tripstorekrabi-shared 1.25.9 → 1.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tripstorekrabi-shared",
-  "version": "1.25.9",
+  "version": "1.26.1",
   "description": "Shared library for Trip Store Krabi",
   "author": "Stefan Sommer <tonprince@gmail.com>",
   "repository": {
@@ -18,8 +18,8 @@
   },
   "dependencies": {
     "dayjs": "^1.11.23",
-    "libphonenumber-js": "^1.13.14",
-    "nanoid": "^6.0.1",
+    "libphonenumber-js": "^1.13.15",
+    "nanoid": "^6.0.2",
     "firebase-admin": "^14.5.0"
   },
   "scripts": {

package/product.js

@@ -1,6 +1,6 @@
-import { calculateProductSellingPrice, countMinPeople } from "./price.js";
+import { calculateProductSellingPrice, countMinPeople } from './price.js';
 
-const MATCH_HTML_REGEXP = /(<([^>]+)>)/ig;
+const MATCH_HTML_REGEXP = /(<([^>]+)>)/gi;
 
 function toIsoDateString(val) {
   if (!val) return null;
@@ -65,21 +65,50 @@ export function buildIndex(id, product) {
     document.shortName = String(product.shortName).trim();
   }
 
-  if (Array.isArray(product.destinations) && product.destinations.length > 0) {
-    document.destinations = product.destinations;
-  } else if (product.destination) {
-    document.destinations = [product.destination];
-  }
+  const isTransfer = Boolean(product.from && product.to);
 
-  if (Array.isArray(product.tags)) {
-    document.tags = product.tags;
+  if (isTransfer) {
+    // For transfers, always derive destinations directly from `from` and `to`
+    const transferDestinations = Array.from(
+      new Set([product.from, product.to].map((d) => String(d || '').trim()).filter(Boolean))
+    );
+    if (transferDestinations.length > 0) {
+      document.destinations = transferDestinations;
+    }
   } else {
-    document.tags = [];
+    // For activities, clean and deduplicate `destinations` (or fallback to `destination`)
+    const rawDestinations = Array.isArray(product.destinations)
+      ? product.destinations
+      : product.destination
+        ? [product.destination]
+        : [];
+
+    const cleanedDestinations = Array.from(
+      new Set(rawDestinations.map((d) => String(d || '').trim()).filter(Boolean))
+    );
+
+    if (cleanedDestinations.length > 0) {
+      document.destinations = cleanedDestinations;
+    }
   }
 
-  if (product.from && product.to) {
-    document.from = product.from;
-    document.to = product.to;
+  // Populate unified keywords array (falls back to legacy tags if keywords has no valid entries)
+  const validKeywords = Array.isArray(product.keywords)
+    ? product.keywords.map((k) => String(k || '').trim()).filter(Boolean)
+    : [];
+
+  const validTags = Array.isArray(product.tags)
+    ? product.tags.map((t) => String(t || '').trim()).filter(Boolean)
+    : [];
+
+  document.keywords = Array.from(new Set(validKeywords.length > 0 ? validKeywords : validTags));
+
+  // TODO stef Keep legacy tags synced for backward compatibility until tags is fully removed from frontend
+  document.tags = validTags.length > 0 ? Array.from(new Set(validTags)) : document.keywords;
+
+  if (isTransfer) {
+    document.from = String(product.from).trim();
+    document.to = String(product.to).trim();
 
     if (Array.isArray(product.waypoints) && product.waypoints.length > 0) {
       const startWp = product.waypoints[0]?.latLng;

package/telegram.js

@@ -1,54 +1,138 @@
-const getEnv = (key) => typeof process !== 'undefined' && process.env ? process.env[key] : undefined;
-
-const ENV_BOT_TOKEN = getEnv('TELEGRAM_API_TOKEN') || getEnv('PUBLIC_TELEGRAM_API_TOKEN');
-const ENV_CHAT_ID = getEnv('TELEGRAM_CHAT_ID');
+const getEnv = (key) => (typeof process !== 'undefined' && process.env ? process.env[key] : undefined);
 const TELEGRAM_MAX_CHARS = 4096;
 
+/**
+ * Safely escapes HTML reserved characters for dynamic user-generated content.
+ * Use this BEFORE passing dynamic variables into your message string!
+ */
+export function escapeHtml(text) {
+  if (!text) return '';
+  return String(text)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+
+/**
+ * Safely truncates HTML strings without breaking active tags, attributes, or HTML entities.
+ */
+export function safeTruncateHtml(html, maxLength) {
+  if (html.length <= maxLength) return html;
+
+  const note = "\n\n... [Message Truncated]";
+  const targetLength = maxLength - note.length;
+  let truncated = html.substring(0, targetLength);
+
+  // 1. Strip trailing broken HTML entity if cut mid-way (e.g., "&am")
+  truncated = truncated.replace(/&[a-z0-9#]{0,7}$/i, '');
+
+  // 2. Cut back if sliced inside an unclosed HTML tag (e.g., "<a href=...")
+  const lastOpenAngle = truncated.lastIndexOf('<');
+  const lastCloseAngle = truncated.lastIndexOf('>');
+  if (lastOpenAngle > lastCloseAngle) {
+    if (/<[a-z\/]/i.test(truncated.substring(lastOpenAngle))) {
+      truncated = truncated.substring(0, lastOpenAngle);
+    }
+  }
+
+  // 3. Close open HTML tags using a localized regex parser (ReDoS safe & supports tg-spoiler)
+  const openTags = [];
+  const tagMatcher = /<\/?([a-z0-9-]+)[^>]*>/gi; // <-- FIXED: Added hyphen for tg-spoiler / tg-emoji
+  let match;
+
+  while ((match = tagMatcher.exec(truncated)) !== null) {
+    const fullTag = match[0];
+    const tagName = match[1].toLowerCase();
+
+    // Skip self-closing void elements or explicit self-closing tags
+    if (fullTag.endsWith('/>') || ['br', 'img', 'hr', 'input'].includes(tagName)) {
+      continue;
+    }
+
+    if (fullTag.startsWith('</')) {
+      const lastIndex = openTags.lastIndexOf(tagName);
+      if (lastIndex !== -1) openTags.splice(lastIndex, 1);
+    } else {
+      openTags.push(tagName);
+    }
+  }
+
+  // Close remaining unclosed tags in reverse order
+  while (openTags.length > 0) {
+    truncated += `</${openTags.pop()}>`;
+  }
+
+  return truncated + note;
+}
+
+/**
+ * Sends a highly resilient message to Telegram.
+ */
 export async function sendTelegramMessage(message, options = {}) {
   const {
     botToken,
     chatId,
+    messageThreadId,
     parseMode = 'HTML',
     prefix = '',
     truncate = true,
     maxRetries = 3,
-    throwOnError = true
+    maxRateLimitRetries = 3,
+    throwOnError = true,
+    timeoutMs = 15000 // <-- ADDED: Failsafe for hanging serverless connections
   } = options;
 
-  const BOT_TOKEN = botToken || ENV_BOT_TOKEN;
-  const CHAT_ID = chatId || ENV_CHAT_ID;
+  const BOT_TOKEN = botToken || getEnv('TELEGRAM_API_TOKEN') || getEnv('PUBLIC_TELEGRAM_API_TOKEN');
+  const CHAT_ID = chatId || getEnv('TELEGRAM_CHAT_ID');
 
   if (!BOT_TOKEN || !CHAT_ID) {
-    const errorMsg = "FATAL: Telegram secrets are not configured in options or the environment.";
+    const errorMsg = "FATAL: Telegram secrets are not configured in options or environment.";
     console.error(errorMsg);
     if (throwOnError) throw new Error(errorMsg);
     return false;
   }
 
-  let finalMessage = `${prefix} ${message}`.trim();
+  let finalMessage = prefix ? `${prefix} ${message}`.trim() : String(message || '').trim();
 
+  // Safe truncation
   if (truncate && finalMessage.length > TELEGRAM_MAX_CHARS) {
-    const note = "\n\n... [Message Truncated]";
-    const usableLength = TELEGRAM_MAX_CHARS - note.length;
-    finalMessage = finalMessage.substring(0, usableLength) + note;
-    console.warn(`Message truncated from ${message.length} to ${TELEGRAM_MAX_CHARS} characters.`);
+    if (parseMode && parseMode.toUpperCase() === 'HTML') {
+      finalMessage = safeTruncateHtml(finalMessage, TELEGRAM_MAX_CHARS);
+    } else {
+      const note = "\n\n... [Message Truncated]";
+      finalMessage = finalMessage.substring(0, TELEGRAM_MAX_CHARS - note.length) + note;
+    }
+    console.warn(`Telegram message truncated to fit ${TELEGRAM_MAX_CHARS} limit.`);
   }
 
-  const telegramApiUrl = `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`;
-  const fetchOptions = {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      chat_id: CHAT_ID,
-      text: finalMessage,
-      parse_mode: parseMode.toUpperCase(),
-    })
+  const bodyPayload = {
+    chat_id: String(CHAT_ID),
+    text: finalMessage,
   };
 
+  if (parseMode) {
+    bodyPayload.parse_mode = parseMode.toUpperCase();
+  }
+
+  if (messageThreadId !== undefined && messageThreadId !== null) {
+    bodyPayload.message_thread_id = Number(messageThreadId);
+  }
+
+  const telegramApiUrl = `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`;
+
+  let lastError = null;
+  let rateLimitRetries = 0;
+
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     try {
+      // <-- FIXED: Added AbortSignal to prevent Firebase Function 60s freeze
+      const fetchOptions = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(bodyPayload),
+        signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(timeoutMs) : undefined
+      };
+
       const res = await fetch(telegramApiUrl, fetchOptions);
 
       if (res.ok) {
@@ -57,49 +141,49 @@ export async function sendTelegramMessage(message, options = {}) {
 
       const json = await res.json().catch(() => null);
 
+      // 1. Rate Limits (429)
       if (res.status === 429 && json?.parameters?.retry_after) {
-        const retryAfterSeconds = json.parameters.retry_after;
-        const waitTimeMs = (retryAfterSeconds + 1) * 1000;
-
-        console.warn(`Telegram Rate Limit hit. Retrying after ${retryAfterSeconds}s...`);
-        await new Promise((resolve) => setTimeout(resolve, waitTimeMs));
-        continue;
+        if (rateLimitRetries < maxRateLimitRetries) {
+          rateLimitRetries++;
+          const waitTimeMs = (json.parameters.retry_after + 1) * 1000;
+          console.warn(`Telegram Rate Limit hit. Waiting ${json.parameters.retry_after}s...`);
+          await new Promise((resolve) => setTimeout(resolve, waitTimeMs));
+          attempt--; // Retry attempt
+          continue;
+        }
       }
 
-      let errorMessage = 'Telegram API request failed';
-      if (json?.description) {
-        errorMessage = json.description;
-      } else if (typeof json?.error === 'string') {
-        errorMessage = json.error;
-      } else if (json?.error?.message) {
-        errorMessage = json.error.message;
-      } else {
-        errorMessage = `HTTP ${res.status}: ${res.statusText || 'Unknown Error'}`;
-      }
-
-      throw new Error(`An error occurred while communicating with Telegram:\n${errorMessage}`);
-    } catch (err) {
-      const safeError = err instanceof Error ? err : new Error(String(err));
-      const msg = safeError.message || '';
+      const description = json?.description || json?.error || `HTTP ${res.status}: ${res.statusText}`;
+      const apiError = new Error(`Telegram API Error (${res.status}): ${description}`);
 
-      if (msg.includes('communicating with Telegram') && !msg.includes('429')) {
-        if (throwOnError) throw safeError;
-        console.error(safeError);
+      // 2. Permanent Client Errors (4xx) - DO NOT RETRY
+      if (res.status >= 400 && res.status < 500) {
+        if (throwOnError) throw apiError;
+        console.error(apiError);
         return false;
       }
 
-      if (attempt === maxRetries - 1) {
-        if (throwOnError) throw safeError;
-        console.error(safeError);
-        return false;
+      // 3. Server Errors (5xx) - Save & Retry
+      lastError = apiError;
+
+    } catch (err) {
+      // If we threw a 4xx error intentionally above, rethrow it immediately
+      if (err instanceof Error && err.message.startsWith('Telegram API Error (4')) {
+        throw err;
       }
 
+      // Capture network errors (e.g., fetch failed, DNS, connection timeout)
+      lastError = err instanceof Error ? err : new Error(String(err));
+    }
+
+    // Delay before retrying network/5xx errors
+    if (attempt < maxRetries - 1) {
       await new Promise((resolve) => setTimeout(resolve, 1000 * (attempt + 1)));
     }
   }
 
-  const timeoutError = new Error('Telegram request failed: Exceeded maximum retries.');
-  if (throwOnError) throw timeoutError;
-  console.error(timeoutError);
+  const finalError = lastError || new Error('Telegram request failed after retries.');
+  if (throwOnError) throw finalError;
+  console.error(finalError);
   return false;
 }