miki-template 1.2.0 → 1.3.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (105) hide show
  1. package/.github/release-notes/v1.3.1.md +55 -0
  2. package/.github/release-notes/v1.3.3.md +77 -0
  3. package/.github/workflows/ci.yml +38 -54
  4. package/.github/workflows/release.yml +106 -0
  5. package/AGENT.md +71 -71
  6. package/API_REFERENCE.md +314 -314
  7. package/CHANGELOG.md +173 -97
  8. package/CODE_OF_CONDUCT.md +14 -14
  9. package/CONTRIBUTING.md +27 -27
  10. package/README.md +342 -304
  11. package/ROADMAP.md +40 -40
  12. package/assets/banner.png +0 -0
  13. package/benchmarks/report.json +16 -16
  14. package/benchmarks/run.js +49 -49
  15. package/benchmarks/stress.mjs +647 -0
  16. package/benchmarks/templates/large.dtpl +7 -7
  17. package/benchmarks/templates/medium.dtpl +3 -3
  18. package/benchmarks/templates/small.dtpl +7 -7
  19. package/context/component.md +109 -109
  20. package/context/prd.md +131 -131
  21. package/context/project-structure.md +33 -33
  22. package/dir/base.html +23 -0
  23. package/dir/cmpnt.html +11 -0
  24. package/dir/footer.html +3 -0
  25. package/dir/home.html +80 -0
  26. package/dir/index.html +80 -0
  27. package/dir/navbar.html +9 -0
  28. package/docs/README.md +18 -18
  29. package/docs/advanced_usage.md +71 -71
  30. package/docs/api.md +119 -102
  31. package/docs/filters.md +708 -540
  32. package/docs/installation.md +106 -106
  33. package/docs/overview.md +57 -57
  34. package/docs/partialdef.md +70 -41
  35. package/docs/security.md +27 -27
  36. package/docs/tags.md +673 -610
  37. package/docs/usage.md +646 -599
  38. package/eslint.config.mjs +42 -34
  39. package/ex.mjs +33 -0
  40. package/miki-template-extension/.github/workflows/ci.yml +116 -0
  41. package/miki-template-extension/.vscodeignore +7 -0
  42. package/miki-template-extension/CHANGELOG.md +99 -0
  43. package/miki-template-extension/LICENSE +21 -21
  44. package/miki-template-extension/README.md +273 -82
  45. package/miki-template-extension/extension.js +1013 -0
  46. package/miki-template-extension/icon.png +0 -0
  47. package/miki-template-extension/icon.svg +10 -10
  48. package/miki-template-extension/miki-template-1.7.1.vsix +0 -0
  49. package/miki-template-extension/package.json +280 -46
  50. package/miki-template-extension/snippets/miki-template.json +717 -177
  51. package/miki-template-extension/syntaxes/language-configuration.json +114 -26
  52. package/miki-template-extension/syntaxes/miki-template.tmLanguage.json +355 -146
  53. package/miki-template-extension/tests/grammar-tests.json +162 -0
  54. package/miki-template-extension/tests/run-grammar-tests.js +82 -0
  55. package/package.json +37 -31
  56. package/sample-app/package-lock.json +901 -0
  57. package/sample-app/package.json +9 -0
  58. package/sample-app/server.js +14 -0
  59. package/sample-app/views/index.html +1 -0
  60. package/scripts/build-vsix.js +129 -0
  61. package/scripts/build-vsix.ps1 +15 -0
  62. package/snippets/miki-template.json +177 -177
  63. package/src/asyncRender.js +20 -20
  64. package/src/cache.js +80 -41
  65. package/src/context.js +126 -122
  66. package/src/context_processors.js +48 -41
  67. package/src/esm.mjs +84 -72
  68. package/src/filters.js +975 -527
  69. package/src/i18n.js +171 -171
  70. package/src/index.js +974 -454
  71. package/src/lexer.js +114 -92
  72. package/src/libraries.js +371 -240
  73. package/src/parser.js +270 -250
  74. package/src/security.js +53 -51
  75. package/src/tags/control.js +719 -590
  76. package/src/tags/extra.js +154 -0
  77. package/src/tags/helpers.js +26 -26
  78. package/src/tags/i18n.js +256 -230
  79. package/src/tags/inheritance.js +335 -216
  80. package/src/tags/registry.js +18 -18
  81. package/src/tags/util.js +400 -322
  82. package/src/types.d.ts +107 -107
  83. package/syntaxes/language-configuration.json +26 -26
  84. package/syntaxes/miki-template.tmLanguage.json +146 -146
  85. package/tests/asyncRender.test.js +17 -17
  86. package/tests/base.html +6 -6
  87. package/tests/child.html +3 -3
  88. package/tests/context_processors.test.js +13 -13
  89. package/tests/esm.test.mjs +61 -26
  90. package/tests/filters.test.js +254 -99
  91. package/tests/include_security.test.js +9 -9
  92. package/tests/integration/README.md +32 -0
  93. package/tests/integration/features.test.cjs +1681 -0
  94. package/tests/integration/features.test.mjs +1697 -0
  95. package/tests/integration/templates/base.miki +6 -0
  96. package/tests/integration/templates/child.miki +6 -0
  97. package/tests/integration/templates/index.html +17 -0
  98. package/tests/lexer.test.js +45 -45
  99. package/tests/parser.test.js +57 -55
  100. package/tests/partial.html +1 -1
  101. package/tests/partialdef.test.js +79 -40
  102. package/tests/production_checks.js +57 -57
  103. package/tests/security.test.js +28 -28
  104. package/tests/tags.test.js +233 -203
  105. package/miki-template-1.2.0.vsix +0 -0
@@ -1,106 +1,106 @@
1
- # Installation
2
-
3
- ## npm
4
- ```bash
5
- npm install miki-template
6
- ```
7
-
8
- ## Prerequisites
9
- - **Node.js** >= 14 (ES6+ support)
10
- - **npm** (or **yarn**) for package management
11
-
12
- ## Optional dependencies
13
- - **express** – for server‑side rendering integration (recommended).
14
- - **eslint** – for linting your project (dev dependency).
15
-
16
- ## Module System Support
17
-
18
- `miki-template` supports both **CommonJS** (`require`) and **ESM** (`import`).
19
-
20
- ### CommonJS (CJS)
21
-
22
- ```js
23
- const { render, compile, __express, SafeString, markSafe } = require('miki-template');
24
- ```
25
-
26
- ### ES Modules (ESM)
27
-
28
- ```js
29
- // Named imports
30
- import { render, compile, __express, SafeString, markSafe } from 'miki-template';
31
-
32
- // Default import (all exports)
33
- import miki from 'miki-template';
34
- const result = miki.render('Hello {{ name }}', { name: 'World' });
35
- ```
36
-
37
- > **Note:** When using ESM in Node.js, either name your files `.mjs` or set `"type": "module"` in your `package.json`.
38
-
39
- ## Publishing to npm
40
-
41
- This project is configured for automatic npm publishing via GitHub Actions. When you push to `main`, the CI workflow runs tests and, if they pass, publishes the package to npm.
42
-
43
- ### Prerequisites for publishing
44
-
45
- 1. You must have an npm account and be a maintainer of the `miki-template` package on npm.
46
- 2. In your GitHub repository, go to **Settings → Secrets and variables → Actions**.
47
- 3. Add a new repository secret named `NPM_TOKEN` with your npm automation token.
48
- - Generate it at https://www.npmjs.com/settings/YOUR_USERNAME/tokens
49
- - Select **Automation** as the token type.
50
-
51
- The CI workflow will then automatically publish on every push to `main`.
52
-
53
- ### Manual publishing
54
-
55
- ```bash
56
- npm version patch # or minor/major
57
- npm publish --access public
58
- ```
59
-
60
- ---
61
-
62
- ## Quick Start
63
-
64
- ### 1. Add the engine to your project
65
-
66
- **CJS:**
67
- ```js
68
- const { render, compile } = require('miki-template');
69
- ```
70
-
71
- **ESM:**
72
- ```js
73
- import { render, compile } from 'miki-template';
74
- ```
75
-
76
- ### 2. (Express) Register the view engine
77
-
78
- **CJS:**
79
- ```js
80
- const express = require('express');
81
- const { __express: renderDtpl } = require('miki-template');
82
- const app = express();
83
- app.engine('html', renderDtpl);
84
- app.set('view engine', 'html');
85
- app.set('views', './views');
86
- ```
87
-
88
- **ESM:**
89
- ```js
90
- import express from 'express';
91
- import { __express as renderDtpl } from 'miki-template';
92
-
93
- const app = express();
94
- app.engine('html', renderDtpl);
95
- app.set('view engine', 'html');
96
- app.set('views', './views');
97
- ```
98
-
99
- ### 3. Run the test suite to verify
100
-
101
- ```bash
102
- npm test
103
- ```
104
-
105
- ---
106
-
1
+ # Installation
2
+
3
+ ## npm
4
+ ```bash
5
+ npm install miki-template
6
+ ```
7
+
8
+ ## Prerequisites
9
+ - **Node.js** >= 14 (ES6+ support)
10
+ - **npm** (or **yarn**) for package management
11
+
12
+ ## Optional dependencies
13
+ - **express** – for server‑side rendering integration (recommended).
14
+ - **eslint** – for linting your project (dev dependency).
15
+
16
+ ## Module System Support
17
+
18
+ `miki-template` supports both **CommonJS** (`require`) and **ESM** (`import`).
19
+
20
+ ### CommonJS (CJS)
21
+
22
+ ```js
23
+ const { render, compile, __express, SafeString, markSafe } = require('miki-template');
24
+ ```
25
+
26
+ ### ES Modules (ESM)
27
+
28
+ ```js
29
+ // Named imports
30
+ import { render, compile, __express, SafeString, markSafe } from 'miki-template';
31
+
32
+ // Default import (all exports)
33
+ import miki from 'miki-template';
34
+ const result = miki.render('Hello {{ name }}', { name: 'World' });
35
+ ```
36
+
37
+ > **Note:** When using ESM in Node.js, either name your files `.mjs` or set `"type": "module"` in your `package.json`.
38
+
39
+ ## Publishing to npm
40
+
41
+ This project is configured for automatic npm publishing via GitHub Actions. When you push to `main`, the CI workflow runs tests and, if they pass, publishes the package to npm.
42
+
43
+ ### Prerequisites for publishing
44
+
45
+ 1. You must have an npm account and be a maintainer of the `miki-template` package on npm.
46
+ 2. In your GitHub repository, go to **Settings → Secrets and variables → Actions**.
47
+ 3. Add a new repository secret named `NPM_TOKEN` with your npm automation token.
48
+ - Generate it at https://www.npmjs.com/settings/YOUR_USERNAME/tokens
49
+ - Select **Automation** as the token type.
50
+
51
+ The CI workflow will then automatically publish on every push to `main`.
52
+
53
+ ### Manual publishing
54
+
55
+ ```bash
56
+ npm version patch # or minor/major
57
+ npm publish --access public
58
+ ```
59
+
60
+ ---
61
+
62
+ ## Quick Start
63
+
64
+ ### 1. Add the engine to your project
65
+
66
+ **CJS:**
67
+ ```js
68
+ const { render, compile } = require('miki-template');
69
+ ```
70
+
71
+ **ESM:**
72
+ ```js
73
+ import { render, compile } from 'miki-template';
74
+ ```
75
+
76
+ ### 2. (Express) Register the view engine
77
+
78
+ **CJS:**
79
+ ```js
80
+ const express = require('express');
81
+ const { __express: renderDtpl } = require('miki-template');
82
+ const app = express();
83
+ app.engine('html', renderDtpl);
84
+ app.set('view engine', 'html');
85
+ app.set('views', './views');
86
+ ```
87
+
88
+ **ESM:**
89
+ ```js
90
+ import express from 'express';
91
+ import { __express as renderDtpl } from 'miki-template';
92
+
93
+ const app = express();
94
+ app.engine('html', renderDtpl);
95
+ app.set('view engine', 'html');
96
+ app.set('views', './views');
97
+ ```
98
+
99
+ ### 3. Run the test suite to verify
100
+
101
+ ```bash
102
+ npm test
103
+ ```
104
+
105
+ ---
106
+
package/docs/overview.md CHANGED
@@ -1,57 +1,57 @@
1
- # Overview
2
-
3
- Welcome to **miki-template** – a production‑ready, Django‑style template engine for Node.js and Express. This documentation mirrors the layout of popular open‑source libraries (e.g., Django, Jinja2, Mustache) and provides a clear, hierarchical guide for developers of all skill levels.
4
-
5
- - **Project structure** – quick glance at the repository layout.
6
- - **Feature list** – exhaustive rundown of supported tags, filters, security helpers, and the new `partialdef` system.
7
- - **Getting started** – installation, basic rendering, and Express integration.
8
- - **Advanced usage** – inheritance, block rendering, custom tags/filters, and performance tips.
9
-
10
- ---
11
-
12
- ## Repository layout
13
-
14
- ```
15
- 📦 miki-template/
16
- ├─ 📁 src/ # Core engine source files
17
- │ ├─ index.js # Entry point, compile/render APIs
18
- │ ├─ lexer.js # Tokenizer
19
- │ ├─ parser.js # AST builder
20
- │ ├─ context.js # Scope & partial registry
21
- │ └─ tags/ # Built‑in tag parsers (control, inheritance, util)
22
- │ ├─ control.js # if, for, with, cycle, partialdef, …
23
- │ ├─ inheritance.js # extends, block, super
24
- │ └─ util.js # comment, verbatim, etc.
25
- ├─ 📁 filters/ # Built‑in filter implementations
26
- ├─ 📁 tests/ # Jest‑style test suite
27
- ├─ 📁 docs/ # 📖 Documentation (this folder)
28
- ├─ README.md # Project landing page (high‑level intro)
29
- ├─ AGENT.md # Agent guardrails (internal)
30
- ├─ ROADMAP.md # Future roadmap & milestones
31
- └─ package.json # npm package definition
32
- ```
33
-
34
- Each module is deliberately **single‑responsibility** and fully typed via JSDoc comments, making it easy to extend.
35
-
36
- ---
37
-
38
- ## Where to start
39
-
40
- - **Installation** – see `docs/installation.md`.
41
- - **Basic rendering** – see `docs/usage.md`.
42
- - **Tag reference** – see `docs/tags.md`.
43
- - **Filter reference** – see `docs/filters.md`.
44
- - **Partial definitions** – see `docs/partialdef.md`.
45
- - **Security considerations** – see `docs/security.md`.
46
-
47
- For API‑level details (e.g., `compile().renderPartial`) check `docs/api.md`.
48
-
49
- ---
50
-
51
- ## Contributing
52
-
53
- We follow the standard open‑source workflow. Details are in `docs/contributing.md`.
54
-
55
- ---
56
-
57
- > **Tip**: All documentation files are located under `c:/Users/Coder Miki/Desktop/miki-template/docs/`.
1
+ # Overview
2
+
3
+ Welcome to **miki-template** – a production‑ready, Django‑style template engine for Node.js and Express. This documentation mirrors the layout of popular open‑source libraries (e.g., Django, Jinja2, Mustache) and provides a clear, hierarchical guide for developers of all skill levels.
4
+
5
+ - **Project structure** – quick glance at the repository layout.
6
+ - **Feature list** – exhaustive rundown of supported tags, filters, security helpers, and the new `partialdef` system.
7
+ - **Getting started** – installation, basic rendering, and Express integration.
8
+ - **Advanced usage** – inheritance, block rendering, custom tags/filters, and performance tips.
9
+
10
+ ---
11
+
12
+ ## Repository layout
13
+
14
+ ```
15
+ 📦 miki-template/
16
+ ├─ 📁 src/ # Core engine source files
17
+ │ ├─ index.js # Entry point, compile/render APIs
18
+ │ ├─ lexer.js # Tokenizer
19
+ │ ├─ parser.js # AST builder
20
+ │ ├─ context.js # Scope & partial registry
21
+ │ └─ tags/ # Built‑in tag parsers (control, inheritance, util)
22
+ │ ├─ control.js # if, for, with, cycle, partialdef, …
23
+ │ ├─ inheritance.js # extends, block, super
24
+ │ └─ util.js # comment, verbatim, etc.
25
+ ├─ 📁 filters/ # Built‑in filter implementations
26
+ ├─ 📁 tests/ # Jest‑style test suite
27
+ ├─ 📁 docs/ # 📖 Documentation (this folder)
28
+ ├─ README.md # Project landing page (high‑level intro)
29
+ ├─ AGENT.md # Agent guardrails (internal)
30
+ ├─ ROADMAP.md # Future roadmap & milestones
31
+ └─ package.json # npm package definition
32
+ ```
33
+
34
+ Each module is deliberately **single‑responsibility** and fully typed via JSDoc comments, making it easy to extend.
35
+
36
+ ---
37
+
38
+ ## Where to start
39
+
40
+ - **Installation** – see `docs/installation.md`.
41
+ - **Basic rendering** – see `docs/usage.md`.
42
+ - **Tag reference** – see `docs/tags.md`.
43
+ - **Filter reference** – see `docs/filters.md`.
44
+ - **Partial definitions** – see `docs/partialdef.md`.
45
+ - **Security considerations** – see `docs/security.md`.
46
+
47
+ For API‑level details (e.g., `compile().renderPartial`) check `docs/api.md`.
48
+
49
+ ---
50
+
51
+ ## Contributing
52
+
53
+ We follow the standard open‑source workflow. Details are in `docs/contributing.md`.
54
+
55
+ ---
56
+
57
+ > **Tip**: All documentation files are located under `c:/Users/Coder Miki/Desktop/miki-template/docs/`.
@@ -1,41 +1,70 @@
1
- # Partial Definition (`partialdef`)
2
-
3
- `partialdef` is the cornerstone feature that brings Django‑style **named template fragments** to Node.js. It allows you to define a reusable block once and render it multiple times, optionally **inline** for immediate output.
4
-
5
- ## Syntax
6
- ```html
7
- {% partialdef name [inline] %}
8
- ...template code...
9
- {% endpartialdef %}
10
- ```
11
- - `name` – identifier used with `{% partial name %}`.
12
- - Optional `inline` – if present, the block is rendered **where it is defined**; no separate `{% partial %}` call is required.
13
-
14
- ## Rendering a Partial
15
- ```html
16
- {% partial greeting %}
17
- ```
18
- The engine looks up the definition in the current rendering **Context** (`context.partialDefs`) and injects the rendered output.
19
-
20
- ## API Usage
21
- ```js
22
- const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
23
- const compiled = compile(tpl);
24
- const out = compiled.renderPartial('api', { data: 123 }); // "API 123"
25
- ```
26
-
27
- ## Features
28
- - **Full tag parity** – conditionals (`if`), loops (`for`), variable scoping (`with`) work inside a `partialdef`.
29
- - **Nested partials** – you can define a partial inside another; inner definitions are registered first and can be used by the outer.
30
- - **Scope isolation** – each rendering of a partial receives its own scope, mirroring Django’s behavior.
31
- - **Inline rendering** – render inline without an extra `{% partial %}` tag (`{% partialdef foo inline %}…{% endpartialdef %}`).
32
- - **Performance** – partials are compiled once per template; subsequent renders reuse the compiled AST.
33
-
34
- ## Common Pitfalls
35
- | Issue | Symptom | Fix |
36
- |-------|---------|-----|
37
- | Missing partial name | `{% partial %}` renders nothing | Ensure the name matches a defined `partialdef`. |
38
- | Variable not found | Appears empty | Variables are resolved in the current context; use `{% with %}` inside the partial if you need a local alias. |
39
- | Inline vs non‑inline confusion | Duplicate output | Use `inline` only when you want immediate rendering. |
40
-
41
- > Implementation lives in `src/tags/control.js` (class `PartialDefNode` and `PartialNode`).
1
+ # Partial Definition (`partialdef`)
2
+
3
+ `partialdef` is the cornerstone feature that brings Django‑style **named template fragments** to Node.js. It allows you to define a reusable block once and render it multiple times, optionally **inline** for immediate output. Combined with the `setupExpress` helper, partials can be served as standalone HTTP responses for HTMX-style UIs.
4
+
5
+ ## Syntax
6
+ ```html
7
+ {% partialdef name [inline] %}
8
+ ...template code...
9
+ {% endpartialdef %}
10
+ ```
11
+ - `name` – identifier used with `{% partial name %}`.
12
+ - Optional `inline` – if present, the block is rendered **where it is defined**; no separate `{% partial %}` call is required.
13
+
14
+ ## Rendering a Partial
15
+ ```html
16
+ {% partial greeting %}
17
+ ```
18
+ The engine looks up the definition in the current rendering **Context** (`context.partialDefs`) and injects the rendered output.
19
+
20
+ ## Including a Partial From Another File
21
+ Use the `file#partial` syntax to include just a single named partial:
22
+ ```html
23
+ {% include "home.html#card" with title="Hi" %}
24
+ ```
25
+
26
+ ## API Usage
27
+ ```js
28
+ const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
29
+ const compiled = compile(tpl);
30
+ const out = compiled.renderPartial('api', { data: 123 }); // "API 123"
31
+ ```
32
+
33
+ `renderPartialFromSource` and `renderPartialFromFile` are also exported at the top level:
34
+ ```js
35
+ const miki = require('miki-template');
36
+ miki.renderPartialFromFile('views/home.html', 'card', { user: req.user });
37
+ miki.renderPartialFromSource(src, 'card', { user: req.user }, { views: 'views' });
38
+ ```
39
+
40
+ ## Serving a Partial Over HTTP (HTMX)
41
+ With `miki.setupExpress(app, { extension: 'html', views: './views' })`, the same `res.render(...)` call you use for full pages also serves a single partial by appending `#partialName` to the view name:
42
+
43
+ ```javascript
44
+ app.get('/partials/:name', (req, res) =>
45
+ res.render(`home#${req.params.name}`, { user: req.user })
46
+ );
47
+ ```
48
+
49
+ The same effect can be obtained via the lighter `expressPartialRenderer()` middleware:
50
+ ```javascript
51
+ app.use(miki.expressPartialRenderer());
52
+ app.get('/card', (req, res) => res.renderPartial('home#card', { user: req.user }));
53
+ ```
54
+
55
+ ## Features
56
+ - **Full tag parity** – conditionals (`if`), loops (`for`), variable scoping (`with`) work inside a `partialdef`.
57
+ - **Nested partials** – you can define a partial inside another; inner definitions are registered first and can be used by the outer.
58
+ - **Scope isolation** – each rendering of a partial receives its own scope, mirroring Django’s behavior.
59
+ - **Inline rendering** – render inline without an extra `{% partial %}` tag (`{% partialdef foo inline %}…{% endpartialdef %}`).
60
+ - **`with` arguments** – bind extra context values when rendering: `{% partial card with title="Hello" description="World" %}`.
61
+ - **Performance** – partials are compiled once per template; subsequent renders reuse the compiled AST.
62
+
63
+ ## Common Pitfalls
64
+ | Issue | Symptom | Fix |
65
+ |-------|---------|-----|
66
+ | Missing partial name | `{% partial %}` renders nothing | Ensure the name matches a defined `partialdef`. |
67
+ | Variable not found | Appears empty | Variables are resolved in the current context; use `{% with %}` inside the partial if you need a local alias. |
68
+ | Inline vs non‑inline confusion | Duplicate output | Use `inline` only when you want immediate rendering. |
69
+
70
+ > Implementation lives in `src/tags/control.js` (class `PartialDefNode` and `PartialNode`).
package/docs/security.md CHANGED
@@ -1,27 +1,27 @@
1
- # Security
2
-
3
- `miki-template` is built with **secure defaults**. All variables are **auto‑escaped** unless explicitly marked safe.
4
-
5
- ## Auto‑escaping
6
- - Every string output goes through `escapeHtml` before being concatenated.
7
- - Use the `|safe` filter or `markSafe(value)` to bypass escaping when you trust the data.
8
-
9
- ## CSRF Protection
10
- - The `{% csrf_token %}` tag renders a hidden `<input>` containing the `csrf_token` value from the rendering context.
11
- - Example:
12
- ```html
13
- <form method="post">{% csrf_token %} ... </form>
14
- ```
15
- - It is a thin wrapper; you must generate and store `csrf_token` in your Express middleware.
16
-
17
- ## CSP Nonce
18
- - `{% csp_nonce_attr %}` injects `nonce="{{ csp_nonce }}"` when `csp_nonce` is present in the context.
19
- - Useful for inline scripts when you have a CSP policy with `script-src 'nonce-...';`.
20
-
21
- ## SafeString Wrapper
22
- - Filters returning `SafeString` bypass auto‑escaping. The wrapper is applied automatically by the `safe` filter.
23
-
24
- ## No `eval`
25
- - Template expressions are parsed into an AST and evaluated using a sandboxed evaluator that **never calls `eval` or `new Function`**.
26
-
27
- > Security‑related code lives in `src/security.js` and the tag implementations in `src/tags/control.js`.
1
+ # Security
2
+
3
+ `miki-template` is built with **secure defaults**. All variables are **auto‑escaped** unless explicitly marked safe.
4
+
5
+ ## Auto‑escaping
6
+ - Every string output goes through `escapeHtml` before being concatenated.
7
+ - Use the `|safe` filter or `markSafe(value)` to bypass escaping when you trust the data.
8
+
9
+ ## CSRF Protection
10
+ - The `{% csrf_token %}` tag renders a hidden `<input>` containing the `csrf_token` value from the rendering context.
11
+ - Example:
12
+ ```html
13
+ <form method="post">{% csrf_token %} ... </form>
14
+ ```
15
+ - It is a thin wrapper; you must generate and store `csrf_token` in your Express middleware.
16
+
17
+ ## CSP Nonce
18
+ - `{% csp_nonce_attr %}` injects `nonce="{{ csp_nonce }}"` when `csp_nonce` is present in the context.
19
+ - Useful for inline scripts when you have a CSP policy with `script-src 'nonce-...';`.
20
+
21
+ ## SafeString Wrapper
22
+ - Filters returning `SafeString` bypass auto‑escaping. The wrapper is applied automatically by the `safe` filter.
23
+
24
+ ## No `eval`
25
+ - Template expressions are parsed into an AST and evaluated using a sandboxed evaluator that **never calls `eval` or `new Function`**.
26
+
27
+ > Security‑related code lives in `src/security.js` and the tag implementations in `src/tags/control.js`.