kempo-inventory 0.5.6 → 0.5.8

package/README.md

@@ -23,6 +23,7 @@ Users in the `kempo-inventory:admin` group add fields from **Inventory > Fields*
 | Type | Holds |
 |---|---|
 | `text` | Short text (up to 1,000 characters) |
+| `url` | A web address, shown as a link on the item page. Without a scheme `https://` is added; only `http` and `https` are accepted |
 | `longtext` | Longer text (up to 20,000 characters) |
 | `number` | Any number |
 | `boolean` | Yes / no |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo-inventory",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "A basic inventory management system for kempo cms",
   "license": "MIT",
   "author": "Dustin Poissant <dustinpoissant@gmail.com>",

package/public/components/FieldsManager.js

@@ -22,6 +22,7 @@ import { getFields, createField, updateField, deleteField, getCategories } from
 */
 const TYPE_LABELS = {
   text: 'Text',
+  url: 'URL',
   longtext: 'Long text',
   number: 'Number',
   boolean: 'Yes / No',

package/public/components/ItemFields.js

@@ -354,6 +354,9 @@ export const fieldTemplate = (field, value, { linked = {}, media = {}, ownId = n
     case 'longtext':
       control = html`<textarea id=${id} class="full" rows="3" .value=${value ?? ''}></textarea>`;
       break;
+    case 'url':
+      control = html`<input type="url" id=${id} class="full" placeholder="https://" .value=${value ?? ''}>`;
+      break;
     case 'number':
       control = html`<input type="number" step="any" id=${id} class="full" .value=${value ?? ''}>`;
       break;

package/public-items/[id]/index.page.html

@@ -112,7 +112,9 @@
 								? html`<span style="display: inline-block; width: 4rem; height: 4rem; vertical-align: middle; margin-right: var(--spacer_h); border: 1px solid var(--c_border); border-radius: var(--radius); background: ${item.fields[f.key]};"></span>${item.fields[f.key]}`
 								: f.type === 'item' && linked[item.fields[f.key]]
 								? html`<a href="/items/${item.fields[f.key]}">${displayValue(f, item.fields[f.key], context)}</a>`
-								: f.type === 'longtext'
+								: f.type === 'url'
+									? html`<a href=${item.fields[f.key]} target="_blank" rel="noopener">${item.fields[f.key]}</a>`
+									: f.type === 'longtext'
 									? html`<span style="white-space: pre-wrap;">${item.fields[f.key]}</span>`
 									: displayValue(f, item.fields[f.key], context)}</dd>`)}
 					</dl>` : ''}

package/server/utils/fieldTypes.js

@@ -6,7 +6,7 @@
 import { categoryKey } from './categoryLogic.js';
 import { parseRatio } from './ratio.js';
 
-export const FIELD_TYPES = ['text', 'longtext', 'number', 'boolean', 'date', 'color', 'rating', 'select', 'item', 'media'];
+export const FIELD_TYPES = ['text', 'url', 'longtext', 'number', 'boolean', 'date', 'color', 'rating', 'select', 'item', 'media'];
 
 /*
   Types that depend on another extension being installed. They are always valid in a definition,
@@ -24,7 +24,7 @@ export const MAX_IMAGE_EDGE = 8000;
   else, such as text to a number, could orphan existing values, so it is refused: delete the field
   and make a new one instead.
 */
-export const CONVERSIONS = { select: ['text'], text: ['longtext'] };
+export const CONVERSIONS = { select: ['text'], text: ['longtext', 'url'] };
 
 export const canConvert = (from, to) => from === to || (CONVERSIONS[from] ?? []).includes(to);
 
@@ -47,6 +47,7 @@ export const KEY_PATTERN = /^[a-z][a-zA-Z0-9]{0,39}$/;
 
 const MAX_TEXT = 1000;
 const MAX_LONGTEXT = 20000;
+const MAX_URL = 2000;
 
 export const isEmpty = value => value === undefined || value === null || value === '';
 
@@ -136,6 +137,16 @@ export const coerceValue = (field, raw) => {
       if(!value) return [null, null];
       return value.length > MAX_LONGTEXT ? bad(`must be ${MAX_LONGTEXT} characters or fewer`) : [null, value];
     }
+    case 'url': {
+      /* Without a scheme https:// is added. Only http and https are kept, so a link can never run a script. */
+      const text = String(raw).trim();
+      if(!text) return [null, null];
+      const address = /^[a-z][a-z0-9+.-]*:/i.test(text) ? text : `https://${text}`;
+      if(address.length > MAX_URL) return bad(`must be ${MAX_URL} characters or fewer`);
+      let parsed;
+      try { parsed = new URL(address); } catch { return bad('must be a web address, such as https://example.com'); }
+      return ['http:', 'https:'].includes(parsed.protocol) ? [null, address] : bad('must be a web address, such as https://example.com');
+    }
     case 'number': {
       const value = typeof raw === 'number' ? raw : Number(String(raw).trim());
       return Number.isFinite(value) ? [null, value] : bad('must be a number');

package/server/utils/fields.js

@@ -3,7 +3,7 @@ import { eq, and, asc, sql } from 'drizzle-orm';
 import crypto from 'crypto';
 import { kempoInventoryField, kempoInventoryItem, kempoInventoryCategory } from '../db/schema.js';
 import { categoryKey, tidyCategory, MAX_CATEGORY } from './categoryLogic.js';
-import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert } from './fieldTypes.js';
+import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert, coerceValue } from './fieldTypes.js';
 import { mediaAvailable } from './media.js';
 import { EVENTS, guard, notify } from './hooks.js';
 
@@ -11,6 +11,22 @@ const newId = () => crypto.randomBytes(8).toString('hex');
 
 const isUniqueViolation = error => (error?.code || error?.cause?.code) === '23505';
 
+/*
+  The values items hold for a key, rewritten as full web addresses where they are one. Anything else is left
+  as it is (it still shows as text, and is not made into a link).
+*/
+const addressesOf = async (key, label) => {
+  const rows = await db.select({ id: kempoInventoryItem.id, data: kempoInventoryItem.data }).from(kempoInventoryItem)
+    .where(sql`${kempoInventoryItem.data}->>${key} IS NOT NULL`);
+  const rewrites = [];
+  for(const row of rows){
+    const value = row.data[key];
+    if(value === '' || value === null) continue;
+    const [invalid, address] = coerceValue({ type: 'url', label }, value);
+    if(!invalid && address && address !== value) rewrites.push({ id: row.id, data: { ...row.data, [key]: address } });
+  }
+  return rewrites;
+};
 /*
   Properties an extension's own field accepts on update, and what anyone else (the admin UI) may
   adjust on a field an extension owns. Key and ownership never change after creation, the scope
@@ -160,6 +176,9 @@ export const updateField = async (key, changes = {}, { owner = null, category =
   }
   if(!Object.keys(updates).length) return [{ code: 400, msg: 'No changes provided' }, null];
 
+  /* Text to a URL: values that are web addresses are kept as their full address; anything else stays text. */
+  const rewrites = targetType === 'url' && existing.type !== 'url' ? await addressesOf(key, existing.label) : [];
+
   const refused = await guard(EVENTS.fieldBeforeUpdate, { field: existing, changes: updates, actor: owner ?? '' });
   if(refused) return [refused, null];
 
@@ -172,6 +191,9 @@ export const updateField = async (key, changes = {}, { owner = null, category =
           .values({ id: newId(), key: targetScope, name: targetName, image: null, created: now, updated: now })
           .onConflictDoNothing();
       }
+      for(const rewrite of rewrites){
+        await tx.update(kempoInventoryItem).set({ data: rewrite.data }).where(eq(kempoInventoryItem.id, rewrite.id));
+      }
       const [updated] = await tx.update(kempoInventoryField).set(updates)
         .where(and(eq(kempoInventoryField.key, key), eq(kempoInventoryField.category, existing.category))).returning();
       return updated;