kempo-inventory 0.5.6 → 0.5.7

package/README.md

@@ -23,6 +23,7 @@ Users in the `kempo-inventory:admin` group add fields from **Inventory > Fields*
 | Type | Holds |
 |---|---|
 | `text` | Short text (up to 1,000 characters) |
+| `url` | A web address, shown as a link on the item page. Without a scheme `https://` is added; only `http` and `https` are accepted |
 | `longtext` | Longer text (up to 20,000 characters) |
 | `number` | Any number |
 | `boolean` | Yes / no |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo-inventory",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "A basic inventory management system for kempo cms",
   "license": "MIT",
   "author": "Dustin Poissant <dustinpoissant@gmail.com>",

package/public/components/FieldsManager.js

@@ -22,6 +22,7 @@ import { getFields, createField, updateField, deleteField, getCategories } from
 */
 const TYPE_LABELS = {
   text: 'Text',
+  url: 'Web address (link)',
   longtext: 'Long text',
   number: 'Number',
   boolean: 'Yes / No',

package/public/components/ItemFields.js

@@ -354,6 +354,9 @@ export const fieldTemplate = (field, value, { linked = {}, media = {}, ownId = n
     case 'longtext':
       control = html`<textarea id=${id} class="full" rows="3" .value=${value ?? ''}></textarea>`;
       break;
+    case 'url':
+      control = html`<input type="url" id=${id} class="full" placeholder="https://" .value=${value ?? ''}>`;
+      break;
     case 'number':
       control = html`<input type="number" step="any" id=${id} class="full" .value=${value ?? ''}>`;
       break;

package/public-items/[id]/index.page.html

@@ -112,7 +112,9 @@
 								? html`<span style="display: inline-block; width: 4rem; height: 4rem; vertical-align: middle; margin-right: var(--spacer_h); border: 1px solid var(--c_border); border-radius: var(--radius); background: ${item.fields[f.key]};"></span>${item.fields[f.key]}`
 								: f.type === 'item' && linked[item.fields[f.key]]
 								? html`<a href="/items/${item.fields[f.key]}">${displayValue(f, item.fields[f.key], context)}</a>`
-								: f.type === 'longtext'
+								: f.type === 'url'
+									? html`<a href=${item.fields[f.key]} rel="noopener">${item.fields[f.key]}</a>`
+									: f.type === 'longtext'
 									? html`<span style="white-space: pre-wrap;">${item.fields[f.key]}</span>`
 									: displayValue(f, item.fields[f.key], context)}</dd>`)}
 					</dl>` : ''}

package/server/utils/fieldTypes.js

@@ -6,7 +6,7 @@
 import { categoryKey } from './categoryLogic.js';
 import { parseRatio } from './ratio.js';
 
-export const FIELD_TYPES = ['text', 'longtext', 'number', 'boolean', 'date', 'color', 'rating', 'select', 'item', 'media'];
+export const FIELD_TYPES = ['text', 'url', 'longtext', 'number', 'boolean', 'date', 'color', 'rating', 'select', 'item', 'media'];
 
 /*
   Types that depend on another extension being installed. They are always valid in a definition,
@@ -47,6 +47,7 @@ export const KEY_PATTERN = /^[a-z][a-zA-Z0-9]{0,39}$/;
 
 const MAX_TEXT = 1000;
 const MAX_LONGTEXT = 20000;
+const MAX_URL = 2000;
 
 export const isEmpty = value => value === undefined || value === null || value === '';
 
@@ -136,6 +137,16 @@ export const coerceValue = (field, raw) => {
       if(!value) return [null, null];
       return value.length > MAX_LONGTEXT ? bad(`must be ${MAX_LONGTEXT} characters or fewer`) : [null, value];
     }
+    case 'url': {
+      /* Without a scheme https:// is added. Only http and https are kept, so a link can never run a script. */
+      const text = String(raw).trim();
+      if(!text) return [null, null];
+      const address = /^[a-z][a-z0-9+.-]*:/i.test(text) ? text : `https://${text}`;
+      if(address.length > MAX_URL) return bad(`must be ${MAX_URL} characters or fewer`);
+      let parsed;
+      try { parsed = new URL(address); } catch { return bad('must be a web address, such as https://example.com'); }
+      return ['http:', 'https:'].includes(parsed.protocol) ? [null, address] : bad('must be a web address, such as https://example.com');
+    }
     case 'number': {
       const value = typeof raw === 'number' ? raw : Number(String(raw).trim());
       return Number.isFinite(value) ? [null, value] : bad('must be a number');