_TITLE;
+    },
+    get _PURCHASE_LICENSE_TEXT () {
+        return _PURCHASE_LICENSE_TEXT;
+    },
+    get _formatExpiryClause () {
+        return _formatExpiryClause;
+    },
+    get _formatIsoDate () {
+        return _formatIsoDate;
+    },
+    get _getLicenseState () {
+        return _getLicenseState;
+    },
     get _injectProductInfo () {
         return _injectProductInfo;
     },
@@ -29,6 +47,7 @@ _export(exports, {
     }
 });
 const _templateLiteralTag = require("./templateLiteralTag");
+const _entitlementLicenseKey = require("../utils/entitlementLicenseKey");
 function stringify(value) {
     let result;
     switch(typeof value){
@@ -69,6 +88,19 @@ const _norm = (v)=>`${v}`.replace(/\-/g, '');
 const _extractTime = (v)=>_hd(_ss(_norm(v), _hd('12'), _cp('\x46'))) / (_hd(_ss(_norm(v), _cp('\x42'), ~~![][_m])) || 9);
 const _ignored = ()=>typeof location !== 'undefined' && /^([a-z0-9\-]+\.)?\x68\x61\x6E\x64\x73\x6F\x6E\x74\x61\x62\x6C\x65\x2E\x63\x6F\x6D$/i.test(location.host);
 let _notified = false;
+// The entitlement-key console message is deduplicated PER KEY, and deliberately SEPARATE from the
+// legacy `_notified` flag above - do NOT merge them. Two reasons for each half:
+//
+// Separate from `_notified`, because the frozen legacy path sets it even when it prints nothing (a
+// non-commercial key's console message is empty), so a shared flag would let a silent non-commercial
+// grid initialized first suppress a later entitlement key's warning.
+//
+// Keyed by the key string rather than a single boolean, because these messages have severity tiers
+// the legacy path never had: a notice window prints `warn`, every stop prints `error`. With one flag,
+// a page whose first grid holds a trial in its notice period would print that warning and silence the
+// expired license on the second grid entirely - a `warn` masking an `error`. Per key, each distinct
+// license still speaks exactly once, and two grids sharing one key still print once between them.
+const _entitlementNotified = new Set();
 const consoleMessages = {
     invalid: ()=>(0, _templateLiteralTag.toSingleLine)`
     The license key for Handsontable is invalid.\x20
@@ -102,10 +134,168 @@ const domMessages = {
     the documentation or contact us at <a href="mailto:support@handsontable.com">support@handsontable.com</a>.`,
     non_commercial: ()=>''
 };
+function _formatExpiryClause(days) {
+    if (days === 0) {
+        return 'expires today';
+    }
+    return `expires in ${days} ${days === 1 ? 'day' : 'days'}`;
+}
+/**
+ * Marks a date as the UTC calendar day it is. Every message that prints a
+ * `usage_until` date carries the marker, because the day is compared against
+ * the clock in UTC and a reader in another timezone would otherwise read it as
+ * their own. A `release_until` date carries no marker - no clock takes part in
+ * the maintenance check.
+ *
+ * @param {string|undefined} isoDate The date the key carries.
+ * @returns {string}
+ */ function _utcDay(isoDate) {
+    return `${isoDate} (UTC)`;
+}
+const _LICENSE_EXPIRED_TITLE = 'Your Handsontable license key has expired.';
+const _PURCHASE_LICENSE_TEXT = 'To continue using Handsontable, you need to purchase a license.';
+/**
+ * The message a lapsed subscription prints, from its first day past the term onwards.
+ *
+ * @param {EntitlementMessageParams} params The message parameters.
+ * @returns {string}
+ */ function _subscriptionExpiredMessage({ licensedUntil }) {
+    return (0, _templateLiteralTag.toSingleLine)`
+    Your Handsontable subscription license expired on ${_utcDay(licensedUntil)}. To continue using the\x20
+    software, contact sales@handsontable.com to purchase a valid license key.`;
+}
+/**
+ * The console notification for each lifecycle state that talks to the
+ * developer, transcribed from the license specification. Silent states (a
+ * license comfortably inside its term, a build covered by its maintenance date)
+ * have no entry, and neither does a hard-stopped non-trial license: its
+ * soft-stop message persists instead.
+ */ const entitlementConsoleNotifications = {
+    trial_notice: {
+        severity: 'warn',
+        message: ({ daysRemaining })=>(0, _templateLiteralTag.toSingleLine)`
+      Your Handsontable license key ${_formatExpiryClause(daysRemaining)}.\x20
+      ${_PURCHASE_LICENSE_TEXT}`
+    },
+    trial_soft_stop: {
+        severity: 'error',
+        message: ({ licensedUntil })=>(0, _templateLiteralTag.toSingleLine)`
+      Your Handsontable trial license key expired on ${_utcDay(licensedUntil)}.\x20
+      ${_PURCHASE_LICENSE_TEXT}`
+    },
+    trial_hard_stop: {
+        severity: 'error',
+        message: ({ licensedUntil })=>(0, _templateLiteralTag.toSingleLine)`
+      Your Handsontable trial license key expired on ${_utcDay(licensedUntil)}. You may no longer use\x20
+      Handsontable under the trial license. To continue using the software, contact\x20
+      sales@handsontable.com to purchase a valid license.`
+    },
+    usage_notice: {
+        severity: 'warn',
+        message: ({ licensedUntil })=>(0, _templateLiteralTag.toSingleLine)`
+      Your Handsontable subscription license expires on ${_utcDay(licensedUntil)}.\x20
+      To renew your license, contact sales@handsontable.com.`
+    },
+    usage_soft_stop: {
+        severity: 'error',
+        message: _subscriptionExpiredMessage
+    },
+    // Past its grace period, a non-trial license keeps saying exactly what it said inside it: 18.1
+    // never blocks a paying customer, so the soft-stop message persists instead of escalating.
+    usage_hard_stop: {
+        severity: 'error',
+        message: _subscriptionExpiredMessage
+    },
+    release_expired: {
+        severity: 'error',
+        message: ({ licensedUntil, hotVersion })=>(0, _templateLiteralTag.toSingleLine)`
+      The license key for Handsontable expired on ${licensedUntil}, and is not valid for the installed\x20
+      version ${hotVersion}. Renew your license key or downgrade to a version released on or before\x20
+      ${licensedUntil}. If you need any help, contact us at sales@handsontable.com.`
+    }
+};
+/**
+ * The bottom-bar (DOM) copy for the states that show one: the soft-stopped
+ * trial and a build past its maintenance date. Three states render the
+ * Core-owned lock screen instead of a bar (see `_BLOCKING_MODAL_STATES` below
+ * and `utils/licenseBranding/lockScreen.ts`), and a non-trial license never
+ * renders a bar - it is developer-facing only in 18.1.
+ *
+ * The soft-stopped trial DOES carry a bar even though its badge popover auto-opens with the same two
+ * sentences. That duplication is deliberate: the bar is the only license surface with a focusable
+ * link and a registered focus scope (`utils/licenseNotification.ts`), while the popover is
+ * pointer-only by design (`tabIndex = -1` throughout, no focus scope, no `aria-live`). The bar is
+ * also the only surface left once the popover is dismissed - on a grid with no corner cell, nothing
+ * can reopen the popover for the rest of the instance's life. Removing this entry was tried and
+ * reverted (DEV-2709) for exactly those two reasons; leave it in place until the popover can carry
+ * the message on its own.
+ *
+ * Note the shape here is NOT what the specification literally describes. S4.1's soft-stop row reads
+ * "Console error. Trial: + modal", and no modal renders for `trial_soft_stop` - `LOCK_CONTENT` has
+ * no entry for it. Either "modal" is meant loosely for the auto-opening popover, or the state is
+ * missing a surface. That question predates DEV-2709 and is still open; this comment records the
+ * divergence rather than settling it.
+ */ const entitlementDomMessages = {
+    trial_soft_stop: ()=>(0, _templateLiteralTag.toSingleLine)`
+    ${_LICENSE_EXPIRED_TITLE} ${_PURCHASE_LICENSE_TEXT}\x20
+    <a href="mailto:sales@handsontable.com">Contact Sales</a>.`,
+    release_expired: ({ licensedUntil, hotVersion })=>(0, _templateLiteralTag.toSingleLine)`
+    The license key for Handsontable expired on ${licensedUntil}, and is not valid for the installed\x20
+    version ${hotVersion}. <a href="https://handsontable.com/pricing" target="_blank">Renew</a> your license\x20
+    key or downgrade to a version released on or before ${licensedUntil}. If you need any help, contact us\x20
+    at <a href="mailto:sales@handsontable.com">sales@handsontable.com</a>.`
+};
+const _BLOCKING_MODAL_STATES = Object.freeze([
+    'trial_hard_stop',
+    'invalid',
+    'missing'
+]);
+/**
+ * Tells whether a license state speaks through the blocking modal rather than the bottom bar.
+ *
+ * @param {string} state The license state, in either path's vocabulary.
+ * @returns {boolean}
+ */ function _rendersBlockingModal(state) {
+    return _BLOCKING_MODAL_STATES.indexOf(state) !== -1;
+}
+/**
+ * Strips surrounding whitespace from a license key.
+ *
+ * A key pasted out of an email or a chat window commonly carries a trailing space or newline. The
+ * legacy 25-character alphabet has no whitespace in it, so an untrimmed key fails the checksum and
+ * reads as `invalid` - which, from 18.1 on, BLOCKS the grid. A paying customer must not be locked
+ * out by a stray space.
+ *
+ * Applied at the head of BOTH license entry points (`_injectProductInfo` and `_getLicenseState`),
+ * never inside either one: the classifier's whole contract is that it reaches the same verdict as
+ * the frozen emitter, so trimming for one and not the other would desync them (the emitter would
+ * say `invalid` and withhold the bar while the classifier said `legacy_valid` and withheld the lock,
+ * leaving the key silently unreported). The frozen interior of the emitter is untouched - this
+ * normalizes its input, exactly like the entitlement reader's own `trim()` in `detectFormat.ts`.
+ *
+ * @param {string} [key] The license key from the grid settings.
+ * @returns {string|undefined} The key without surrounding whitespace.
+ */ function _trimKey(key) {
+    return typeof key === 'string' ? key.trim() : key;
+}
 function _injectProductInfo({ className, key, element, releaseDate }) {
+    // Reassigning the parameter, exactly as the frozen body below does with `_norm`: the legacy branch
+    // needs `key` to stay one mutable binding.
+    key = _trimKey(key);
+    // An entitlement key is routed to its own path BEFORE any legacy normalization runs. The legacy
+    // branch below is left exactly as-is, so every existing key keeps behaving the same. The shape
+    // test is two string scans, so a legacy key pays almost nothing for it.
+    if ((0, _entitlementLicenseKey.isEntitlementKey)(key)) {
+        return _injectEntitlementProductInfo({
+            className,
+            key,
+            element,
+            releaseDate
+        });
+    }
     const hasValidType = !isEmpty(key);
     const isNonCommercial = typeof key === 'string' && (key.toLowerCase() === 'non-commercial-and-evaluation' || key.toLowerCase() === 'ht68e-1f2b7-47158-70b05-0842f');
-    const hotVersion = "18.0.0";
+    const hotVersion = "18.1.0-rc11";
     let keyValidityDate;
     let consoleMessageState = 'invalid';
     let domMessageState = 'invalid';
@@ -116,7 +306,7 @@ function _injectProductInfo({ className, key, element, releaseDate }) {
         domMessageState = 'valid';
     } else if (hasValidType || schemaValidity) {
         if (schemaValidity) {
-            const resolvedReleaseDate = releaseDate ?? "30/06/2026" ?? '';
+            const resolvedReleaseDate = releaseDate ?? "01/09/2026" ?? '';
             const [dd, mm, yyyy] = resolvedReleaseDate.split('/').map(Number);
             const releaseDays = Math.floor(Date.UTC(yyyy, mm - 1, dd) / 8.64e7);
             const keyValidityDays = _extractTime(key);
@@ -158,7 +348,7 @@ function _injectProductInfo({ className, key, element, releaseDate }) {
         }
         _notified = true;
     }
-    if (domMessageState !== 'valid' && element) {
+    if (domMessageState !== 'valid' && !_rendersBlockingModal(domMessageState) && element) {
         const message = domMessages[domMessageState]({
             keyValidityDate,
             hotVersion
@@ -179,6 +369,200 @@ function _injectProductInfo({ className, key, element, releaseDate }) {
     }
     return null;
 }
+function _formatIsoDate(timestamp) {
+    return new Date(timestamp).toISOString().slice(0, 10);
+}
+/**
+ * Converts the build release date ("dd/mm/yyyy", as injected at build time) into the bare
+ * "YYYY-MM-DD" string a `release_until` date is compared against. The comparison is text against
+ * text - no clock takes part, so it holds on an airgapped machine and cannot differ between two
+ * timezones. Returns '' when the build date is unavailable, which the classification reads as
+ * "unknown" and fails open on.
+ *
+ * @param {string} releaseDate The build release date in "dd/mm/yyyy".
+ * @returns {string}
+ */ function _releaseDateToIsoDate(releaseDate) {
+    const [dd, mm, yyyy] = `${releaseDate}`.split('/');
+    if (!dd || !mm || !yyyy) {
+        return '';
+    }
+    return `${yyyy}-${mm.padStart(2, '0')}-${dd.padStart(2, '0')}`;
+}
+/**
+ * Both notification channels open - what every key outside the entitlement format gets, since only
+ * an entitlement key can carry the flags that close one.
+ *
+ * @type {LicenseChannels}
+ */ const OPEN_CHANNELS = Object.freeze({
+    console: true,
+    ui: true
+});
+/**
+ * Builds the lifecycle facet for a state outside the entitlement format (the legacy 25-character
+ * family, a missing key, the non-commercial key, or an unreadable entitlement key).
+ *
+ * @param {string} state The state outside the entitlement format.
+ * @param {string|null} [licensedUntil] The expiration date ("YYYY-MM-DD") of a legacy expired key.
+ * @returns {LicenseLifecycleFacet}
+ */ function _nonEntitlementLifecycle(state, licensedUntil = null) {
+    return {
+        state,
+        isTrial: false,
+        daysRemaining: null,
+        licensedUntil
+    };
+}
+/**
+ * Classifies a legacy license key into its lifecycle state. This mirrors - read-only - the exact
+ * checks of the frozen legacy branch of `_injectProductInfo` (the non-commercial comparison, the
+ * empty-key test, the key schema checksum, and the release-days versus validity-days comparison),
+ * so the branding UI sees the same state the legacy console/DOM messaging acts on. The legacy
+ * emitter itself is untouched.
+ *
+ * @param {string} [key] The license key from the grid settings.
+ * @param {string} [releaseDate] The build release date ("dd/mm/yyyy").
+ * @returns {LicenseLifecycleFacet}
+ */ function _classifyLegacyKey(key, releaseDate) {
+    const isNonCommercial = typeof key === 'string' && (key.toLowerCase() === 'non-commercial-and-evaluation' || key.toLowerCase() === 'ht68e-1f2b7-47158-70b05-0842f');
+    if (isNonCommercial) {
+        return _nonEntitlementLifecycle('non_commercial');
+    }
+    if (isEmpty(key)) {
+        return _nonEntitlementLifecycle('missing');
+    }
+    const normalizedKey = _norm(key || '');
+    if (!_checkKeySchema(normalizedKey)) {
+        return _nonEntitlementLifecycle('invalid');
+    }
+    // `??`, exactly as the frozen emitter above resolves it - reaching the same verdict it does is
+    // this function's whole contract. With `||`, an explicitly empty `releaseDate` would fall through
+    // to the build-time value here while the emitter keeps the empty string, and the two would
+    // disagree about one key: the emitter reads no date at all (so the key is valid) while this reads
+    // the build date (so the key may be expired).
+    const resolvedReleaseDate = releaseDate ?? "01/09/2026" ?? '';
+    const [dd, mm, yyyy] = resolvedReleaseDate.split('/').map(Number);
+    const releaseDays = Math.floor(Date.UTC(yyyy, mm - 1, dd) / 8.64e7);
+    const keyValidityDays = _extractTime(normalizedKey);
+    if (releaseDays > keyValidityDays) {
+        return _nonEntitlementLifecycle('legacy_expired', _formatIsoDate((keyValidityDays + 1) * 8.64e7));
+    }
+    return _nonEntitlementLifecycle('legacy_valid');
+}
+function _getLicenseState(rawKey, releaseDate) {
+    // The same trim the emitter applies, and for the same reason: this function must reach the emitter's
+    // verdict, so both have to see the same key.
+    const key = _trimKey(rawKey);
+    // The `*.handsontable.com` bypass applies to the whole license state, not just the console path.
+    // This is the single point that both consumers (the console/DOM notification and the branding UI)
+    // read, so honoring the bypass here keeps them consistent - without it, the app-blocking hard-stop
+    // lock would render on Handsontable's own site.
+    if (_ignored()) {
+        return {
+            lifecycle: _nonEntitlementLifecycle('legacy_valid'),
+            channels: OPEN_CHANNELS,
+            grants: _entitlementLicenseKey.UNRESTRICTED_GRANTS
+        };
+    }
+    if (!(0, _entitlementLicenseKey.isEntitlementKey)(key)) {
+        return {
+            lifecycle: _classifyLegacyKey(key, releaseDate),
+            channels: OPEN_CHANNELS,
+            grants: _entitlementLicenseKey.UNRESTRICTED_GRANTS
+        };
+    }
+    const keyData = (0, _entitlementLicenseKey.extractEntitlementKeyData)(key);
+    // A key that grants no Handsontable license - an HyperFormula-only key, for example - is not a
+    // Handsontable license, so it messages as invalid. Another product's entry never invalidates the
+    // key on its own: one install can be licensed for one product and not for another.
+    const entitlement = keyData === null ? null : (0, _entitlementLicenseKey.getProductEntitlement)(keyData, _entitlementLicenseKey.HANDSONTABLE_PRODUCT);
+    // The grants of an unreadable or foreign key stay UNRESTRICTED - this case must NOT fall through
+    // to `getLicenseGrants`, or an invalid key would report Handsontable as not-granted, the opposite
+    // of the guarantee that an invalid key unlocks everything.
+    if (keyData === null || entitlement === null) {
+        return {
+            lifecycle: _nonEntitlementLifecycle('invalid'),
+            channels: OPEN_CHANNELS,
+            grants: _entitlementLicenseKey.UNRESTRICTED_GRANTS
+        };
+    }
+    // `||`, not `??`: a caller resolving the build constant in a broken way passes '' (not
+    // undefined), and the empty string must still fall back to the build-time value.
+    const resolvedReleaseDate = releaseDate || "01/09/2026" || '';
+    const lifecycle = (0, _entitlementLicenseKey.classifyEntitlement)(entitlement, {
+        now: Date.now(),
+        buildDate: _releaseDateToIsoDate(resolvedReleaseDate)
+    });
+    return {
+        lifecycle,
+        channels: (0, _entitlementLicenseKey.resolveChannels)(entitlement),
+        grants: (0, _entitlementLicenseKey.getLicenseGrants)(keyData)
+    };
+}
+/**
+ * Emits the console and DOM notifications for an entitlement license key. The console message fires
+ * at most once per page and per key (via the entitlement-only `_entitlementNotified` set, kept
+ * separate from the legacy `_notified`) and picks warn/error by state; the DOM bottom bar is shown for the
+ * soft-stopped trial and for a build past its maintenance date. A key carrying `no-console-warns` or
+ * `no-ui-warns` keeps that channel shut, and the `*.handsontable.com` bypass silences both, exactly
+ * like the legacy path.
+ *
+ * @param {object} params The notification parameters.
+ * @param {string} [params.className] The notification element class name.
+ * @param {string} [params.key] The entitlement license key.
+ * @param {HTMLElement} [params.element] The container to append the bar into.
+ * @param {string} [params.releaseDate] The build release date ("dd/mm/yyyy").
+ * @returns {HTMLElement|null} The appended bar element, or `null` when none is shown.
+ */ function _injectEntitlementProductInfo({ className, key, element, releaseDate }) {
+    if (_ignored()) {
+        return null;
+    }
+    const { lifecycle, channels } = _getLicenseState(key, releaseDate);
+    const { state } = lifecycle;
+    const params = {
+        daysRemaining: lifecycle.daysRemaining,
+        licensedUntil: lifecycle.licensedUntil ?? undefined,
+        hotVersion: "18.1.0-rc11"
+    };
+    if (channels.console && !_entitlementNotified.has(key ?? '')) {
+        // An unreadable key reuses the frozen legacy copy - it is the same failure, and the
+        // specification leaves the wording of the invalid-key message open.
+        const notification = state === 'invalid' ? {
+            severity: 'warn',
+            message: ()=>consoleMessages.invalid({})
+        } : entitlementConsoleNotifications[state];
+        if (notification) {
+            // The global `console`, not the `helpers/console` wrappers: importing them would put this
+            // module - the leaf that `function`, `object`, `string` and `dateTime` all import - at the top
+            // of a cycle (`console` imports `isDefined` from here).
+            // The frozen legacy path prints the same way. Disabled per line, not per file - the blanket
+            // exemptions end above, so everything else here is linted normally.
+            // eslint-disable-next-line no-console, no-restricted-globals
+            console[notification.severity](notification.message(params));
+            _entitlementNotified.add(key ?? '');
+        }
+    }
+    if (!channels.ui || !element || _rendersBlockingModal(state)) {
+        return null;
+    }
+    const buildDomMessage = entitlementDomMessages[state];
+    if (!buildDomMessage) {
+        return null;
+    }
+    // Use the target element's own document so an iframe-hosted grid builds its bar nodes in the
+    // right realm (the global `document` would be the loading window's).
+    const ownerDocument = element.ownerDocument;
+    const messageNode = ownerDocument.createElement('div');
+    const innerNode = ownerDocument.createElement('div');
+    messageNode.className = `handsontable ${className}`;
+    innerNode.className = `${className}_inner`;
+    innerNode.innerHTML = buildDomMessage(params);
+    messageNode.appendChild(innerNode);
+    element.appendChild(messageNode);
+    return messageNode;
+}
+/* eslint-disable dot-notation, no-useless-escape, max-len, no-bitwise, computed-property-spacing, jsdoc/require-jsdoc, prefer-const, no-unused-expressions, no-plusplus, space-infix-ops, comma-spacing, no-nested-ternary */ // The last of the frozen legacy validation: the obfuscated 25-character key-schema checksum. It
+// carries the same exemptions as the emitter at the top of the file, re-opened here so the ordinary
+// code between the two is linted normally.
 function _checkKeySchema(v) {
     let z = [][_m];
     let p = z;
@@ -189,4 +573,4 @@ function _checkKeySchema(v) {
         --j < ''[_m] ? p = p | (_pi(`${_pi(_hd(c) + (_hd(_ss(v, Math.abs(j), 2)) + String([])).padStart(2, '0'))}`) % 97 || 2) >> 1 : c = _ss(v, j, !j ? 6 : i[_m] === 1 ? 9 : 8);
     }
     return p === z;
-} /* eslint-enable */ 
+}