scorm-again 3.1.4 → 3.2.0

package/dist/esm/scorm12.js

@@ -1,5 +1,22 @@
 const SECONDS_PER_MINUTE = 60;
 const SECONDS_PER_HOUR = 60 * SECONDS_PER_MINUTE;
+const CORS_SAFELISTED_CONTENT_TYPES = [
+  "text/plain",
+  "application/x-www-form-urlencoded",
+  "multipart/form-data"
+];
+function isCorsSafelistedContentType(contentType) {
+  const essence = ((contentType || "").split(";")[0] ?? "").trim().toLowerCase();
+  return CORS_SAFELISTED_CONTENT_TYPES.includes(essence);
+}
+function isCrossOriginUrl(url) {
+  if (typeof location === "undefined" || !location || !location.origin) return false;
+  try {
+    return new URL(url, location.href).origin !== location.origin;
+  } catch {
+    return false;
+  }
+}
 const getSecondsAsHHMMSS = (totalSeconds) => {
   if (!totalSeconds || totalSeconds <= 0) {
     return "00:00:00";
@@ -149,12 +166,18 @@ function stringMatches(str, tester) {
   }
   return new RegExp(tester).test(str);
 }
-function memoize(fn, keyFn) {
+function memoize(fn, keyFn, options) {
   const cache = /* @__PURE__ */ new Map();
   return ((...args) => {
     const key = keyFn ? keyFn(...args) : JSON.stringify(args);
+    if (options?.maxKeyLength !== void 0 && key.length > options.maxKeyLength) {
+      return fn(...args);
+    }
     return cache.has(key) ? cache.get(key) : (() => {
       const result = fn(...args);
+      if (options?.maxEntries !== void 0 && cache.size >= options.maxEntries) {
+        cache.delete(cache.keys().next().value);
+      }
       cache.set(key, result);
       return result;
     })();
@@ -524,8 +547,10 @@ const DefaultSettings = {
   lmsCommitUrl: false,
   dataCommitFormat: "json",
   commitRequestDataType: "application/json;charset=UTF-8",
+  terminationCommitContentType: "text/plain;charset=UTF-8",
   autoProgress: false,
   logLevel: LogLevelEnum.ERROR,
+  uninitializedGetLogLevel: LogLevelEnum.WARN,
   selfReportSessionTime: false,
   alwaysSendTotalTime: false,
   renderCommonCommitFields: false,
@@ -819,6 +844,8 @@ const scorm2004_regex = {
   CMILang: "^([a-zA-Z]{1,8}|i|x)(-[a-zA-Z0-9-]{2,8})?$|^$",
   /** CMILangString250 - String with optional language tag, max 250 chars (RTE C.1.3) */
   CMILangString250: "^({lang=([a-zA-Z]{1,8}|i|x)(-[a-zA-Z0-9-]{2,8})?})?((?!{.*$).{0,250}$)?$",
+  /** CMILangString - Optional language tag, no length cap; RTE C.1.3 SPM is a floor and is deliberately not enforced */
+  CMILangString: "^({lang=([a-zA-Z]{1,8}|i|x)(-[a-zA-Z0-9-]{2,8})?})?((?!{.*$).*$)?$",
   /** CMILangcr - Language tag pattern with content */
   CMILangcr: "^(({lang=([a-zA-Z]{1,8}|i|x)?(-[a-zA-Z0-9-]{2,8})?}))(.*?)$",
   /** CMILangString250cr - String with optional language tag (carriage return variant) */
@@ -1053,7 +1080,9 @@ class AsynchronousHttpService {
    */
   async performBeacon(url, params) {
     const { body, contentType } = this._prepareRequestBody(params);
-    const beaconSuccess = navigator.sendBeacon(url, new Blob([body], { type: contentType }));
+    const beaconContentType = Array.isArray(params) ? contentType : this.settings.terminationCommitContentType;
+    this._warnIfBeaconContentTypeUnsafe(url, beaconContentType);
+    const beaconSuccess = navigator.sendBeacon(url, new Blob([body], { type: beaconContentType }));
     return Promise.resolve({
       status: beaconSuccess ? 200 : 0,
       ok: beaconSuccess,
@@ -1067,6 +1096,14 @@ class AsynchronousHttpService {
       })
     });
   }
+  _warnIfBeaconContentTypeUnsafe(url, contentType) {
+    if (isCrossOriginUrl(url) && !isCorsSafelistedContentType(contentType)) {
+      this.settings.onLogMessage?.(
+        LogLevelEnum.WARN,
+        `sendBeacon to cross-origin URL with non-CORS-safelisted Content-Type "${contentType}" may be silently dropped by the browser (Beacon cannot preflight). Use fetch (useAsynchronousCommits + asyncModeBeaconBehavior:"never") for cross-origin JSON/auth on terminate.`
+      );
+    }
+  }
   /**
    * Transforms the response from the LMS to a ResultObject
    * @param {Response} response - The response from the LMS
@@ -1734,14 +1771,14 @@ class ErrorHandlingService {
    * @param {string} message - The error message
    * @throws {ValidationError} - If throwException is true, throws a ValidationError
    */
-  throwSCORMError(CMIElement, errorNumber, message) {
+  throwSCORMError(CMIElement, errorNumber, message, messageLevel = LogLevelEnum.ERROR) {
     this._lastDiagnostic = message || "";
     if (!message) {
       message = this._getLmsErrorMessageDetails(errorNumber, true);
     }
     const formattedMessage = `SCORM Error ${errorNumber}: ${message}${CMIElement ? ` [Element: ${CMIElement}]` : ""}`;
-    this._apiLog("throwSCORMError", errorNumber + ": " + message, LogLevelEnum.ERROR, CMIElement);
-    this._loggingService.error(formattedMessage);
+    this._apiLog("throwSCORMError", errorNumber + ": " + message, messageLevel, CMIElement);
+    this._loggingService.log(messageLevel, formattedMessage);
     this._lastErrorCode = String(errorNumber);
   }
   /**
@@ -2424,7 +2461,9 @@ const checkValidFormat = memoize(
   (CMIElement, value, regexPattern, errorCode, _errorClass, allowEmptyString) => {
     const valueKey = typeof value === "string" ? value : `[${typeof value}]`;
     return `${CMIElement}:${valueKey}:${regexPattern}:${errorCode}:${allowEmptyString || false}`;
-  }
+  },
+  // Normal capped CMI values and regexes fit within 2000 characters; large uncapped values bypass caching.
+  { maxEntries: 1e3, maxKeyLength: 2e3 }
 );
 const checkValidRange = memoize(
   (CMIElement, value, rangePattern, errorCode, errorClass) => {
@@ -2447,7 +2486,8 @@ const checkValidRange = memoize(
   },
   // Custom key function that excludes the error class from the cache key
   // since it can't be stringified and doesn't affect the validation result
-  (CMIElement, value, rangePattern, errorCode, _errorClass) => `${CMIElement}:${value}:${rangePattern}:${errorCode}`
+  (CMIElement, value, rangePattern, errorCode, _errorClass) => `${CMIElement}:${value}:${rangePattern}:${errorCode}`,
+  { maxEntries: 1e3 }
 );
 
 class SerializationService {
@@ -2737,15 +2777,22 @@ class SynchronousHttpService {
     const handledPayload = metadata === void 0 ? this.settings.requestHandler(params) : this.settings.requestHandler(params, metadata);
     const requestPayload = handledPayload ?? params;
     const { body } = this._prepareRequestBody(requestPayload);
-    const beaconSuccess = navigator.sendBeacon(
-      url,
-      new Blob([body], { type: "text/plain;charset=UTF-8" })
-    );
+    const beaconContentType = this.settings.terminationCommitContentType;
+    this._warnIfBeaconContentTypeUnsafe(url, beaconContentType);
+    const beaconSuccess = navigator.sendBeacon(url, new Blob([body], { type: beaconContentType }));
     return {
       result: beaconSuccess ? "true" : "false",
       errorCode: beaconSuccess ? 0 : this.error_codes.GENERAL_COMMIT_FAILURE || 391
     };
   }
+  _warnIfBeaconContentTypeUnsafe(url, contentType) {
+    if (isCrossOriginUrl(url) && !isCorsSafelistedContentType(contentType)) {
+      this.settings.onLogMessage?.(
+        LogLevelEnum.WARN,
+        `sendBeacon to cross-origin URL with non-CORS-safelisted Content-Type "${contentType}" may be silently dropped by the browser (Beacon cannot preflight). Use fetch (useAsynchronousCommits + asyncModeBeaconBehavior:"never") for cross-origin JSON/auth on terminate.`
+      );
+    }
+  }
   /**
    * Performs a synchronous XMLHttpRequest
    * @param {string} url - The URL to send the request to
@@ -3772,8 +3819,8 @@ class BaseAPI {
    * // Throw a "not initialized" error
    * this.throwSCORMError(301, "The API must be initialized before calling GetValue");
    */
-  throwSCORMError(CMIElement, errorNumber, message) {
-    this._errorHandlingService.throwSCORMError(CMIElement, errorNumber ?? 0, message);
+  throwSCORMError(CMIElement, errorNumber, message, messageLevel) {
+    this._errorHandlingService.throwSCORMError(CMIElement, errorNumber ?? 0, message, messageLevel);
   }
   /**
    * Clears the last SCORM error code when an operation succeeds.