web-manager 4.1.36 → 4.1.38

package/CHANGELOG.md

@@ -15,6 +15,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Security` in case of vulnerabilities.
 
 ---
+## [4.1.38] - 2026-04-08
+### Added
+- Added `sanitizeURL()` utility method that validates URLs against dangerous URI schemes (javascript:, data:, etc.), allowing only http: and https: protocols.
+
+## [4.1.37] - 2026-04-05
+### Added
+- Added `_resolveUsage()` to auth module that merges account usage data with plan limits from config, exposed as a top-level `usage` binding context.
+- Added `payment.processors` and `payment.plans` defaults to configuration.
+
 ## [4.1.36] - 2026-04-02
 ### Fixed
 - Fixed mocha binary path preventing `npm test` from running.

package/CLAUDE.md

@@ -152,7 +152,8 @@ document.body.addEventListener('click', (e) => {
 ### Auth (`auth.js`)
 - **Class**: `Auth`
 - **Key Methods**: `listen(options, callback)`, `isAuthenticated()`, `getUser()`, `signInWithEmailAndPassword()`, `signOut()`, `getIdToken()`, `resolveSubscription(account?)`
-- **Bindings**: Updates `auth.user` and `auth.account` context
+- **Bindings**: Updates `auth` and `usage` context on auth settle
+- **Usage Resolution**: `_resolveUsage(state)` merges `account.usage` (Firestore) with plan limits from `config.payment.plans` to produce the `usage` bindings key (e.g., `{ credits: { monthly: 5, limit: 100 } }`)
 
 #### resolveSubscription(account?)
 Derives calculated subscription fields from raw account data. Returns only fields that require derivation logic — raw data (product.id, status, trial, cancellation) lives on `account.subscription` directly.
@@ -268,9 +269,14 @@ Current test coverage is minimal - focuses on configuration and storage.
 
 ### Modifying Configuration Defaults
 1. Edit `_processConfiguration()` in `src/index.js`
-2. Add to `defaults` object
+2. Add to `defaults` object (e.g., `payment: { processors: {}, plans: [] }`)
 3. Document in README.md Configuration section
 
+### Payment Configuration
+Payment config is set in `_config.yml` under `web_manager.payment` and includes:
+- `processors`: Stripe, PayPal, etc. (publishable keys)
+- `plans`: Array of `{ id, limits: { feature: N } }` used to resolve usage limits on the frontend
+
 ### Adding a Data Binding Action
 1. Edit `_executeAction()` in `src/modules/bindings.js`
 2. Add case for new action (e.g., `@class`)

package/dist/index.js

@@ -296,6 +296,10 @@ class Manager {
         FIREBASE_EMULATOR_CONNECT: false,
       },
       validRedirectHosts: [],
+      payment: {
+        processors: {},
+        plans: [],
+      },
 
       // Non-configurable defaults
       refreshNewVersion: {

package/dist/modules/auth.js

@@ -164,8 +164,12 @@ class Auth {
 
       // Update bindings and storage once per auth state change
       if (!this._hasProcessedStateChange) {
-        this.manager.bindings().update({ auth: state });
+        this.manager.bindings().update({
+          auth: state,
+          usage: this._resolveUsage(state),
+        });
         this.manager.storage().set('auth', state);
+
         this._hasProcessedStateChange = true;
       }
 
@@ -252,6 +256,29 @@ class Auth {
     };
   }
 
+  // Resolve usage bindings from account data + plan limits from config.
+  // Returns: { credits: { monthly: 5, limit: 100 }, ... }
+  _resolveUsage(state) {
+    const accountUsage = state.account?.usage || {};
+    const plan = state.resolved?.plan || 'basic';
+    const plans = this.manager.config.payment?.plans || [];
+    const planConfig = plans.find(p => p.id === plan) || {};
+    const limits = planConfig.limits || {};
+
+    // Merge current usage with limits for each feature
+    const usage = {};
+    const keys = new Set([...Object.keys(accountUsage), ...Object.keys(limits)]);
+
+    for (const key of keys) {
+      usage[key] = {
+        ...(accountUsage[key] || {}),
+        limit: limits[key] || 0,
+      };
+    }
+
+    return usage;
+  }
+
   // Get ID token for the current user
   async getIdToken(forceRefresh = false) {
     try {

package/dist/modules/utilities.js

@@ -81,6 +81,26 @@ class Utilities {
     return input;
   }
 
+  // Sanitize URL to prevent javascript:, data:, and other dangerous URI schemes
+  // Returns the original URL if safe, or '' if rejected
+  sanitizeURL(url) {
+    if (!url || typeof url !== 'string') {
+      return '';
+    }
+
+    try {
+      const parsed = new URL(url, window.location.origin);
+
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return '';
+      }
+
+      return url;
+    } catch (e) {
+      return '';
+    }
+  }
+
   // Show notification
   showNotification(message, options = {}) {
     // Handle different input types

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "4.1.36",
+  "version": "4.1.38",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "dist/index.js",
   "module": "src/index.js",