wireweave 0.3.10 → 0.3.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wireweave",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "nostr + webrtc voice + data SDK. networking layer for 247420 projects.",
   "type": "module",
   "main": "./src/index.js",

package/src/bans.js

@@ -1,3 +1,5 @@
+import { dtag, parseDtag } from './dtag.js';
+
 export class Bans extends EventTarget {
   constructor({ relayPool, auth = null, roles = null }) {
     super();
@@ -17,7 +19,7 @@ export class Bans extends EventTarget {
   async ban(serverId, pubkey) {
     if (!this.auth?.isLoggedIn()) throw new Error('Not logged in');
     if (this.roles && !this.roles.isAdmin(serverId)) throw new Error('Insufficient permissions');
-    const dTag = 'zellous-ban:' + serverId + ':' + pubkey;
+    const dTag = dtag('ban', serverId, pubkey);
     const signed = await this.auth.sign({
       kind: 30078, created_at: Math.floor(Date.now() / 1000),
       tags: [['d', dTag], ['server', serverId]],
@@ -30,7 +32,7 @@ export class Bans extends EventTarget {
     if (!this.auth?.isLoggedIn()) throw new Error('Not logged in');
     if (this.roles && !this.roles.isAdmin(serverId)) throw new Error('Insufficient permissions');
     const expiry = Math.floor(Date.now() / 1000) + (minutes * 60);
-    const dTag = 'zellous-timeout:' + serverId + ':' + pubkey;
+    const dTag = dtag('timeout', serverId, pubkey);
     const signed = await this.auth.sign({
       kind: 30078, created_at: Math.floor(Date.now() / 1000),
       tags: [['d', dTag], ['server', serverId]],
@@ -43,7 +45,7 @@ export class Bans extends EventTarget {
     if (!this.auth?.isLoggedIn()) throw new Error('Not logged in');
     const signed = await this.auth.sign({
       kind: 30078, created_at: Math.floor(Date.now() / 1000),
-      tags: [['d', 'zellous-kick:' + pubkey]], content: ''
+      tags: [['d', dtag('kick', pubkey)]], content: ''
     });
     this.pool.publish(signed);
   }
@@ -61,13 +63,12 @@ export class Bans extends EventTarget {
         try {
           const dTag = event.tags.find(t => t[0] === 'd');
           if (!dTag?.[1]) return;
-          const parts = dTag[1].split(':');
-          const prefix = parts[0];
-          const pubkey = parts[parts.length - 1];
-          if (prefix !== 'zellous-ban' && prefix !== 'zellous-timeout') return;
+          const parsed = parseDtag(dTag[1]);
+          if (!parsed || (parsed.ns !== 'ban' && parsed.ns !== 'timeout')) return;
+          const pubkey = parsed.parts[parsed.parts.length - 1];
           const data = this.store.get(serverId) || { banned: [], timeouts: {} };
-          if (prefix === 'zellous-ban' && pubkey && !data.banned.includes(pubkey)) data.banned.push(pubkey);
-          else if (prefix === 'zellous-timeout' && pubkey) {
+          if (parsed.ns === 'ban' && pubkey && !data.banned.includes(pubkey)) data.banned.push(pubkey);
+          else if (parsed.ns === 'timeout' && pubkey) {
             const parsed = JSON.parse(event.content);
             if (parsed.expiry > Math.floor(Date.now() / 1000)) (data.timeouts = data.timeouts || {})[pubkey] = { expiry: parsed.expiry };
             else if (data.timeouts?.[pubkey]) delete data.timeouts[pubkey];

package/src/channels.js

@@ -1,3 +1,5 @@
+import { dtag } from './dtag.js';
+
 const DEFAULT_CATEGORIES = [
   { id: 'general', name: 'TEXT CHANNELS', position: 0 },
   { id: 'voice', name: 'VOICE CHANNELS', position: 1 }
@@ -23,7 +25,7 @@ export class Channels extends EventTarget {
     this.serverId = serverId;
     this.channels = []; this.categories = [];
     const ownerPubkey = serverId.split(':')[0];
-    const dTag = 'zellous-channels:' + serverId;
+    const dTag = dtag('channels', serverId);
     this.pool.subscribe('channels-' + serverId,
       [{ kinds: [30078], authors: [ownerPubkey], '#d': [dTag] }],
       (event) => {
@@ -53,7 +55,7 @@ export class Channels extends EventTarget {
     if (!this.isOwner()) return;
     const signed = await this.auth.sign({
       kind: 30078, created_at: Math.floor(Date.now() / 1000),
-      tags: [['d', 'zellous-channels:' + this.serverId]],
+      tags: [['d', dtag('channels', this.serverId)]],
       content: JSON.stringify({ channels: this.channels, categories: this.categories })
     });
     this.pool.publish(signed);

package/src/dtag.js

@@ -0,0 +1,14 @@
+const NAMESPACES = new Set(['ban', 'timeout', 'kick', 'page', 'channels', 'roles', 'settings']);
+
+export const dtag = (ns, ...parts) => {
+  if (!NAMESPACES.has(ns)) throw new Error('dtag: unknown namespace ' + ns);
+  return ['zellous-' + ns, ...parts].join(':');
+};
+
+export const parseDtag = (s) => {
+  if (typeof s !== 'string' || !s.startsWith('zellous-')) return null;
+  const parts = s.slice(8).split(':');
+  const ns = parts.shift();
+  if (!NAMESPACES.has(ns)) return null;
+  return { ns, parts };
+};

package/src/pages.js

@@ -1,26 +1,69 @@
-const stripTags = (html) => html
-  .replace(/<\s*(script|iframe|object|embed|form|input|button)\b[^>]*>[\s\S]*?<\s*\/\s*\1\s*>/gi, '')
-  .replace(/<\s*(script|iframe|object|embed|form|input|button)\b[^>]*\/?\s*>/gi, '')
-  .replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '')
-  .replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '')
-  .replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, '')
-  .replace(/(href|src)\s*=\s*"\s*javascript:[^"]*"/gi, '$1="#"')
-  .replace(/(href|src)\s*=\s*'\s*javascript:[^']*'/gi, "$1='#'");
+const ALLOWED_TAGS = new Set(['a','abbr','b','blockquote','br','code','div','em','h1','h2','h3','h4','h5','h6','hr','i','img','li','ol','p','pre','span','strong','sub','sup','table','tbody','td','th','thead','tr','u','ul']);
+const ALLOWED_ATTRS = { a: new Set(['href','title','rel','target']), img: new Set(['src','alt','title','width','height']), '*': new Set(['class','id']) };
+const SAFE_URL = /^(https?:|mailto:|#|\/)/i;
+
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;' }[c]));
+
+const sanitizeNoDom = (html) => {
+  let out = '';
+  let i = 0;
+  while (i < html.length) {
+    const lt = html.indexOf('<', i);
+    if (lt < 0) { out += escapeHtml(html.slice(i)); break; }
+    out += escapeHtml(html.slice(i, lt));
+    const gt = html.indexOf('>', lt);
+    if (gt < 0) { out += escapeHtml(html.slice(lt)); break; }
+    const raw = html.slice(lt + 1, gt);
+    const closing = raw.startsWith('/');
+    const body = closing ? raw.slice(1) : raw;
+    const m = body.match(/^([a-zA-Z][a-zA-Z0-9]*)/);
+    i = gt + 1;
+    if (!m) continue;
+    const tag = m[1].toLowerCase();
+    if (!ALLOWED_TAGS.has(tag)) continue;
+    if (closing) { out += '</' + tag + '>'; continue; }
+    const attrs = [];
+    const attrRe = /([a-zA-Z_:][a-zA-Z0-9_:.-]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/g;
+    let am;
+    const allowed = ALLOWED_ATTRS[tag] || new Set();
+    while ((am = attrRe.exec(body.slice(m[0].length))) !== null) {
+      const name = am[1].toLowerCase();
+      const value = am[3] ?? am[4] ?? am[5] ?? '';
+      if (/^on/.test(name)) continue;
+      if (!allowed.has(name) && !ALLOWED_ATTRS['*'].has(name)) continue;
+      if ((name === 'href' || name === 'src') && !SAFE_URL.test(value.trim())) continue;
+      attrs.push(name + '="' + escapeHtml(value) + '"');
+    }
+    out += '<' + tag + (attrs.length ? ' ' + attrs.join(' ') : '') + '>';
+  }
+  return out;
+};
 
 const sanitize = (html) => {
-  const stripped = stripTags(html);
-  if (typeof document === 'undefined') return stripped;
+  if (typeof document === 'undefined') return sanitizeNoDom(html || '');
   const el = document.createElement('div');
-  el.innerHTML = stripped;
-  el.querySelectorAll('script,iframe,object,embed,form,input,button').forEach(n => n.remove());
-  el.querySelectorAll('*').forEach(n => {
-    [...n.attributes].forEach(a => {
-      if (/^on/i.test(a.name) || (a.name === 'href' && /^javascript:/i.test(a.value)) || (a.name === 'src' && /^javascript:/i.test(a.value))) n.removeAttribute(a.name);
+  el.innerHTML = html || '';
+  const walk = (node) => {
+    [...node.childNodes].forEach(child => {
+      if (child.nodeType === 1) {
+        const tag = child.tagName.toLowerCase();
+        if (!ALLOWED_TAGS.has(tag)) { child.replaceWith(...child.childNodes); return; }
+        const allowed = ALLOWED_ATTRS[tag] || new Set();
+        [...child.attributes].forEach(a => {
+          const name = a.name.toLowerCase();
+          if (/^on/.test(name) || (!allowed.has(name) && !ALLOWED_ATTRS['*'].has(name))) child.removeAttribute(a.name);
+          else if ((name === 'href' || name === 'src') && !SAFE_URL.test(a.value.trim())) child.removeAttribute(a.name);
+        });
+        walk(child);
+      } else if (child.nodeType !== 3) child.remove();
     });
-  });
+  };
+  walk(el);
   return el.innerHTML;
 };
 
+import { dtag } from './dtag.js';
+
 export class Pages extends EventTarget {
   constructor({ relayPool, auth, roles }) {
     super();
@@ -29,7 +72,7 @@ export class Pages extends EventTarget {
     this.store = new Map(); this.subs = new Map();
   }
 
-  _key(serverId, slug) { return 'zellous-page:' + serverId + ':' + slug; }
+  _key(serverId, slug) { return dtag('page', serverId, slug); }
   getPages(serverId) { return Array.from((this.store.get(serverId) || new Map()).values()); }
 
   subscribe(serverId) {
@@ -43,7 +86,7 @@ export class Pages extends EventTarget {
       (event) => {
         if (event.pubkey !== creator) return;
         const dTag = (event.tags.find(t => t[0] === 'd') || [])[1] || '';
-        const prefix = 'zellous-page:' + serverId + ':';
+        const prefix = dtag('page', serverId) + ':';
         if (!dTag.startsWith(prefix)) return;
         const slug = dTag.slice(prefix.length); if (!slug) return;
         try {

package/src/relay-pool.js

@@ -11,12 +11,23 @@ const DEFAULT_RELAYS = [
   'wss://relay.0xchat.com'
 ];
 
-const trim = (set, max, keep) => {
-  if (set.size <= max) return set;
-  const arr = Array.from(set);
-  return new Set(arr.slice(arr.length - keep));
+const SEEN_MAX = 10000;
+
+const lruTouch = (map, key) => {
+  if (map.has(key)) { map.delete(key); map.set(key, 1); return false; }
+  map.set(key, 1);
+  if (map.size > SEEN_MAX) { const first = map.keys().next().value; map.delete(first); }
+  return true;
+};
+
+const fnv1a = (s) => {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0; }
+  return h.toString(16).padStart(8, '0');
 };
 
+const safeSubId = (subId) => subId.length <= 64 ? subId : subId.slice(0, 55) + '-' + fnv1a(subId);
+
 export class RelayPool extends EventTarget {
   constructor({ relays = DEFAULT_RELAYS, verifyEvent = null, WebSocketImpl = null } = {}) {
     super();
@@ -24,7 +35,7 @@ export class RelayPool extends EventTarget {
     this.relays = new Map();
     this.subs = new Map();
     this.pending = [];
-    this.seen = new Set();
+    this.seen = new Map();
     this.verifyEvent = verifyEvent;
     this.WS = WebSocketImpl || (typeof WebSocket !== 'undefined' ? WebSocket : null);
     if (!this.WS) throw new Error('No WebSocket implementation available');
@@ -99,8 +110,7 @@ export class RelayPool extends EventTarget {
       if (this.verifyEvent) {
         try { if (!this.verifyEvent(event)) return; } catch { return; }
       }
-      this.seen.add(event.id);
-      this.seen = trim(this.seen, 10000, 5000);
+      lruTouch(this.seen, event.id);
       const sub = this.subs.get(subId);
       sub?.onEvent?.(event);
       this._emit('event', { subId, event });
@@ -115,7 +125,7 @@ export class RelayPool extends EventTarget {
   }
 
   subscribe(subId, filters, onEvent, onEose) {
-    subId = subId.length > 64 ? subId.slice(0, 64) : subId;
+    subId = safeSubId(subId);
     this.subs.set(subId, { filters, onEvent, onEose });
     for (const [, relay] of this.relays) {
       if (relay.ws?.readyState === 1) {
@@ -128,7 +138,7 @@ export class RelayPool extends EventTarget {
   }
 
   unsubscribe(subId) {
-    subId = subId.length > 64 ? subId.slice(0, 64) : subId;
+    subId = safeSubId(subId);
     for (const [, relay] of this.relays) {
       if (relay.ws?.readyState === 1 && relay.subIds.has(subId)) {
         relay.ws.send(JSON.stringify(['CLOSE', subId]));

package/src/roles.js

@@ -1,3 +1,5 @@
+import { dtag } from './dtag.js';
+
 export class Roles extends EventTarget {
   constructor({ relayPool, auth }) {
     super();
@@ -31,7 +33,7 @@ export class Roles extends EventTarget {
     else if (role === 'moderator') mods = [...mods, targetPubkey];
     const next = { admins, mods };
     this.store.set(serverId, next);
-    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', 'zellous-roles:' + serverId]], content: JSON.stringify(next) });
+    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', dtag('roles', serverId)]], content: JSON.stringify(next) });
     this.pool.publish(signed);
     this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, next } }));
   }
@@ -43,7 +45,7 @@ export class Roles extends EventTarget {
     if (!creator) return;
     this.sub = 'roles-' + serverId;
     this.pool.subscribe(this.sub,
-      [{ kinds: [30078], authors: [creator], '#d': ['zellous-roles:' + serverId] }],
+      [{ kinds: [30078], authors: [creator], '#d': [dtag('roles', serverId)] }],
       (event) => {
         if (event.pubkey !== creator) return;
         try {

package/src/settings.js

@@ -1,3 +1,5 @@
+import { dtag } from './dtag.js';
+
 const VALID_BITRATES = [8000, 16000, 24000, 48000, 96000];
 const clampBitrate = (v) => VALID_BITRATES.reduce((prev, cur) => Math.abs(cur - v) < Math.abs(prev - v) ? cur : prev);
 
@@ -18,7 +20,7 @@ export class Settings extends EventTarget {
     const existing = this.store.get(serverId) || {};
     const next = { ...existing, opusBitrate: clamped };
     this.store.set(serverId, next);
-    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', 'zellous-settings:' + serverId]], content: JSON.stringify(next) });
+    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', dtag('settings', serverId)]], content: JSON.stringify(next) });
     this.pool.publish(signed);
     this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, next } }));
     return clamped;
@@ -36,7 +38,7 @@ export class Settings extends EventTarget {
     const existing = this.store.get(serverId) || {};
     const next = { ...existing, embedAllowlist: domains };
     this.store.set(serverId, next);
-    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', 'zellous-settings:' + serverId]], content: JSON.stringify(next) });
+    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', dtag('settings', serverId)]], content: JSON.stringify(next) });
     this.pool.publish(signed);
     this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, next } }));
     return domains;
@@ -61,7 +63,7 @@ export class Settings extends EventTarget {
     if (!creator) return;
     this.sub = 'settings-' + serverId;
     this.pool.subscribe(this.sub,
-      [{ kinds: [30078], authors: [creator], '#d': ['zellous-settings:' + serverId] }],
+      [{ kinds: [30078], authors: [creator], '#d': [dtag('settings', serverId)] }],
       (event) => {
         if (event.pubkey !== creator) return;
         try { this.store.set(serverId, JSON.parse(event.content)); this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, next: this.store.get(serverId) } })); } catch {}