nextjs-cms 0.9.42 → 0.10.1

package/dist/utils/index.d.ts

@@ -1,5 +1,5 @@
 import CpanelAPI from './CpanelApi.js';
-export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
+export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, maxFileSizeToBytes, base64ByteLength, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
 export { CpanelAPI };
 export { responseHeaders } from './constants.js';
 export { logWarn, logError, logInfo } from './console-log.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,gBAAgB,CAAA;AACtC,OAAO,EACH,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,YAAY,GACf,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,gBAAgB,CAAA;AACtC,OAAO,EACH,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,YAAY,GACf,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/utils/index.js

@@ -1,5 +1,5 @@
 import CpanelAPI from './CpanelApi.js';
-export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
+export { sanitizeFileName, sanitizeFolderOrFileName, humanReadableFileSize, maxFileSizeToBytes, base64ByteLength, capitalizeWords, base64ToBlob, displayDateFromString, formatNumber, } from './utils.js';
 export { CpanelAPI };
 export { responseHeaders } from './constants.js';
 export { logWarn, logError, logInfo } from './console-log.js';

package/dist/utils/utils.d.ts

@@ -50,5 +50,18 @@ export declare function capitalizeWords(input: string, allWords?: boolean): stri
  * Function to display a file size in a human-readable format
  * @param sizeInBytes
  */
+/**
+ * Byte budget for a `{ size, unit }` file-size limit, so every enforcement site converts it the
+ * same way.
+ */
+export declare function maxFileSizeToBytes(limit: {
+    size: number;
+    unit: 'kb' | 'mb';
+}): number;
+/**
+ * Decoded byte length of a base64 payload, without allocating the buffer — lets an oversized
+ * image be rejected before anything is decoded.
+ */
+export declare function base64ByteLength(base64: string): number;
 export declare function humanReadableFileSize(sizeInBytes: number, decimals?: number): string;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,WAGtD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,WAG9C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,WAE1C,CAAA;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EACzB,MAAM,EACN,WAAW,EACX,WAAW,GACd,EAAE;IACC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,IAAI,CAmBP;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,gBAAgB,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,WAGhH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC5B,MAAM,IAAI,EACV,MAAM,MAAM,EACZ,gBAAgB,OAAO,EACvB,WAAW,GAAG,GAAG,GAAG,KACrB,MAkBF,CAAA;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAc,GAAG,MAAM,CAW/E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAoBvF"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,WAGtD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,WAG9C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,WAE1C,CAAA;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EACzB,MAAM,EACN,WAAW,EACX,WAAW,GACd,EAAE;IACC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,IAAI,CAmBP;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,gBAAgB,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,WAGhH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC5B,MAAM,IAAI,EACV,MAAM,MAAM,EACZ,gBAAgB,OAAO,EACvB,WAAW,GAAG,GAAG,GAAG,KACrB,MAkBF,CAAA;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAc,GAAG,MAAM,CAW/E;AAED;;;GAGG;AACH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAErF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAoBvF"}

package/dist/utils/utils.js

@@ -104,6 +104,21 @@ export function capitalizeWords(input, allWords = true) {
  * Function to display a file size in a human-readable format
  * @param sizeInBytes
  */
+/**
+ * Byte budget for a `{ size, unit }` file-size limit, so every enforcement site converts it the
+ * same way.
+ */
+export function maxFileSizeToBytes(limit) {
+    return limit.size * (limit.unit === 'kb' ? 1024 : 1024 * 1024);
+}
+/**
+ * Decoded byte length of a base64 payload, without allocating the buffer — lets an oversized
+ * image be rejected before anything is decoded.
+ */
+export function base64ByteLength(base64) {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return Math.floor((base64.length * 3) / 4) - padding;
+}
 export function humanReadableFileSize(sizeInBytes, decimals = 2) {
     const units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
     let index = 0;

package/dist/validators/richText.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"richText.d.ts","sourceRoot":"","sources":["../../src/validators/richText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AACxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,eAAO,MAAM,mBAAmB,GAAI,OAAO,yBAAyB,EAAE,iBAAe,sFAepF,CAAA"}
+{"version":3,"file":"richText.d.ts","sourceRoot":"","sources":["../../src/validators/richText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AACxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAKxE,eAAO,MAAM,mBAAmB,GAAI,OAAO,yBAAyB,EAAE,iBAAe,sFAiDpF,CAAA"}

package/dist/validators/richText.js

@@ -1,5 +1,7 @@
 import * as z from 'zod';
+import { DEFAULT_MAX_FILE_SIZE, INLINE_IMAGE_REGEX } from '../core/helpers/inline-image.js';
 import getString from '../translations/index.js';
+import { base64ByteLength, maxFileSizeToBytes } from '../utils/utils.js';
 export const richTextFieldSchema = (field, language = 'en') => {
     const requiredMessage = getString('requiredField', language);
     const minLength = field.minLength ?? 1;
@@ -12,5 +14,37 @@ export const richTextFieldSchema = (field, language = 'en') => {
     if (Number.isFinite(maxLength)) {
         base = base.max(maxLength, { message: getString('maxLength', language, { max: maxLength }) });
     }
-    return field.required ? base : z.union([z.literal(''), base], requiredMessage).optional();
+    /**
+     * Reject oversized inline images during validation, so the editor reports it while the admin is
+     * still looking at the content rather than after a failed save.
+     *
+     * This schema is environment-neutral: the admin form runs it in the browser, and a consumer may
+     * also run it server-side. Neither is the authority — `RichTextField.extractInlineImages` repeats
+     * the check on every submit, which is what a browser-side bypass would still hit.
+     */
+    const allowImageUploads = field.allowImageUploads;
+    const checked = allowImageUploads
+        ? base.superRefine((value, ctx) => {
+            const maxFileSize = allowImageUploads.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+            const maxBytes = maxFileSizeToBytes(maxFileSize);
+            for (const match of value.matchAll(INLINE_IMAGE_REGEX)) {
+                const payload = match[1]?.split(',')[1] ?? '';
+                if (base64ByteLength(payload) <= maxBytes)
+                    continue;
+                ctx.addIssue({
+                    code: 'too_big',
+                    maximum: maxBytes,
+                    inclusive: true,
+                    type: 'number',
+                    origin: 'number',
+                    message: getString('fileSizeExceeded', language, {
+                        size: maxFileSize.size,
+                        unit: maxFileSize.unit,
+                    }),
+                });
+                return; // one message is enough — every oversized image has the same fix
+            }
+        })
+        : base;
+    return field.required ? checked : z.union([z.literal(''), checked], requiredMessage).optional();
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nextjs-cms",
-  "version": "0.9.42",
+  "version": "0.10.1",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "type": "module",
@@ -226,9 +226,9 @@
     "prettier": "^3.3.3",
     "tsx": "^4.20.6",
     "typescript": "^5.9.2",
-    "@lzcms/eslint-config": "0.3.0",
+    "@lzcms/tsconfig": "0.1.0",
     "@lzcms/prettier-config": "0.1.0",
-    "@lzcms/tsconfig": "0.1.0"
+    "@lzcms/eslint-config": "0.3.0"
   },
   "license": "MIT",
   "keywords": [