spyne 0.25.0 → 0.26.0

package/src/tests/channels/channel-window-custom-events.test.js

@@ -0,0 +1,130 @@
+import { SpyneChannelWindow } from '../../spyne/channels/spyne-channel-window'
+import { Subject } from 'rxjs'
+const { expect } = require('chai')
+
+const conformedEvent = (detail) => {
+  const event = new CustomEvent('my_test_event', { detail })
+  return {
+    action: 'CHANNEL_WINDOW_MY_TEST_EVENT_EVENT',
+    payload: event,
+    srcElement: undefined,
+    event
+  }
+}
+
+describe('window channel customEvents config conforming', () => {
+  it('should conform a string entry', () => {
+    const entry = SpyneChannelWindow.conformCustomEventConfig('my_event')
+    expect(entry).to.deep.equal({ name: 'my_event', operator: undefined, value: undefined })
+  })
+
+  it('should conform an object entry with a buffer operator', () => {
+    const entry = SpyneChannelWindow.conformCustomEventConfig({ name: 'my_event', buffer: 400 })
+    expect(entry).to.deep.equal({ name: 'my_event', operator: 'buffer', value: 400 })
+  })
+
+  it('should conform debounce, throttle and count operators', () => {
+    expect(SpyneChannelWindow.conformCustomEventConfig({ name: 'e1', debounce: 250 }).operator).to.equal('debounce')
+    expect(SpyneChannelWindow.conformCustomEventConfig({ name: 'e2', throttle: 100 }).operator).to.equal('throttle')
+    expect(SpyneChannelWindow.conformCustomEventConfig({ name: 'e3', count: 50 }).operator).to.equal('count')
+  })
+
+  it('should pick the first operator when several are set', () => {
+    const entry = SpyneChannelWindow.conformCustomEventConfig({ name: 'my_event', debounce: 250, buffer: 400 })
+    expect(entry.operator).to.equal('buffer')
+    expect(entry.value).to.equal(400)
+  })
+
+  it('should skip invalid entries', () => {
+    expect(SpyneChannelWindow.conformCustomEventConfig(42)).to.equal(null)
+    expect(SpyneChannelWindow.conformCustomEventConfig({ buffer: 400 })).to.equal(null)
+    expect(SpyneChannelWindow.conformCustomEventConfig(null)).to.equal(null)
+  })
+})
+
+describe('window channel customEvents batching operators', () => {
+  it('should map a batch to one payload with detail as the details array', () => {
+    const batch = [conformedEvent({ id: 1 }), conformedEvent({ id: 2 }), conformedEvent({ id: 3 })]
+    const { action, payload, event } = SpyneChannelWindow.mapBatchedEvents(batch)
+    expect(action).to.equal('CHANNEL_WINDOW_MY_TEST_EVENT_EVENT')
+    expect(payload.detail).to.deep.equal([{ id: 1 }, { id: 2 }, { id: 3 }])
+    expect(payload.isBatch).to.be.true
+    expect(payload.batchCount).to.equal(3)
+    expect(event).to.equal(batch[2].event)
+  })
+
+  it('should close a buffer batch after the quiet gap and emit once', (done) => {
+    const source$ = new Subject()
+    const obs$ = SpyneChannelWindow.customizeCustomEventObservable(source$, 'buffer', 30)
+    const emissions = []
+    obs$.subscribe(p => emissions.push(p))
+
+    source$.next(conformedEvent({ id: 1 }))
+    source$.next(conformedEvent({ id: 2 }))
+    setTimeout(() => source$.next(conformedEvent({ id: 3 })), 10)
+
+    setTimeout(() => {
+      expect(emissions.length).to.equal(1)
+      expect(emissions[0].payload.detail).to.deep.equal([{ id: 1 }, { id: 2 }, { id: 3 }])
+      done()
+    }, 100)
+  })
+
+  it('should emit separate buffer batches per burst', (done) => {
+    const source$ = new Subject()
+    const obs$ = SpyneChannelWindow.customizeCustomEventObservable(source$, 'buffer', 20)
+    const emissions = []
+    obs$.subscribe(p => emissions.push(p))
+
+    source$.next(conformedEvent({ id: 1 }))
+    setTimeout(() => source$.next(conformedEvent({ id: 2 })), 60)
+
+    setTimeout(() => {
+      expect(emissions.length).to.equal(2)
+      expect(emissions[0].payload.batchCount).to.equal(1)
+      expect(emissions[1].payload.batchCount).to.equal(1)
+      done()
+    }, 140)
+  })
+
+  it('should batch every n events with the count operator', () => {
+    const source$ = new Subject()
+    const obs$ = SpyneChannelWindow.customizeCustomEventObservable(source$, 'count', 2)
+    const emissions = []
+    obs$.subscribe(p => emissions.push(p))
+
+    source$.next(conformedEvent({ id: 1 }))
+    source$.next(conformedEvent({ id: 2 }))
+    source$.next(conformedEvent({ id: 3 }))
+    source$.next(conformedEvent({ id: 4 }))
+    source$.next(conformedEvent({ id: 5 }))
+
+    expect(emissions.length).to.equal(2)
+    expect(emissions[0].payload.detail).to.deep.equal([{ id: 1 }, { id: 2 }])
+    expect(emissions[1].payload.detail).to.deep.equal([{ id: 3 }, { id: 4 }])
+  })
+
+  it('should pass only the latest event through debounce', (done) => {
+    const source$ = new Subject()
+    const obs$ = SpyneChannelWindow.customizeCustomEventObservable(source$, 'debounce', 20)
+    const emissions = []
+    obs$.subscribe(p => emissions.push(p))
+
+    source$.next(conformedEvent({ id: 1 }))
+    source$.next(conformedEvent({ id: 2 }))
+    source$.next(conformedEvent({ id: 3 }))
+
+    setTimeout(() => {
+      expect(emissions.length).to.equal(1)
+      // debounced events keep the single-event payload shape (payload = CustomEvent)
+      expect(emissions[0].payload.detail).to.deep.equal({ id: 3 })
+      done()
+    }, 80)
+  })
+
+  it('should return the observable untouched when there is no operator', () => {
+    const source$ = new Subject()
+    const obs$ = SpyneChannelWindow.customizeCustomEventObservable(source$, undefined, undefined)
+    expect(obs$).to.equal(source$)
+  })
+})

package/src/tests/utils/safe-clone.test.js

@@ -0,0 +1,193 @@
+import { safeClone, safeCloneDeep, safeAugment, safeFilter, safeMap, safeReject } from '../../spyne/utils/safe-clone'
+import { SpyneAppProperties } from '../../spyne/utils/spyne-app-properties'
+import { ChannelPayload } from '../../spyne/channels/channel-payload-class'
+
+const PROXY_NAME = 'safeCloneTestProxy'
+
+// stub reviver: wraps the cloned target in a Proxy that answers a marker key
+const stubReviver = (target, proxyProps) => new Proxy(target, {
+  get(t, key) {
+    if (key === '__test__revived') {
+      return true
+    }
+    return t[key]
+  }
+})
+
+const makeProxyMarkedObj = (extraProps = {}) => ({
+  __proxy__proxyName: PROXY_NAME,
+  __proxy__isProxy: true,
+  __proxy__props: {},
+  headline: 'A Test Headline',
+  ...extraProps
+})
+
+describe('safeClone proxy revival', () => {
+  before(() => {
+    SpyneAppProperties.registerProxyReviver(PROXY_NAME, stubReviver)
+  })
+
+  describe('safeClone (existing behavior)', () => {
+    it('revives a root-level proxy object', () => {
+      const revived = safeClone(makeProxyMarkedObj())
+      expect(revived.__test__revived).to.be.true
+      expect(revived.headline).to.equal('A Test Headline')
+    })
+
+    it('deep-copies a plain object without mutating the source', () => {
+      const src = { a: { b: 1 } }
+      const copy = safeClone(src)
+      copy.a.b = 2
+      expect(src.a.b).to.equal(1)
+    })
+  })
+
+  describe('safeCloneDeep', () => {
+    it('revives a root-level proxy object', () => {
+      const revived = safeCloneDeep(makeProxyMarkedObj())
+      expect(revived.__test__revived).to.be.true
+    })
+
+    it('revives a proxy nested inside a plain wrapper', () => {
+      const wrapper = { pageData: { story: makeProxyMarkedObj() } }
+      const copy = safeCloneDeep(wrapper)
+      expect(copy.pageData.story.__test__revived).to.be.true
+      expect(copy.pageData.story.headline).to.equal('A Test Headline')
+    })
+
+    it('revives proxies inside arrays', () => {
+      const arr = [makeProxyMarkedObj(), { plain: true }]
+      const copy = safeCloneDeep(arr)
+      expect(copy[0].__test__revived).to.be.true
+      expect(copy[1].plain).to.be.true
+      expect(copy).to.not.equal(arr)
+    })
+
+    it('passes functions through by reference', () => {
+      const fn = () => 'curried'
+      const copy = safeCloneDeep({ curriedData: fn })
+      expect(copy.curriedData).to.equal(fn)
+    })
+
+    it('does not infinitely recurse on cycles', () => {
+      const obj = { name: 'cyclical' }
+      obj.self = obj
+      const copy = safeCloneDeep(obj)
+      expect(copy.name).to.equal('cyclical')
+    })
+
+    it('returns primitives as-is', () => {
+      expect(safeCloneDeep('str')).to.equal('str')
+      expect(safeCloneDeep(5)).to.equal(5)
+      expect(safeCloneDeep(null)).to.equal(null)
+    })
+
+    it('is reachable through safeClone(o, true)', () => {
+      const wrapper = { story: makeProxyMarkedObj() }
+      const copy = safeClone(wrapper, true)
+      expect(copy.story.__test__revived).to.be.true
+    })
+  })
+
+  describe('safeFilter / safeReject / safeMap', () => {
+    const makeProxyMarkedArr = () => {
+      const arr = [
+        { menu_label: 'a', headline: 'A' },
+        { menu_label: 'b', headline: 'B' },
+        { menu_label: 'c', headline: 'C' }
+      ]
+      arr.__proxy__proxyName = PROXY_NAME
+      arr.__proxy__isProxy = true
+      arr.__proxy__props = {}
+      return arr
+    }
+
+    it('safeFilter keeps element identity and re-wraps the array', () => {
+      const src = makeProxyMarkedArr()
+      const result = safeFilter(src, (o) => o.menu_label !== 'b')
+      expect(result.length).to.equal(2)
+      expect(result[0]).to.equal(src[0])          // element reference preserved
+      expect(result.__test__revived).to.be.true   // array-level identity re-wrapped
+    })
+
+    it('safeReject is the inverse of safeFilter', () => {
+      const src = makeProxyMarkedArr()
+      const result = safeReject(src, (o) => o.menu_label === 'b')
+      expect(result.length).to.equal(2)
+      expect(result.map(o => o.menu_label).join('')).to.equal('ac')
+      expect(result.__test__revived).to.be.true
+    })
+
+    it('safeMap gives callbacks writable copies of proxied elements', () => {
+      const src = [makeProxyMarkedObj()]
+      const result = safeMap(src, (el) => {
+        el.type = 'story'
+        return el
+      })
+      expect(result[0].type).to.equal('story')
+      expect(result[0].__test__revived).to.be.true  // revived copy
+      expect(src[0].type).to.equal(undefined)       // source untouched
+    })
+
+    it('safeMap passes plain elements by reference like native map', () => {
+      const plainEl = { plain: true }
+      const result = safeMap([plainEl], (el) => el)
+      expect(result[0]).to.equal(plainEl)
+    })
+
+    it('all three degrade to native behavior on plain arrays', () => {
+      const plain = [1, 2, 3]
+      expect(safeFilter(plain, n => n > 1)).to.deep.equal([2, 3])
+      expect(safeReject(plain, n => n > 1)).to.deep.equal([1])
+      expect(safeMap(plain, n => n * 2)).to.deep.equal([2, 4, 6])
+    })
+  })
+
+  describe('read-only payload facades (deepFreeze)', () => {
+    it('wraps proxy subtrees in a write-blocking facade instead of freezing', () => {
+      const proxyChild = makeProxyMarkedObj()
+      const payload = { plainKey: 1, story: proxyChild }
+      const frozen = ChannelPayload.deepFreeze(payload)
+
+      expect(Object.isFrozen(frozen)).to.be.true          // plain shell frozen
+      expect(frozen.story).to.not.equal(proxyChild)        // facade, not raw ref
+      expect(frozen.story.headline).to.equal('A Test Headline') // reads pass through
+
+      frozen.story.headline = 'MUTATED'                    // write silently blocked
+      expect(proxyChild.headline).to.equal('A Test Headline')
+      expect(frozen.story.headline).to.equal('A Test Headline')
+    })
+
+    it('reuses one facade per proxy across dispatches', () => {
+      const proxyChild = makeProxyMarkedObj()
+      const a = ChannelPayload.deepFreeze({ story: proxyChild })
+      const b = ChannelPayload.deepFreeze({ story: proxyChild })
+      expect(a.story).to.equal(b.story)
+    })
+
+    it('facade data still revives to a writable copy via safeCloneDeep', () => {
+      const payload = ChannelPayload.deepFreeze({ story: makeProxyMarkedObj() })
+      const writable = safeCloneDeep(payload)
+      writable.story.type = 'story'
+      expect(writable.story.type).to.equal('story')
+      expect(writable.story.__test__revived).to.be.true
+    })
+  })
+
+  describe('safeAugment', () => {
+    it('returns a writable revived copy carrying the extra props', () => {
+      const augmented = safeAugment(makeProxyMarkedObj(), { type: 'story', launchCode: 'hp3' })
+      expect(augmented.__test__revived).to.be.true
+      expect(augmented.type).to.equal('story')
+      expect(augmented.launchCode).to.equal('hp3')
+      expect(augmented.headline).to.equal('A Test Headline')
+    })
+
+    it('augments plain objects without mutating the source', () => {
+      const src = { a: 1 }
+      const augmented = safeAugment(src, { b: 2 })
+      expect(augmented.b).to.equal(2)
+      expect(src.b).to.equal(undefined)
+    })
+  })
+})

package/src/tests/utils/security.test.js

@@ -268,6 +268,94 @@ describe('sanitization security', () => {
     })
   })
 
+  describe('anchor policy', () => {
+    it('should keep target in app mode and force noopener on _blank', () => {
+      const clean = sanitizeData('<a href="https://example.com" target="_blank">x</a>', { mode: 'app' })
+
+      expect(clean).to.include('target="_blank"')
+      expect(clean).to.include('noopener')
+      expect(clean).to.include('noreferrer')
+    })
+
+    it('should preserve existing rel values when forcing noopener', () => {
+      const clean = sanitizeData('<a href="https://example.com" target="_blank" rel="external">x</a>', { mode: 'richtext' })
+
+      expect(clean).to.include('external')
+      expect(clean).to.include('noopener')
+    })
+
+    it('should keep named-window targets and force noopener on them', () => {
+      // target="blank" (no underscore) is a legal named browsing context
+      // and the most common real-world form; it carries the same opener
+      // risk as _blank and gets the same mitigation.
+      const clean = sanitizeData('<a href="https://rxjs.dev/api/index/function/fromEvent" target="blank">fromEvent</a>', { mode: 'app' })
+
+      expect(clean).to.include('target="blank"')
+      expect(clean).to.include('noopener')
+      expect(clean).to.include('noreferrer')
+    })
+
+    it('should not add noopener to same-context targets', () => {
+      const clean = sanitizeData('<a href="https://example.com" target="_self">x</a>', { mode: 'app' })
+
+      expect(clean).to.include('target="_self"')
+      expect(clean).to.not.include('noopener')
+    })
+
+    it('should remove target from anchors without an href', () => {
+      const clean = sanitizeData('<a target="_blank">x</a>', { mode: 'app' })
+
+      expect(clean).to.not.include('target=')
+    })
+
+    it('should strip target everywhere with allowTarget false', () => {
+      const clean = sanitizeData('<a href="https://example.com" target="_blank">x</a>', {
+        mode: 'richtext',
+        anchors: { allowTarget: false }
+      })
+
+      expect(clean).to.not.include('target=')
+    })
+
+    it('should enforce allowedDomains on cross-origin hrefs', () => {
+      const opts = { mode: 'app', anchors: { allowedDomains: ['https://github.com'] } }
+
+      const allowed = sanitizeData('<a href="https://github.com/spynejs">x</a>', opts)
+      const blocked = sanitizeData('<a href="https://evil.example.com/page">x</a>', opts)
+
+      expect(allowed).to.include('href="https://github.com/spynejs"')
+      expect(blocked).to.not.include('href=')
+    })
+
+    it('should always allow same-origin, relative, mailto and tel hrefs despite allowedDomains', () => {
+      const opts = { mode: 'app', anchors: { allowedDomains: ['https://github.com'] } }
+
+      expect(sanitizeData('<a href="/local/page">x</a>', opts)).to.include('href="/local/page"')
+      expect(sanitizeData('<a href="mailto:a@b.com">x</a>', opts)).to.include('href="mailto:a@b.com"')
+      expect(sanitizeData('<a href="tel:+15551234567">x</a>', opts)).to.include('href="tel:+15551234567"')
+    })
+
+    it('should apply the anchor policy on the DomElement attribute channel', () => {
+      const el = new DomElement({
+        tagName: 'a',
+        attributes: { href: 'https://example.com', target: '_blank' }
+      }).render()
+
+      expect(el.getAttribute('target')).to.equal('_blank')
+      expect(el.getAttribute('rel')).to.include('noopener')
+    })
+
+    it('should keep named-window targets with noopener on the DomElement attribute channel', () => {
+      const el = new DomElement({
+        tagName: 'a',
+        attributes: { href: 'https://example.com', target: 'blank' }
+      }).render()
+
+      expect(el.getAttribute('target')).to.equal('blank')
+      expect(el.getAttribute('rel')).to.include('noopener')
+    })
+  })
+
   describe('CMS wrappers and custom elements', () => {
     const cmsMarkup = '<spyne-cms-item data-cms-id="post.title" data-cms-key="title">' +
       '<spyne-cms-item-hitbox></spyne-cms-item-hitbox>' +