rapidoc 11.0.0 → 12.0.0

package/src/utils/request-utils.js

@@ -0,0 +1,203 @@
+/**
+ * Serializes a header parameter value according to OpenAPI 3 rules.
+ * Objects can be serialized exploded (key=value,key2=value2) or unexploded (key,value,key2,value2).
+ *
+ * @param {any} rawValue - Raw header parameter value
+ * @param {object} [options]
+ * @param {boolean} [options.explode=false] - Whether to explode object properties with '='
+ * @param {boolean} [options.isObject=false] - Whether value is an object
+ * @returns {string} Serialized header string
+ */
+export function serializeHeaderValue(rawValue, options = {}) {
+  const { explode = false, isObject = false } = options;
+
+  if (rawValue === undefined || rawValue === null || rawValue === "") {
+    return "";
+  }
+
+  if (isObject || (typeof rawValue === "object" && !Array.isArray(rawValue))) {
+    let obj = rawValue;
+    if (typeof rawValue === "string") {
+      try {
+        obj = JSON.parse(rawValue.replace(/\n/g, "").trim());
+      } catch {
+        return "";
+      }
+    }
+
+    if (!obj || typeof obj !== "object") {
+      return "";
+    }
+
+    const separator = explode ? "=" : ",";
+    return Object.keys(obj)
+      .map((key) => {
+        const val = obj[key];
+        const valStr = typeof val === "object" ? JSON.stringify(val) : String(val);
+        return `${key}${separator}${valStr}`;
+      })
+      .join(",");
+  }
+
+  if (Array.isArray(rawValue)) {
+    const filtered = rawValue.filter((v) => v !== "" && v !== undefined && v !== null);
+    return filtered.join(",");
+  }
+
+  return String(rawValue);
+}
+
+/**
+ * Constructs a Headers instance for an API request from structured inputs.
+ *
+ * @param {object} options
+ * @param {string} [options.accept] - Accept header
+ * @param {Array<object>} [options.apiKeys] - Applied API keys
+ * @param {Array<{ name: string, value: any, explode?: boolean, isObject?: boolean }>} [options.headerParams]
+ * @param {string} [options.contentType] - Content-Type to apply (omitted for multipart/form-data)
+ * @returns {Headers}
+ */
+export function constructFetchHeaders({
+  accept = "",
+  apiKeys = [],
+  headerParams = [],
+  contentType = "",
+} = {}) {
+  const reqHeaders = new Headers();
+
+  if (accept) {
+    reqHeaders.append("Accept", accept);
+  }
+
+  if (Array.isArray(apiKeys)) {
+    apiKeys
+      .filter((k) => k && k.in === "header" && k.finalKeyValue)
+      .forEach((k) => {
+        reqHeaders.append(k.name, k.finalKeyValue);
+      });
+  }
+
+  if (Array.isArray(headerParams)) {
+    headerParams.forEach((param) => {
+      if (
+        param &&
+        param.name &&
+        param.value !== undefined &&
+        param.value !== null &&
+        param.value !== ""
+      ) {
+        const headerValue = serializeHeaderValue(param.value, {
+          explode: param.explode === true || param.explode === "true",
+          isObject: param.isObject === true,
+        });
+        if (headerValue) {
+          reqHeaders.append(param.name, headerValue);
+        }
+      }
+    });
+  }
+
+  if (contentType && !contentType.includes("form-data")) {
+    reqHeaders.append("Content-Type", contentType);
+  }
+
+  return reqHeaders;
+}
+
+/**
+ * Builds a URLSearchParams body from field entries or a dynamic JSON template.
+ *
+ * @param {Array<{ name: string, value: any, isArray?: boolean }>} fields
+ * @param {string} [dynamicJson] - Raw JSON string for dynamic forms
+ * @returns {URLSearchParams}
+ */
+export function buildUrlEncodedBody(fields = [], dynamicJson = "") {
+  const params = new URLSearchParams();
+
+  if (dynamicJson) {
+    try {
+      const obj = JSON.parse(dynamicJson);
+      if (obj && typeof obj === "object") {
+        for (const prop of Object.keys(obj)) {
+          params.append(
+            prop,
+            typeof obj[prop] === "object" ? JSON.stringify(obj[prop]) : String(obj[prop]),
+          );
+        }
+        return params;
+      }
+    } catch {
+      // Fall through to fields
+    }
+  }
+
+  if (Array.isArray(fields)) {
+    fields.forEach((field) => {
+      if (
+        !field ||
+        !field.name ||
+        field.value === undefined ||
+        field.value === null ||
+        field.value === ""
+      ) {
+        return;
+      }
+      if (field.isArray) {
+        const arr = Array.isArray(field.value) ? field.value : [field.value];
+        const filtered = arr.filter((v) => v !== "" && v !== undefined && v !== null);
+        if (filtered.length > 0) {
+          params.append(field.name, filtered.join(","));
+        }
+      } else {
+        params.append(field.name, String(field.value));
+      }
+    });
+  }
+
+  return params;
+}
+
+/**
+ * Builds a FormData instance from structured field entries.
+ *
+ * @param {Array<{ name: string, value: any, file?: File, isArray?: boolean }>} fields
+ * @returns {FormData}
+ */
+export function buildMultipartFormData(fields = []) {
+  const formData = new FormData();
+
+  if (!Array.isArray(fields)) {
+    return formData;
+  }
+
+  fields.forEach((field) => {
+    if (!field || !field.name) {
+      return;
+    }
+
+    if (typeof File !== "undefined" && field.file instanceof File) {
+      formData.append(field.name, field.file, field.file.name);
+      return;
+    }
+
+    if (field.value === undefined || field.value === null || field.value === "") {
+      return;
+    }
+
+    if (field.isArray) {
+      const arr = Array.isArray(field.value) ? field.value : [field.value];
+      const filtered = arr.filter((v) => v !== "" && v !== undefined && v !== null);
+      filtered.forEach((item) => {
+        if (typeof File !== "undefined" && item instanceof File) {
+          formData.append(field.name, item, item.name);
+        } else {
+          formData.append(field.name, String(item));
+        }
+      });
+    } else {
+      formData.append(field.name, String(field.value));
+    }
+  });
+
+  return formData;
+}

package/src/utils/response-utils.js

@@ -0,0 +1,203 @@
+import { formatXml } from "./xml-utils.js";
+import { schemaToAST, generateExample, standardizeExample } from "./schema-utils.js";
+
+/**
+ * Parses and processes a standard Fetch API Response into RapiDoc formatted response state.
+ * Handles JSON parsing, XML formatting, NDJSON streaming format, charset decoding,
+ * and binary MIME sniffing with RFC 5987 Content-Disposition decoding.
+ *
+ * @param {Response} fetchResponse - Standard Fetch Response object
+ * @returns {Promise<{
+ *   responseText: string,
+ *   respJson?: any,
+ *   respBlob?: Blob,
+ *   respText?: string,
+ *   responseIsBlob: boolean,
+ *   responseBlobType: string,
+ *   responseBlobUrl: string,
+ *   respContentDisposition: string
+ * }>}
+ */
+export async function processFetchResponse(fetchResponse) {
+  let respBlob;
+  let respJson;
+  let respText;
+  let responseIsBlob = false;
+  let responseBlobType = "";
+  let responseBlobUrl = "";
+  let respContentDisposition = "";
+  let responseText = "";
+
+  let contentType = fetchResponse.headers.get("content-type");
+  const respEmpty = (await fetchResponse.clone().text()).length === 0;
+  if (respEmpty) {
+    responseText = "";
+  } else if (contentType) {
+    contentType = contentType.split(";")[0].trim();
+    if (contentType === "application/x-ndjson") {
+      responseText = await fetchResponse.text();
+    } else if (contentType.includes("json")) {
+      if (/charset=[^"']+/.test(contentType)) {
+        const encoding = contentType.split("charset=")[1];
+        const buffer = await fetchResponse.arrayBuffer();
+        try {
+          respText = new TextDecoder(encoding).decode(buffer);
+        } catch {
+          respText = new TextDecoder("utf-8").decode(buffer);
+        }
+        try {
+          respJson = JSON.parse(respText);
+          responseText = JSON.stringify(respJson, null, 2);
+        } catch {
+          responseText = respText;
+        }
+      } else {
+        respJson = await fetchResponse.json();
+        responseText = JSON.stringify(respJson, null, 2);
+      }
+    } else if (
+      /^font\/|tar$|zip$|7z$|rtf$|msword$|excel$|\/pdf$|\/octet-stream$|^application\/vnd\./.test(
+        contentType,
+      )
+    ) {
+      responseIsBlob = true;
+      responseBlobType = "download";
+    } else if (contentType.startsWith("image")) {
+      responseIsBlob = true;
+      responseBlobType = "image";
+    } else if (/^audio|^image|^video/.test(contentType)) {
+      responseIsBlob = true;
+      responseBlobType = "view";
+    } else {
+      respText = await fetchResponse.text();
+      if (contentType.includes("xml")) {
+        responseText = formatXml(respText, { textNodesOnSameLine: true, indentor: "  " });
+      } else {
+        responseText = respText;
+      }
+    }
+    if (responseIsBlob) {
+      const contentDisposition = fetchResponse.headers.get("content-disposition") || "";
+      let filenameFromContentDisposition = "filename";
+      if (contentDisposition) {
+        const filenameStarRegexMatch = contentDisposition.match(/filename\*=\s*UTF-8''([^;]+)/);
+        if (filenameStarRegexMatch) {
+          filenameFromContentDisposition = decodeURIComponent(filenameStarRegexMatch[1]);
+        } else {
+          const filenameMatch = contentDisposition.match(/filename="?([^"]+)"?/);
+          if (filenameMatch) {
+            filenameFromContentDisposition = filenameMatch[1];
+          }
+        }
+      }
+      respContentDisposition = filenameFromContentDisposition;
+      respBlob = await fetchResponse.blob();
+      if (typeof URL !== "undefined" && URL.createObjectURL) {
+        responseBlobUrl = URL.createObjectURL(respBlob);
+      }
+    }
+  } else {
+    respText = await fetchResponse.text();
+    responseText = respText;
+  }
+
+  return {
+    responseText,
+    respJson,
+    respBlob,
+    respText,
+    responseIsBlob,
+    responseBlobType,
+    responseBlobUrl,
+    respContentDisposition,
+  };
+}
+
+/**
+ * Pre-computes schema ASTs, examples, and headers for all response codes and MIME types.
+ * Pure function extracted from api-response component to enable caching and unit testing.
+ *
+ * @param {object} responses - OpenAPI responses map
+ * @param {object} [options]
+ * @param {boolean|string} [options.callback=false]
+ * @param {boolean|string} [options.webhook=false]
+ * @returns {{
+ *   headersForEachRespStatus: object,
+ *   mimeResponsesForEachStatus: object,
+ *   defaultStatus: string,
+ *   defaultMimeType: string
+ * }}
+ */
+export function prepareResponseDefinitions(responses, options = {}) {
+  const { callback = false, webhook = false } = options;
+  const isCallbackOrWebhook =
+    callback === true || callback === "true" || webhook === true || webhook === "true";
+
+  const headersForEachRespStatus = {};
+  const mimeResponsesForEachStatus = {};
+  let defaultStatus = "";
+  let defaultMimeType = "";
+
+  if (!responses || typeof responses !== "object") {
+    return {
+      headersForEachRespStatus,
+      mimeResponsesForEachStatus,
+      defaultStatus,
+      defaultMimeType,
+    };
+  }
+
+  for (const statusCode of Object.keys(responses)) {
+    if (statusCode === "$$ref") {
+      continue;
+    }
+    if (!defaultStatus) {
+      defaultStatus = statusCode;
+    }
+    const allMimeResp = {};
+    const content = responses[statusCode]?.content;
+
+    if (content && typeof content === "object") {
+      for (const mimeResp of Object.keys(content)) {
+        const mimeRespObj = content[mimeResp];
+        if (!defaultMimeType) {
+          defaultMimeType = mimeResp;
+        }
+
+        const schemaTree = mimeRespObj?.schema ? schemaToAST(mimeRespObj.schema) : null;
+        const respExamples = generateExample(
+          mimeRespObj?.schema,
+          mimeResp,
+          standardizeExample(mimeRespObj?.examples),
+          standardizeExample(mimeRespObj?.example),
+          !isCallbackOrWebhook,
+          isCallbackOrWebhook,
+          mimeResp.includes("json") ? "json" : "text",
+        );
+
+        allMimeResp[mimeResp] = {
+          description: responses[statusCode].description,
+          examples: respExamples,
+          selectedExample: respExamples[0]?.exampleId || "",
+          schemaTree,
+        };
+      }
+    }
+
+    const tempHeaders = [];
+    if (responses[statusCode]?.headers) {
+      for (const key of Object.keys(responses[statusCode].headers)) {
+        tempHeaders.push({ name: key, ...responses[statusCode].headers[key] });
+      }
+    }
+    headersForEachRespStatus[statusCode] = tempHeaders;
+    mimeResponsesForEachStatus[statusCode] = allMimeResp;
+  }
+
+  return {
+    headersForEachRespStatus,
+    mimeResponsesForEachStatus,
+    defaultStatus,
+    defaultMimeType,
+  };
+}

package/src/utils/sanitize.js

@@ -0,0 +1,57 @@
+// One instance for every call: constructing it per description is measurable on large schemas
+let nativeSanitizer;
+
+export function sanitizeHTML(htmlString) {
+  if (typeof htmlString !== "string") {
+    return "";
+  }
+
+  // Use native Sanitizer API if supported
+  if (typeof window !== "undefined" && window.Sanitizer && Element.prototype.setHTML) {
+    try {
+      const el = document.createElement("div");
+      nativeSanitizer ??= new window.Sanitizer({ allowAttributes: { "*": ["*"] } });
+      el.setHTML(htmlString, { sanitizer: nativeSanitizer });
+      return el.innerHTML;
+    } catch {
+      // If Sanitizer with options throws, fall through to fallback shim
+    }
+  }
+
+  // Minimal shim for unsupported browsers to prevent basic XSS
+  let doc;
+  if (typeof DOMParser !== "undefined") {
+    doc = new DOMParser().parseFromString(htmlString, "text/html");
+  } else {
+    // Fallback for SSR/Node if needed, though this is primarily browser-side
+    return htmlString;
+  }
+
+  // Remove script tags
+  const scripts = doc.querySelectorAll("script");
+  for (let i = scripts.length - 1; i >= 0; i--) {
+    scripts[i].parentNode.removeChild(scripts[i]);
+  }
+
+  // Remove on* attributes and javascript: URIs
+  const allElements = doc.querySelectorAll("*");
+  for (let i = 0; i < allElements.length; i++) {
+    const el = allElements[i];
+    for (let j = el.attributes.length - 1; j >= 0; j--) {
+      const attr = el.attributes[j];
+      const attrName = attr.name.toLowerCase();
+      const attrValue = attr.value.toLowerCase();
+
+      if (attrName.startsWith("on")) {
+        el.removeAttribute(attr.name);
+      } else if (
+        (attrName === "href" || attrName === "src") &&
+        (attrValue.includes("javascript:") || attrValue.includes("data:text/html"))
+      ) {
+        el.removeAttribute(attr.name);
+      }
+    }
+  }
+
+  return doc.body.innerHTML;
+}