notes

1.2 KB

1. // lib/api-helpers.hl — what lib/api.hl looks up (notes mission 002, code order): the JSON answer, the field type
2. // checks and the login button's `?next=` check.
3. import { Response } from 'hl:http1'
5. static apiHeaders = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' }
6. static reply = (status, value) => { return new Response(JSON.stringify(value), { status = status headers = apiHeaders }) }
7. static isText = (v) => { return v != null && hlTypeName(v) == 'String' }
8. static isTime = (v) => { return v != null && hlTypeName(v) == 'Number' && v >= 0 }
10. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
11. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
12. static nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
13. static safePath = (want) => {
14. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
15. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
16. let i = 0
17. while (i < want.length) {
18. if (!nextChars.includes(want[i])) { return '/' }
19. i = i + 1
20. }
21. return want
22. }