nextjs-cms 0.10.0 → 0.10.2

package/dist/core/security/dom.d.ts

@@ -6,6 +6,10 @@ export declare function escapeHTML(value: string | undefined | null): string | u
 /**
  * Sanitize rich-text/HTML content using DOMPurify with a restrictive allow-list.
  * Always returns a string (empty string when value is undefined or null).
+ *
+ * Uses `isomorphic-dompurify` rather than `dompurify` directly: this runs during submission,
+ * which is server-side, and bare `dompurify` returns a factory (no `sanitize` method) when it
+ * cannot find a `document`. The isomorphic wrapper supplies a jsdom window on the server.
  */
 export declare function sanitizeRichText(value: string | undefined | null): Promise<string>;
 //# sourceMappingURL=dom.d.ts.map

package/dist/core/security/dom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../../src/core/security/dom.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAU/E;AA+DD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxF"}
+{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../../src/core/security/dom.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAU/E;AA+DD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxF"}

package/dist/core/security/dom.js

@@ -82,11 +82,15 @@ const RICH_TEXT_SANITIZE_CONFIG = {
 /**
  * Sanitize rich-text/HTML content using DOMPurify with a restrictive allow-list.
  * Always returns a string (empty string when value is undefined or null).
+ *
+ * Uses `isomorphic-dompurify` rather than `dompurify` directly: this runs during submission,
+ * which is server-side, and bare `dompurify` returns a factory (no `sanitize` method) when it
+ * cannot find a `document`. The isomorphic wrapper supplies a jsdom window on the server.
  */
 export async function sanitizeRichText(value) {
     if (value === undefined || value === null || value.trim().length === 0) {
         return '';
     }
-    const { default: DOMPurify } = await import('dompurify');
+    const { default: DOMPurify } = await import('isomorphic-dompurify');
     return DOMPurify.sanitize(value, RICH_TEXT_SANITIZE_CONFIG);
 }

package/dist/utils/index.d.ts

@@ -1,5 +1,5 @@
 import CpanelAPI from './CpanelApi.js';
-export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
+export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, maxFileSizeToBytes, base64ByteLength, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
 export { CpanelAPI };
 export { responseHeaders } from './constants.js';
 export { logWarn, logError, logInfo } from './console-log.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,gBAAgB,CAAA;AACtC,OAAO,EACH,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,YAAY,GACf,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,gBAAgB,CAAA;AACtC,OAAO,EACH,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,YAAY,GACf,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/utils/index.js

@@ -1,5 +1,5 @@
 import CpanelAPI from './CpanelApi.js';
-export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
+export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, maxFileSizeToBytes, base64ByteLength, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
 export { CpanelAPI };
 export { responseHeaders } from './constants.js';
 export { logWarn, logError, logInfo } from './console-log.js';

package/dist/utils/utils.d.ts

@@ -50,5 +50,18 @@ export declare function capitalizeWords(input: string, allWords?: boolean): stri
  * Function to display a file size in a human-readable format
  * @param sizeInBytes
  */
+/**
+ * Byte budget for a `{ size, unit }` file-size limit, so every enforcement site converts it the
+ * same way.
+ */
+export declare function maxFileSizeToBytes(limit: {
+    size: number;
+    unit: 'kb' | 'mb';
+}): number;
+/**
+ * Decoded byte length of a base64 payload, without allocating the buffer — lets an oversized
+ * image be rejected before anything is decoded.
+ */
+export declare function base64ByteLength(base64: string): number;
 export declare function humanReadableFileSize(sizeInBytes: number, decimals?: number): string;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,WAGtD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,WAG9C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,WAE1C,CAAA;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EACzB,MAAM,EACN,WAAW,EACX,WAAW,GACd,EAAE;IACC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,IAAI,CAmBP;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,gBAAgB,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,WAGhH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC5B,MAAM,IAAI,EACV,MAAM,MAAM,EACZ,gBAAgB,OAAO,EACvB,WAAW,GAAG,GAAG,GAAG,KACrB,MAkBF,CAAA;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAc,GAAG,MAAM,CAW/E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAoBvF"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,WAGtD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,WAG9C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,WAE1C,CAAA;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EACzB,MAAM,EACN,WAAW,EACX,WAAW,GACd,EAAE;IACC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,IAAI,CAmBP;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,gBAAgB,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,WAGhH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC5B,MAAM,IAAI,EACV,MAAM,MAAM,EACZ,gBAAgB,OAAO,EACvB,WAAW,GAAG,GAAG,GAAG,KACrB,MAkBF,CAAA;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAc,GAAG,MAAM,CAW/E;AAED;;;GAGG;AACH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAErF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAoBvF"}

package/dist/utils/utils.js

@@ -104,6 +104,21 @@ export function capitalizeWords(input, allWords = true) {
  * Function to display a file size in a human-readable format
  * @param sizeInBytes
  */
+/**
+ * Byte budget for a `{ size, unit }` file-size limit, so every enforcement site converts it the
+ * same way.
+ */
+export function maxFileSizeToBytes(limit) {
+    return limit.size * (limit.unit === 'kb' ? 1024 : 1024 * 1024);
+}
+/**
+ * Decoded byte length of a base64 payload, without allocating the buffer — lets an oversized
+ * image be rejected before anything is decoded.
+ */
+export function base64ByteLength(base64) {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return Math.floor((base64.length * 3) / 4) - padding;
+}
 export function humanReadableFileSize(sizeInBytes, decimals = 2) {
     const units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
     let index = 0;

package/dist/validators/richText.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"richText.d.ts","sourceRoot":"","sources":["../../src/validators/richText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AACxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,eAAO,MAAM,mBAAmB,GAAI,OAAO,yBAAyB,EAAE,iBAAe,sFAepF,CAAA"}
+{"version":3,"file":"richText.d.ts","sourceRoot":"","sources":["../../src/validators/richText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AACxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAKxE,eAAO,MAAM,mBAAmB,GAAI,OAAO,yBAAyB,EAAE,iBAAe,sFAiDpF,CAAA"}

package/dist/validators/richText.js

@@ -1,5 +1,7 @@
 import * as z from 'zod';
+import { DEFAULT_MAX_FILE_SIZE, INLINE_IMAGE_REGEX } from '../core/helpers/inline-image.js';
 import getString from '../translations/index.js';
+import { base64ByteLength, maxFileSizeToBytes } from '../utils/utils.js';
 export const richTextFieldSchema = (field, language = 'en') => {
     const requiredMessage = getString('requiredField', language);
     const minLength = field.minLength ?? 1;
@@ -12,5 +14,37 @@ export const richTextFieldSchema = (field, language = 'en') => {
     if (Number.isFinite(maxLength)) {
         base = base.max(maxLength, { message: getString('maxLength', language, { max: maxLength }) });
     }
-    return field.required ? base : z.union([z.literal(''), base], requiredMessage).optional();
+    /**
+     * Reject oversized inline images during validation, so the editor reports it while the admin is
+     * still looking at the content rather than after a failed save.
+     *
+     * This schema is environment-neutral: the admin form runs it in the browser, and a consumer may
+     * also run it server-side. Neither is the authority — `RichTextField.extractInlineImages` repeats
+     * the check on every submit, which is what a browser-side bypass would still hit.
+     */
+    const allowImageUploads = field.allowImageUploads;
+    const checked = allowImageUploads
+        ? base.superRefine((value, ctx) => {
+            const maxFileSize = allowImageUploads.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+            const maxBytes = maxFileSizeToBytes(maxFileSize);
+            for (const match of value.matchAll(INLINE_IMAGE_REGEX)) {
+                const payload = match[1]?.split(',')[1] ?? '';
+                if (base64ByteLength(payload) <= maxBytes)
+                    continue;
+                ctx.addIssue({
+                    code: 'too_big',
+                    maximum: maxBytes,
+                    inclusive: true,
+                    type: 'number',
+                    origin: 'number',
+                    message: getString('fileSizeExceeded', language, {
+                        size: maxFileSize.size,
+                        unit: maxFileSize.unit,
+                    }),
+                });
+                return; // one message is enough — every oversized image has the same fix
+            }
+        })
+        : base;
+    return field.required ? checked : z.union([z.literal(''), checked], requiredMessage).optional();
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nextjs-cms",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "type": "module",
@@ -185,7 +185,6 @@
     "chokidar": "3.6.0",
     "commander": "^14.0.2",
     "dayjs": "^1.11.19",
-    "dompurify": "^3.3.3",
     "dotenv": "^17.2.3",
     "drizzle-orm": "^0.45.1",
     "esbuild": "0.27.2",
@@ -195,6 +194,7 @@
     "glob": "^10.4.5",
     "gradient-string": "^3.0.0",
     "international-types": "^0.8.1",
+    "isomorphic-dompurify": "^3.19.0",
     "jiti": "^2.6.1",
     "jose": "^6.0.11",
     "jsonwebtoken": "^9.0.2",