kempo-inventory 0.5.7 → 0.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo-inventory",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "A basic inventory management system for kempo cms",
   "license": "MIT",
   "author": "Dustin Poissant <dustinpoissant@gmail.com>",

package/public/components/FieldsManager.js

@@ -22,7 +22,7 @@ import { getFields, createField, updateField, deleteField, getCategories } from
 */
 const TYPE_LABELS = {
   text: 'Text',
-  url: 'Web address (link)',
+  url: 'URL',
   longtext: 'Long text',
   number: 'Number',
   boolean: 'Yes / No',

package/public-items/[id]/index.page.html

@@ -45,6 +45,15 @@
 		}
 
 		/* The category is a built-in property of every item; '' means uncategorised. */
+		/* Only web addresses become links; anything else (a javascript: or data: address, say) shows as plain text. */
+		function isWebLink(value){
+			try {
+				const { protocol } = new URL(String(value).trim());
+				return protocol === 'http:' || protocol === 'https:';
+			} catch {
+				return false;
+			}
+		}
 		function categoryOf(item){ return (item.category ?? '').trim(); }
 		function categoryHref(name){ return name ? `/category?name=${encodeURIComponent(name)}` : '/category?uncategorised=1'; }
 		function tagChips(tags){ return tags?.length ? html`<div class="tag-list">${tags.map(tag => html`<a class="tag-chip" href="/search?tag=${encodeURIComponent(tag)}">${tag}</a>`)}</div>` : ''; }
@@ -112,8 +121,8 @@
 								? html`<span style="display: inline-block; width: 4rem; height: 4rem; vertical-align: middle; margin-right: var(--spacer_h); border: 1px solid var(--c_border); border-radius: var(--radius); background: ${item.fields[f.key]};"></span>${item.fields[f.key]}`
 								: f.type === 'item' && linked[item.fields[f.key]]
 								? html`<a href="/items/${item.fields[f.key]}">${displayValue(f, item.fields[f.key], context)}</a>`
-								: f.type === 'url'
-									? html`<a href=${item.fields[f.key]} rel="noopener">${item.fields[f.key]}</a>`
+								: f.type === 'url' && isWebLink(item.fields[f.key])
+									? html`<a href=${item.fields[f.key]} target="_blank" rel="noopener">${item.fields[f.key]}</a>`
 									: f.type === 'longtext'
 									? html`<span style="white-space: pre-wrap;">${item.fields[f.key]}</span>`
 									: displayValue(f, item.fields[f.key], context)}</dd>`)}

package/server/utils/fieldTypes.js

@@ -24,10 +24,15 @@ export const MAX_IMAGE_EDGE = 8000;
   else, such as text to a number, could orphan existing values, so it is refused: delete the field
   and make a new one instead.
 */
-export const CONVERSIONS = { select: ['text'], text: ['longtext'] };
+export const CONVERSIONS = { select: ['text'], text: ['longtext', 'url'] };
 
 export const canConvert = (from, to) => from === to || (CONVERSIONS[from] ?? []).includes(to);
 
+/* A javascript: link runs code when clicked. Browsers ignore spaces and control characters inside the scheme, so they are allowed for. */
+const SCRIPT_SCHEME = /^[\s\x00-\x1f\x7f]*j[\s\x00-\x1f\x7f]*a[\s\x00-\x1f\x7f]*v[\s\x00-\x1f\x7f]*a[\s\x00-\x1f\x7f]*s[\s\x00-\x1f\x7f]*c[\s\x00-\x1f\x7f]*r[\s\x00-\x1f\x7f]*i[\s\x00-\x1f\x7f]*p[\s\x00-\x1f\x7f]*t[\s\x00-\x1f\x7f]*:/i;
+export const hasScriptScheme = value => SCRIPT_SCHEME.test(String(value));
+export const stripScriptScheme = value => String(value).replace(SCRIPT_SCHEME, '');
+
 /*
   A `media` value is a list of ids, each saying where the file lives. A bare id is a kempo-media
   asset; "files:<id>" is a kempo-files file.

package/server/utils/fields.js

@@ -3,7 +3,7 @@ import { eq, and, asc, sql } from 'drizzle-orm';
 import crypto from 'crypto';
 import { kempoInventoryField, kempoInventoryItem, kempoInventoryCategory } from '../db/schema.js';
 import { categoryKey, tidyCategory, MAX_CATEGORY } from './categoryLogic.js';
-import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert } from './fieldTypes.js';
+import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert, coerceValue, hasScriptScheme, stripScriptScheme } from './fieldTypes.js';
 import { mediaAvailable } from './media.js';
 import { EVENTS, guard, notify } from './hooks.js';
 
@@ -11,6 +11,24 @@ const newId = () => crypto.randomBytes(8).toString('hex');
 
 const isUniqueViolation = error => (error?.code || error?.cause?.code) === '23505';
 
+/*
+  The values items hold for a key, rewritten as full web addresses where they are one. Anything else is left
+  as it is (it still shows as text, and is not made into a link).
+*/
+const addressesOf = async (key, label) => {
+  const rows = await db.select({ id: kempoInventoryItem.id, data: kempoInventoryItem.data }).from(kempoInventoryItem)
+    .where(sql`${kempoInventoryItem.data}->>${key} IS NOT NULL`);
+  const rewrites = [];
+  for(const row of rows){
+    const original = row.data[key];
+    if(original === '' || original === null) continue;
+    const cleaned = hasScriptScheme(original) ? stripScriptScheme(original) : original;
+    const [invalid, address] = coerceValue({ type: 'url', label }, cleaned);
+    const value = !invalid && address ? address : cleaned;
+    if(value !== original) rewrites.push({ id: row.id, data: { ...row.data, [key]: value } });
+  }
+  return rewrites;
+};
 /*
   Properties an extension's own field accepts on update, and what anyone else (the admin UI) may
   adjust on a field an extension owns. Key and ownership never change after creation, the scope
@@ -160,6 +178,9 @@ export const updateField = async (key, changes = {}, { owner = null, category =
   }
   if(!Object.keys(updates).length) return [{ code: 400, msg: 'No changes provided' }, null];
 
+  /* Text to a URL: values that are web addresses are kept as their full address; anything else stays text. */
+  const rewrites = targetType === 'url' && existing.type !== 'url' ? await addressesOf(key, existing.label) : [];
+
   const refused = await guard(EVENTS.fieldBeforeUpdate, { field: existing, changes: updates, actor: owner ?? '' });
   if(refused) return [refused, null];
 
@@ -172,6 +193,9 @@ export const updateField = async (key, changes = {}, { owner = null, category =
           .values({ id: newId(), key: targetScope, name: targetName, image: null, created: now, updated: now })
           .onConflictDoNothing();
       }
+      for(const rewrite of rewrites){
+        await tx.update(kempoInventoryItem).set({ data: rewrite.data }).where(eq(kempoInventoryItem.id, rewrite.id));
+      }
       const [updated] = await tx.update(kempoInventoryField).set(updates)
         .where(and(eq(kempoInventoryField.key, key), eq(kempoInventoryField.category, existing.category))).returning();
       return updated;