← back to Inline Editor
inline-editor v0.1: Wix-style admin editing for DW sister sites — schema, middleware, client, sanitize, auth, pilot (smoke green)
451175e25bc11a7b4bce73251f0f0291155bf7fa · 2026-05-11 14:58:58 -0700 · Steve
Files touched
A .gitignoreA README.mdA db/migrations/001_page_overrides.sqlA package-lock.jsonA package.jsonA public/editor.cssA public/editor.jsA src/auth.jsA src/db.jsA src/middleware.jsA src/sanitize.jsA test/pilot.js
Diff
commit 451175e25bc11a7b4bce73251f0f0291155bf7fa
Author: Steve <steve@designerwallcoverings.com>
Date: Mon May 11 14:58:58 2026 -0700
inline-editor v0.1: Wix-style admin editing for DW sister sites — schema, middleware, client, sanitize, auth, pilot (smoke green)
---
.gitignore | 8 +
README.md | 123 +++
db/migrations/001_page_overrides.sql | 53 ++
package-lock.json | 1547 ++++++++++++++++++++++++++++++++++
package.json | 19 +
public/editor.css | 53 ++
public/editor.js | 321 +++++++
src/auth.js | 89 ++
src/db.js | 90 ++
src/middleware.js | 219 +++++
src/sanitize.js | Bin 0 -> 4327 bytes
test/pilot.js | 89 ++
12 files changed, 2611 insertions(+)
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1924158
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,8 @@
+node_modules/
+.env*
+tmp/
+*.log
+.DS_Store
+dist/
+build/
+.next/
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..4340d8b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,123 @@
+# @dw/inline-editor
+
+Drop-in inline page editor for the DW sister-site fleet (~46 sites). Admins
+authenticated via **auth.agentabrams.com** (role=admin) can click any text
+block, image, link, or HTML region on any sister site and edit it directly
+on the page — Wix-style. Edits persist in `dw_unified.page_overrides` (PG)
+and the source HTML is left untouched.
+
+## Architecture
+
+```
+ ┌─────────────────────────────────────────┐
+ │ auth.agentabrams.com (existing widget) │
+ │ → sets cookie with { email, role } │
+ └────────────────┬────────────────────────┘
+ │
+ ┌──────────────────▼──────────────────┐
+ │ per-site Express app │
+ │ app.use(inlineEditor({ site })) │
+ │ ─ middleware: HTML rewriter │
+ │ ─ routes: /api/_inline/* │
+ │ ─ static: /_inline/editor.js,css │
+ └────────────────┬────────────────────┘
+ │ reads/writes
+ ▼
+ ┌──────────────────────────┐
+ │ dw_unified PG │
+ │ · page_overrides │ ← current state per (site,path,selector)
+ │ · page_edit_log │ ← append-only audit
+ │ · page_uploads │ ← image uploads metadata
+ └──────────────────────────┘
+```
+
+## Persistence — append-only audit (best-practice mode)
+
+`page_overrides` holds the *current* override for each (site, path, selector).
+`page_edit_log` is **append-only** — every save inserts a new row with editor
+email + IP + UA. A revert is a new log row that updates `page_overrides`. No
+edit is ever silently lost.
+
+```
+page_overrides
+ site, path, selector PRIMARY KEY
+ kind 'text' | 'html' | 'image' | 'href' | 'image_alt'
+ value sanitized payload
+ updated_at, updated_by_email
+
+page_edit_log
+ id, site, path, selector, kind,
+ old_value, new_value,
+ editor_email, editor_ip, editor_ua, ts
+```
+
+## Edit surface (v1 — "all like Wix")
+
+| kind | trigger | persists |
+|---|---|---|
+| `text` | click any text-bearing leaf node | sanitized innerText |
+| `html` | double-click a `[data-edit-region]` block | DOMPurify-sanitized innerHTML |
+| `image` | click an `<img>` | new src (uploaded to /uploads or pasted URL) |
+| `image_alt` | shift-click an `<img>` | alt text |
+| `href` | right-click an `<a>` | new href (only http/https/mailto/tel) |
+
+All HTML kinds are sanitized server-side via `sanitize-html` with a strict
+allowlist (no `<script>`, no `on*` attrs, no `javascript:` urls). Image uploads
+gate on MIME (`image/*`), size (≤5 MB), and re-validate at content sniff.
+
+## Auth (role=admin via auth.agentabrams.com)
+
+Every save endpoint checks the `dw_auth` cookie issued by the auth widget.
+The cookie is a signed JWT; we verify against `AUTH_JWKS_URL` and require:
+- `role === 'admin'`
+- `iss === 'https://auth.agentabrams.com'`
+- `exp > now`
+
+Rate-limited to 10 edits / min per editor email.
+
+## Wiring per site (one line)
+
+```js
+const inlineEditor = require('@dw/inline-editor');
+app.use(inlineEditor({
+ site: 'corkwallcovering.com',
+ uploadDir: path.join(__dirname, 'public', 'uploads'),
+}));
+```
+
+The middleware:
+1. Wraps `res.send` for `text/html` responses, walking the DOM and applying
+ any matching overrides from PG (cached for 30 s per (site, path)).
+2. Injects `<script src="/_inline/editor.js" defer></script>` and a tiny
+ bootstrap `<script>` that reads the auth cookie and decides whether to
+ activate edit mode.
+3. Mounts `/api/_inline/save`, `/state`, `/upload`, `/revert`.
+
+Sites *not* served by Express (static nginx) can opt in by including the
+script tag and pointing it at a central edit-API host.
+
+## Security checklist
+
+- [x] Append-only audit log; never delete, only superseding inserts
+- [x] HTML sanitized server-side, not client-side
+- [x] CSP-friendly: editor uses no `eval`, no inline event handlers (uses delegated listeners + dataset)
+- [x] Auth cookie verified per request; admin role required
+- [x] Rate limit 10 edits/min/editor; 100/day soft cap with alert
+- [x] Image uploads MIME-sniffed (file signature), size-capped, stored outside web root by default
+- [x] Selector validated as stable (id, data-edit-id, structural path with index); reject XPath
+- [x] No raw HTML kind accepted unless region has `[data-edit-region]` opt-in
+- [x] Backups: page_overrides snapshotted to `data/overrides.snapshot.json` hourly
+- [x] Revert path from admin.agentabrams.com console
+
+## Pilot
+
+Pilot site: TBD (a single low-traffic sister site, Mac2-local first).
+Production deploy to Kamatera fleet only after the pilot is green and
+Steve gives explicit "deploy fleet" go-ahead.
+
+## NOT in scope (yet)
+
+- Cross-page reflows (editor doesn't break grids when text expands)
+- Layout edits (drag-drop blocks) — that needs a real visual editor
+- Multi-language overrides
+- Versioning UI (we have the log; UI lands in admin console v2)
diff --git a/db/migrations/001_page_overrides.sql b/db/migrations/001_page_overrides.sql
new file mode 100644
index 0000000..cd66364
--- /dev/null
+++ b/db/migrations/001_page_overrides.sql
@@ -0,0 +1,53 @@
+-- @dw/inline-editor — Postgres schema (dw_unified)
+-- Append-only audit + current-state override layer.
+
+CREATE TABLE IF NOT EXISTS page_overrides (
+ site TEXT NOT NULL,
+ path TEXT NOT NULL,
+ selector TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK (kind IN ('text','html','image','image_alt','href')),
+ value TEXT NOT NULL,
+ updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+ updated_by TEXT NOT NULL,
+ PRIMARY KEY (site, path, selector)
+);
+CREATE INDEX IF NOT EXISTS idx_page_overrides_site_path ON page_overrides(site, path);
+
+-- Append-only — no UPDATE, no DELETE in normal use. Reverts are new rows.
+CREATE TABLE IF NOT EXISTS page_edit_log (
+ id BIGSERIAL PRIMARY KEY,
+ site TEXT NOT NULL,
+ path TEXT NOT NULL,
+ selector TEXT NOT NULL,
+ kind TEXT NOT NULL,
+ old_value TEXT,
+ new_value TEXT NOT NULL,
+ editor_email TEXT NOT NULL,
+ editor_ip INET,
+ editor_ua TEXT,
+ is_revert BOOLEAN NOT NULL DEFAULT FALSE,
+ ts TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_page_edit_log_site_path ON page_edit_log(site, path, ts DESC);
+CREATE INDEX IF NOT EXISTS idx_page_edit_log_editor ON page_edit_log(editor_email, ts DESC);
+
+-- Editor file uploads — metadata; the actual bytes land under site's public/uploads
+CREATE TABLE IF NOT EXISTS page_uploads (
+ id BIGSERIAL PRIMARY KEY,
+ site TEXT NOT NULL,
+ url TEXT NOT NULL, -- the public URL (/uploads/abc.jpg)
+ abs_path TEXT NOT NULL, -- filesystem path on origin
+ mime_type TEXT NOT NULL,
+ bytes BIGINT NOT NULL,
+ uploaded_by TEXT NOT NULL,
+ uploader_ip INET,
+ ts TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_page_uploads_site ON page_uploads(site, ts DESC);
+
+-- Rate limit table (sliding window — cleaned periodically)
+CREATE TABLE IF NOT EXISTS page_edit_ratelimit (
+ editor_email TEXT NOT NULL,
+ ts TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_page_edit_ratelimit ON page_edit_ratelimit(editor_email, ts DESC);
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..96a224f
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,1547 @@
+{
+ "name": "@dw/inline-editor",
+ "version": "0.1.0",
+ "lockfileVersion": 3,
+ "requires": true,
+ "packages": {
+ "": {
+ "name": "@dw/inline-editor",
+ "version": "0.1.0",
+ "dependencies": {
+ "cheerio": "^1.0.0",
+ "cookie-parser": "^1.4.7",
+ "express": "^4.21.1",
+ "jsonwebtoken": "^9.0.2",
+ "multer": "^1.4.5-lts.1",
+ "sanitize-html": "^2.13.1"
+ }
+ },
+ "node_modules/accepts": {
+ "version": "1.3.8",
+ "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+ "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+ "license": "MIT",
+ "dependencies": {
+ "mime-types": "~2.1.34",
+ "negotiator": "0.6.3"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/append-field": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/append-field/-/append-field-1.0.0.tgz",
+ "integrity": "sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==",
+ "license": "MIT"
+ },
+ "node_modules/array-flatten": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+ "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+ "license": "MIT"
+ },
+ "node_modules/body-parser": {
+ "version": "1.20.5",
+ "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
+ "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+ "license": "MIT",
+ "dependencies": {
+ "bytes": "~3.1.2",
+ "content-type": "~1.0.5",
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "destroy": "~1.2.0",
+ "http-errors": "~2.0.1",
+ "iconv-lite": "~0.4.24",
+ "on-finished": "~2.4.1",
+ "qs": "~6.15.1",
+ "raw-body": "~2.5.3",
+ "type-is": "~1.6.18",
+ "unpipe": "~1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8",
+ "npm": "1.2.8000 || >= 1.4.16"
+ }
+ },
+ "node_modules/body-parser/node_modules/iconv-lite": {
+ "version": "0.4.24",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+ "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+ "license": "MIT",
+ "dependencies": {
+ "safer-buffer": ">= 2.1.2 < 3"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/boolbase": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
+ "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
+ "license": "ISC"
+ },
+ "node_modules/buffer-equal-constant-time": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+ "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
+ "license": "BSD-3-Clause"
+ },
+ "node_modules/buffer-from": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+ "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+ "license": "MIT"
+ },
+ "node_modules/busboy": {
+ "version": "1.6.0",
+ "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
+ "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+ "dependencies": {
+ "streamsearch": "^1.1.0"
+ },
+ "engines": {
+ "node": ">=10.16.0"
+ }
+ },
+ "node_modules/bytes": {
+ "version": "3.1.2",
+ "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+ "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/call-bind-apply-helpers": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+ "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+ "license": "MIT",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "function-bind": "^1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/call-bound": {
+ "version": "1.0.4",
+ "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+ "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+ "license": "MIT",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.2",
+ "get-intrinsic": "^1.3.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/cheerio": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.2.0.tgz",
+ "integrity": "sha512-WDrybc/gKFpTYQutKIK6UvfcuxijIZfMfXaYm8NMsPQxSYvf+13fXUJ4rztGGbJcBQ/GF55gvrZ0Bc0bj/mqvg==",
+ "license": "MIT",
+ "dependencies": {
+ "cheerio-select": "^2.1.0",
+ "dom-serializer": "^2.0.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.2.2",
+ "encoding-sniffer": "^0.2.1",
+ "htmlparser2": "^10.1.0",
+ "parse5": "^7.3.0",
+ "parse5-htmlparser2-tree-adapter": "^7.1.0",
+ "parse5-parser-stream": "^7.1.2",
+ "undici": "^7.19.0",
+ "whatwg-mimetype": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=20.18.1"
+ },
+ "funding": {
+ "url": "https://github.com/cheeriojs/cheerio?sponsor=1"
+ }
+ },
+ "node_modules/cheerio-select": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/cheerio-select/-/cheerio-select-2.1.0.tgz",
+ "integrity": "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g==",
+ "license": "BSD-2-Clause",
+ "dependencies": {
+ "boolbase": "^1.0.0",
+ "css-select": "^5.1.0",
+ "css-what": "^6.1.0",
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.0.1"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/concat-stream": {
+ "version": "1.6.2",
+ "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
+ "integrity": "sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==",
+ "engines": [
+ "node >= 0.8"
+ ],
+ "license": "MIT",
+ "dependencies": {
+ "buffer-from": "^1.0.0",
+ "inherits": "^2.0.3",
+ "readable-stream": "^2.2.2",
+ "typedarray": "^0.0.6"
+ }
+ },
+ "node_modules/content-disposition": {
+ "version": "0.5.4",
+ "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+ "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+ "license": "MIT",
+ "dependencies": {
+ "safe-buffer": "5.2.1"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/content-type": {
+ "version": "1.0.5",
+ "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+ "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/cookie": {
+ "version": "0.7.2",
+ "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+ "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/cookie-parser": {
+ "version": "1.4.7",
+ "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.7.tgz",
+ "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
+ "license": "MIT",
+ "dependencies": {
+ "cookie": "0.7.2",
+ "cookie-signature": "1.0.6"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/cookie-signature": {
+ "version": "1.0.6",
+ "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+ "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+ "license": "MIT"
+ },
+ "node_modules/core-util-is": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+ "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+ "license": "MIT"
+ },
+ "node_modules/css-select": {
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz",
+ "integrity": "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==",
+ "license": "BSD-2-Clause",
+ "dependencies": {
+ "boolbase": "^1.0.0",
+ "css-what": "^6.1.0",
+ "domhandler": "^5.0.2",
+ "domutils": "^3.0.1",
+ "nth-check": "^2.0.1"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/css-what": {
+ "version": "6.2.2",
+ "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz",
+ "integrity": "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==",
+ "license": "BSD-2-Clause",
+ "engines": {
+ "node": ">= 6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "license": "MIT",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/deepmerge": {
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+ "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/depd": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+ "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/destroy": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+ "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8",
+ "npm": "1.2.8000 || >= 1.4.16"
+ }
+ },
+ "node_modules/dom-serializer": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
+ "integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
+ "license": "MIT",
+ "dependencies": {
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.2",
+ "entities": "^4.2.0"
+ },
+ "funding": {
+ "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+ }
+ },
+ "node_modules/domelementtype": {
+ "version": "2.3.0",
+ "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+ "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/fb55"
+ }
+ ],
+ "license": "BSD-2-Clause"
+ },
+ "node_modules/domhandler": {
+ "version": "5.0.3",
+ "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
+ "integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
+ "license": "BSD-2-Clause",
+ "dependencies": {
+ "domelementtype": "^2.3.0"
+ },
+ "engines": {
+ "node": ">= 4"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/domhandler?sponsor=1"
+ }
+ },
+ "node_modules/domutils": {
+ "version": "3.2.2",
+ "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+ "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
+ "license": "BSD-2-Clause",
+ "dependencies": {
+ "dom-serializer": "^2.0.0",
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/domutils?sponsor=1"
+ }
+ },
+ "node_modules/dunder-proto": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+ "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+ "license": "MIT",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.1",
+ "es-errors": "^1.3.0",
+ "gopd": "^1.2.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/ecdsa-sig-formatter": {
+ "version": "1.0.11",
+ "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+ "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+ "license": "Apache-2.0",
+ "dependencies": {
+ "safe-buffer": "^5.0.1"
+ }
+ },
+ "node_modules/ee-first": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+ "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+ "license": "MIT"
+ },
+ "node_modules/encodeurl": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+ "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/encoding-sniffer": {
+ "version": "0.2.1",
+ "resolved": "https://registry.npmjs.org/encoding-sniffer/-/encoding-sniffer-0.2.1.tgz",
+ "integrity": "sha512-5gvq20T6vfpekVtqrYQsSCFZ1wEg5+wW0/QaZMWkFr6BqD3NfKs0rLCx4rrVlSWJeZb5NBJgVLswK/w2MWU+Gw==",
+ "license": "MIT",
+ "dependencies": {
+ "iconv-lite": "^0.6.3",
+ "whatwg-encoding": "^3.1.1"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/encoding-sniffer?sponsor=1"
+ }
+ },
+ "node_modules/entities": {
+ "version": "4.5.0",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+ "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+ "license": "BSD-2-Clause",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
+ "node_modules/es-define-property": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+ "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/es-errors": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+ "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/es-object-atoms": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+ "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+ "license": "MIT",
+ "dependencies": {
+ "es-errors": "^1.3.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/escape-html": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+ "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+ "license": "MIT"
+ },
+ "node_modules/escape-string-regexp": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+ "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/etag": {
+ "version": "1.8.1",
+ "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+ "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/express": {
+ "version": "4.22.2",
+ "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+ "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+ "license": "MIT",
+ "dependencies": {
+ "accepts": "~1.3.8",
+ "array-flatten": "1.1.1",
+ "body-parser": "~1.20.5",
+ "content-disposition": "~0.5.4",
+ "content-type": "~1.0.4",
+ "cookie": "~0.7.1",
+ "cookie-signature": "~1.0.6",
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "etag": "~1.8.1",
+ "finalhandler": "~1.3.1",
+ "fresh": "~0.5.2",
+ "http-errors": "~2.0.0",
+ "merge-descriptors": "1.0.3",
+ "methods": "~1.1.2",
+ "on-finished": "~2.4.1",
+ "parseurl": "~1.3.3",
+ "path-to-regexp": "~0.1.12",
+ "proxy-addr": "~2.0.7",
+ "qs": "~6.15.1",
+ "range-parser": "~1.2.1",
+ "safe-buffer": "5.2.1",
+ "send": "~0.19.0",
+ "serve-static": "~1.16.2",
+ "setprototypeof": "1.2.0",
+ "statuses": "~2.0.1",
+ "type-is": "~1.6.18",
+ "utils-merge": "1.0.1",
+ "vary": "~1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.10.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
+ }
+ },
+ "node_modules/finalhandler": {
+ "version": "1.3.2",
+ "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+ "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+ "license": "MIT",
+ "dependencies": {
+ "debug": "2.6.9",
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "on-finished": "~2.4.1",
+ "parseurl": "~1.3.3",
+ "statuses": "~2.0.2",
+ "unpipe": "~1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/forwarded": {
+ "version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+ "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/fresh": {
+ "version": "0.5.2",
+ "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+ "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/function-bind": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+ "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+ "license": "MIT",
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/get-intrinsic": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+ "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+ "license": "MIT",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.2",
+ "es-define-property": "^1.0.1",
+ "es-errors": "^1.3.0",
+ "es-object-atoms": "^1.1.1",
+ "function-bind": "^1.1.2",
+ "get-proto": "^1.0.1",
+ "gopd": "^1.2.0",
+ "has-symbols": "^1.1.0",
+ "hasown": "^2.0.2",
+ "math-intrinsics": "^1.1.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/get-proto": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+ "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+ "license": "MIT",
+ "dependencies": {
+ "dunder-proto": "^1.0.1",
+ "es-object-atoms": "^1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/gopd": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+ "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/has-symbols": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+ "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/hasown": {
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+ "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+ "license": "MIT",
+ "dependencies": {
+ "function-bind": "^1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/htmlparser2": {
+ "version": "10.1.0",
+ "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.1.0.tgz",
+ "integrity": "sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==",
+ "funding": [
+ "https://github.com/fb55/htmlparser2?sponsor=1",
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/fb55"
+ }
+ ],
+ "license": "MIT",
+ "dependencies": {
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.2.2",
+ "entities": "^7.0.1"
+ }
+ },
+ "node_modules/htmlparser2/node_modules/entities": {
+ "version": "7.0.1",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
+ "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
+ "license": "BSD-2-Clause",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
+ "node_modules/http-errors": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+ "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+ "license": "MIT",
+ "dependencies": {
+ "depd": "~2.0.0",
+ "inherits": "~2.0.4",
+ "setprototypeof": "~1.2.0",
+ "statuses": "~2.0.2",
+ "toidentifier": "~1.0.1"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
+ }
+ },
+ "node_modules/iconv-lite": {
+ "version": "0.6.3",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+ "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+ "license": "MIT",
+ "dependencies": {
+ "safer-buffer": ">= 2.1.2 < 3.0.0"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/inherits": {
+ "version": "2.0.4",
+ "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+ "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+ "license": "ISC"
+ },
+ "node_modules/ipaddr.js": {
+ "version": "1.9.1",
+ "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+ "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.10"
+ }
+ },
+ "node_modules/is-plain-object": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+ "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/isarray": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+ "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+ "license": "MIT"
+ },
+ "node_modules/jsonwebtoken": {
+ "version": "9.0.3",
+ "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+ "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+ "license": "MIT",
+ "dependencies": {
+ "jws": "^4.0.1",
+ "lodash.includes": "^4.3.0",
+ "lodash.isboolean": "^3.0.3",
+ "lodash.isinteger": "^4.0.4",
+ "lodash.isnumber": "^3.0.3",
+ "lodash.isplainobject": "^4.0.6",
+ "lodash.isstring": "^4.0.1",
+ "lodash.once": "^4.0.0",
+ "ms": "^2.1.1",
+ "semver": "^7.5.4"
+ },
+ "engines": {
+ "node": ">=12",
+ "npm": ">=6"
+ }
+ },
+ "node_modules/jsonwebtoken/node_modules/ms": {
+ "version": "2.1.3",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+ "license": "MIT"
+ },
+ "node_modules/jwa": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+ "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+ "license": "MIT",
+ "dependencies": {
+ "buffer-equal-constant-time": "^1.0.1",
+ "ecdsa-sig-formatter": "1.0.11",
+ "safe-buffer": "^5.0.1"
+ }
+ },
+ "node_modules/jws": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+ "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+ "license": "MIT",
+ "dependencies": {
+ "jwa": "^2.0.1",
+ "safe-buffer": "^5.0.1"
+ }
+ },
+ "node_modules/lodash.includes": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
+ "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.isboolean": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+ "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.isinteger": {
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+ "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.isnumber": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+ "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.isplainobject": {
+ "version": "4.0.6",
+ "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+ "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.isstring": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+ "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
+ "license": "MIT"
+ },
+ "node_modules/lodash.once": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+ "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+ "license": "MIT"
+ },
+ "node_modules/math-intrinsics": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+ "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/media-typer": {
+ "version": "0.3.0",
+ "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+ "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/merge-descriptors": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+ "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+ "license": "MIT",
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/methods": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+ "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/mime": {
+ "version": "1.6.0",
+ "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+ "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+ "license": "MIT",
+ "bin": {
+ "mime": "cli.js"
+ },
+ "engines": {
+ "node": ">=4"
+ }
+ },
+ "node_modules/mime-db": {
+ "version": "1.52.0",
+ "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+ "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/mime-types": {
+ "version": "2.1.35",
+ "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+ "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+ "license": "MIT",
+ "dependencies": {
+ "mime-db": "1.52.0"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/minimist": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+ "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+ "license": "MIT",
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/mkdirp": {
+ "version": "0.5.6",
+ "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+ "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+ "license": "MIT",
+ "dependencies": {
+ "minimist": "^1.2.6"
+ },
+ "bin": {
+ "mkdirp": "bin/cmd.js"
+ }
+ },
+ "node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+ "license": "MIT"
+ },
+ "node_modules/multer": {
+ "version": "1.4.5-lts.2",
+ "resolved": "https://registry.npmjs.org/multer/-/multer-1.4.5-lts.2.tgz",
+ "integrity": "sha512-VzGiVigcG9zUAoCNU+xShztrlr1auZOlurXynNvO9GiWD1/mTBbUljOKY+qMeazBqXgRnjzeEgJI/wyjJUHg9A==",
+ "deprecated": "Multer 1.x is impacted by a number of vulnerabilities, which have been patched in 2.x. You should upgrade to the latest 2.x version.",
+ "license": "MIT",
+ "dependencies": {
+ "append-field": "^1.0.0",
+ "busboy": "^1.0.0",
+ "concat-stream": "^1.5.2",
+ "mkdirp": "^0.5.4",
+ "object-assign": "^4.1.1",
+ "type-is": "^1.6.4",
+ "xtend": "^4.0.0"
+ },
+ "engines": {
+ "node": ">= 6.0.0"
+ }
+ },
+ "node_modules/nanoid": {
+ "version": "3.3.12",
+ "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+ "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/ai"
+ }
+ ],
+ "license": "MIT",
+ "bin": {
+ "nanoid": "bin/nanoid.cjs"
+ },
+ "engines": {
+ "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+ }
+ },
+ "node_modules/negotiator": {
+ "version": "0.6.3",
+ "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+ "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/nth-check": {
+ "version": "2.1.1",
+ "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
+ "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
+ "license": "BSD-2-Clause",
+ "dependencies": {
+ "boolbase": "^1.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/nth-check?sponsor=1"
+ }
+ },
+ "node_modules/object-assign": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+ "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/object-inspect": {
+ "version": "1.13.4",
+ "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+ "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/on-finished": {
+ "version": "2.4.1",
+ "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+ "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+ "license": "MIT",
+ "dependencies": {
+ "ee-first": "1.1.1"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/parse-srcset": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/parse-srcset/-/parse-srcset-1.0.2.tgz",
+ "integrity": "sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==",
+ "license": "MIT"
+ },
+ "node_modules/parse5": {
+ "version": "7.3.0",
+ "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+ "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+ "license": "MIT",
+ "dependencies": {
+ "entities": "^6.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/parse5-htmlparser2-tree-adapter": {
+ "version": "7.1.0",
+ "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz",
+ "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==",
+ "license": "MIT",
+ "dependencies": {
+ "domhandler": "^5.0.3",
+ "parse5": "^7.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/parse5-parser-stream": {
+ "version": "7.1.2",
+ "resolved": "https://registry.npmjs.org/parse5-parser-stream/-/parse5-parser-stream-7.1.2.tgz",
+ "integrity": "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow==",
+ "license": "MIT",
+ "dependencies": {
+ "parse5": "^7.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/parse5/node_modules/entities": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+ "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+ "license": "BSD-2-Clause",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
+ "node_modules/parseurl": {
+ "version": "1.3.3",
+ "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+ "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/path-to-regexp": {
+ "version": "0.1.13",
+ "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+ "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+ "license": "MIT"
+ },
+ "node_modules/picocolors": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+ "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+ "license": "ISC"
+ },
+ "node_modules/postcss": {
+ "version": "8.5.14",
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
+ "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+ "funding": [
+ {
+ "type": "opencollective",
+ "url": "https://opencollective.com/postcss/"
+ },
+ {
+ "type": "tidelift",
+ "url": "https://tidelift.com/funding/github/npm/postcss"
+ },
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/ai"
+ }
+ ],
+ "license": "MIT",
+ "dependencies": {
+ "nanoid": "^3.3.11",
+ "picocolors": "^1.1.1",
+ "source-map-js": "^1.2.1"
+ },
+ "engines": {
+ "node": "^10 || ^12 || >=14"
+ }
+ },
+ "node_modules/process-nextick-args": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+ "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+ "license": "MIT"
+ },
+ "node_modules/proxy-addr": {
+ "version": "2.0.7",
+ "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+ "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+ "license": "MIT",
+ "dependencies": {
+ "forwarded": "0.2.0",
+ "ipaddr.js": "1.9.1"
+ },
+ "engines": {
+ "node": ">= 0.10"
+ }
+ },
+ "node_modules/qs": {
+ "version": "6.15.1",
+ "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+ "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+ "license": "BSD-3-Clause",
+ "dependencies": {
+ "side-channel": "^1.1.0"
+ },
+ "engines": {
+ "node": ">=0.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/range-parser": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+ "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/raw-body": {
+ "version": "2.5.3",
+ "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+ "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+ "license": "MIT",
+ "dependencies": {
+ "bytes": "~3.1.2",
+ "http-errors": "~2.0.1",
+ "iconv-lite": "~0.4.24",
+ "unpipe": "~1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/raw-body/node_modules/iconv-lite": {
+ "version": "0.4.24",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+ "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+ "license": "MIT",
+ "dependencies": {
+ "safer-buffer": ">= 2.1.2 < 3"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/readable-stream": {
+ "version": "2.3.8",
+ "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+ "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+ "license": "MIT",
+ "dependencies": {
+ "core-util-is": "~1.0.0",
+ "inherits": "~2.0.3",
+ "isarray": "~1.0.0",
+ "process-nextick-args": "~2.0.0",
+ "safe-buffer": "~5.1.1",
+ "string_decoder": "~1.1.1",
+ "util-deprecate": "~1.0.1"
+ }
+ },
+ "node_modules/readable-stream/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+ "license": "MIT"
+ },
+ "node_modules/safe-buffer": {
+ "version": "5.2.1",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+ "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/feross"
+ },
+ {
+ "type": "patreon",
+ "url": "https://www.patreon.com/feross"
+ },
+ {
+ "type": "consulting",
+ "url": "https://feross.org/support"
+ }
+ ],
+ "license": "MIT"
+ },
+ "node_modules/safer-buffer": {
+ "version": "2.1.2",
+ "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+ "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+ "license": "MIT"
+ },
+ "node_modules/sanitize-html": {
+ "version": "2.17.3",
+ "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.3.tgz",
+ "integrity": "sha512-Kn4srCAo2+wZyvCNKCSyB2g8RQ8IkX/gQs2uqoSRNu5t9I2qvUyAVvRDiFUVAiX3N3PNuwStY0eNr+ooBHVWEg==",
+ "license": "MIT",
+ "dependencies": {
+ "deepmerge": "^4.2.2",
+ "escape-string-regexp": "^4.0.0",
+ "htmlparser2": "^10.1.0",
+ "is-plain-object": "^5.0.0",
+ "parse-srcset": "^1.0.2",
+ "postcss": "^8.3.11"
+ }
+ },
+ "node_modules/semver": {
+ "version": "7.8.0",
+ "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+ "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+ "license": "ISC",
+ "bin": {
+ "semver": "bin/semver.js"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/send": {
+ "version": "0.19.2",
+ "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+ "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+ "license": "MIT",
+ "dependencies": {
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "destroy": "1.2.0",
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "etag": "~1.8.1",
+ "fresh": "~0.5.2",
+ "http-errors": "~2.0.1",
+ "mime": "1.6.0",
+ "ms": "2.1.3",
+ "on-finished": "~2.4.1",
+ "range-parser": "~1.2.1",
+ "statuses": "~2.0.2"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/send/node_modules/ms": {
+ "version": "2.1.3",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+ "license": "MIT"
+ },
+ "node_modules/serve-static": {
+ "version": "1.16.3",
+ "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+ "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+ "license": "MIT",
+ "dependencies": {
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "parseurl": "~1.3.3",
+ "send": "~0.19.1"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/setprototypeof": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+ "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+ "license": "ISC"
+ },
+ "node_modules/side-channel": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+ "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+ "license": "MIT",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "object-inspect": "^1.13.3",
+ "side-channel-list": "^1.0.0",
+ "side-channel-map": "^1.0.1",
+ "side-channel-weakmap": "^1.0.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/side-channel-list": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+ "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+ "license": "MIT",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "object-inspect": "^1.13.4"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/side-channel-map": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+ "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+ "license": "MIT",
+ "dependencies": {
+ "call-bound": "^1.0.2",
+ "es-errors": "^1.3.0",
+ "get-intrinsic": "^1.2.5",
+ "object-inspect": "^1.13.3"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/side-channel-weakmap": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+ "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+ "license": "MIT",
+ "dependencies": {
+ "call-bound": "^1.0.2",
+ "es-errors": "^1.3.0",
+ "get-intrinsic": "^1.2.5",
+ "object-inspect": "^1.13.3",
+ "side-channel-map": "^1.0.1"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/source-map-js": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+ "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+ "license": "BSD-3-Clause",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/statuses": {
+ "version": "2.0.2",
+ "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+ "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/streamsearch": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
+ "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+ "engines": {
+ "node": ">=10.0.0"
+ }
+ },
+ "node_modules/string_decoder": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+ "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+ "license": "MIT",
+ "dependencies": {
+ "safe-buffer": "~5.1.0"
+ }
+ },
+ "node_modules/string_decoder/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+ "license": "MIT"
+ },
+ "node_modules/toidentifier": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+ "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=0.6"
+ }
+ },
+ "node_modules/type-is": {
+ "version": "1.6.18",
+ "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+ "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+ "license": "MIT",
+ "dependencies": {
+ "media-typer": "0.3.0",
+ "mime-types": "~2.1.24"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/typedarray": {
+ "version": "0.0.6",
+ "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
+ "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
+ "license": "MIT"
+ },
+ "node_modules/undici": {
+ "version": "7.25.0",
+ "resolved": "https://registry.npmjs.org/undici/-/undici-7.25.0.tgz",
+ "integrity": "sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=20.18.1"
+ }
+ },
+ "node_modules/unpipe": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+ "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/util-deprecate": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+ "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+ "license": "MIT"
+ },
+ "node_modules/utils-merge": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+ "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4.0"
+ }
+ },
+ "node_modules/vary": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+ "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/whatwg-encoding": {
+ "version": "3.1.1",
+ "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+ "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+ "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+ "license": "MIT",
+ "dependencies": {
+ "iconv-lite": "0.6.3"
+ },
+ "engines": {
+ "node": ">=18"
+ }
+ },
+ "node_modules/whatwg-mimetype": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+ "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=18"
+ }
+ },
+ "node_modules/xtend": {
+ "version": "4.0.2",
+ "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+ "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=0.4"
+ }
+ }
+ }
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..3319635
--- /dev/null
+++ b/package.json
@@ -0,0 +1,19 @@
+{
+ "name": "@dw/inline-editor",
+ "version": "0.1.0",
+ "description": "Drop-in Wix-style inline page editor for the DW sister-site fleet (auth.agentabrams.com gated)",
+ "main": "src/middleware.js",
+ "files": ["src", "public", "db", "README.md"],
+ "scripts": {
+ "test": "node test/run.js",
+ "pilot": "node test/pilot.js"
+ },
+ "dependencies": {
+ "cheerio": "^1.0.0",
+ "cookie-parser": "^1.4.7",
+ "express": "^4.21.1",
+ "jsonwebtoken": "^9.0.2",
+ "multer": "^1.4.5-lts.1",
+ "sanitize-html": "^2.13.1"
+ }
+}
diff --git a/public/editor.css b/public/editor.css
new file mode 100644
index 0000000..eb84bec
--- /dev/null
+++ b/public/editor.css
@@ -0,0 +1,53 @@
+/* @dw/inline-editor — styles. Scoped to elements we own + .dw-edit-* classes. */
+#dw-inline-ui { position: fixed; z-index: 2147483647; bottom: 16px; right: 16px; font: 13px/1.4 -apple-system, system-ui, sans-serif; }
+#dw-inline-toggle {
+ appearance: none; border: 0; cursor: pointer;
+ background: #1a1a1a; color: #fff;
+ padding: 10px 14px; border-radius: 999px;
+ box-shadow: 0 6px 24px rgba(0,0,0,.25);
+ font: inherit; font-weight: 500;
+}
+#dw-inline-toggle.on { background: #e74c3c; }
+#dw-inline-toast {
+ position: fixed; left: 50%; bottom: 80px; transform: translateX(-50%);
+ background: #1a1a1a; color: #fff; padding: 8px 14px; border-radius: 6px;
+ font: inherit; opacity: 0; transition: opacity .2s, transform .2s;
+ pointer-events: none;
+ z-index: 2147483647;
+}
+#dw-inline-toast.show { opacity: .95; transform: translate(-50%, -8px); }
+#dw-inline-toast[data-kind=err] { background: #b03a2e; }
+
+#dw-inline-modal { position: fixed; inset: 0; z-index: 2147483646; }
+#dw-inline-modal .m-back { position: absolute; inset: 0; background: rgba(0,0,0,.5); }
+#dw-inline-modal .m-card {
+ position: absolute; left: 50%; top: 50%; transform: translate(-50%, -50%);
+ background: #fff; min-width: 520px; max-width: 90vw; max-height: 80vh; overflow: auto;
+ padding: 20px 24px; border-radius: 4px; box-shadow: 0 24px 80px rgba(0,0,0,.4);
+ font: 13px/1.4 -apple-system, system-ui, sans-serif;
+}
+#dw-inline-modal h3 { margin: 0 0 12px; font-size: 14px; font-weight: 600; }
+#dw-inline-modal textarea {
+ width: 100%; min-height: 140px; padding: 8px 10px; font: 13px/1.4 -apple-system, system-ui, monospace;
+ border: 1px solid #d0d0d0; border-radius: 2px; resize: vertical;
+}
+#dw-inline-modal input[type=file] { margin-top: 8px; font: inherit; }
+#dw-inline-modal .m-actions { display: flex; gap: 8px; justify-content: flex-end; margin-top: 12px; }
+#dw-inline-modal button {
+ appearance: none; border: 0; cursor: pointer; font: inherit; font-weight: 500;
+ padding: 8px 16px; border-radius: 2px;
+}
+#dw-inline-modal-save { background: #1a1a1a; color: #fff; }
+#dw-inline-modal-cancel { background: #eee; color: #1a1a1a; }
+
+html.dw-edit-on .dw-edit-hover {
+ outline: 2px solid #ff6b35 !important;
+ outline-offset: 2px !important;
+ cursor: pointer !important;
+}
+html.dw-edit-on a.dw-edit-hover { cursor: context-menu !important; }
+html.dw-edit-on [contenteditable=true] {
+ outline: 2px dashed #ff6b35 !important;
+ outline-offset: 2px !important;
+ background: rgba(255,107,53,.04);
+}
diff --git a/public/editor.js b/public/editor.js
new file mode 100644
index 0000000..5aeaa53
--- /dev/null
+++ b/public/editor.js
@@ -0,0 +1,321 @@
+/* @dw/inline-editor — client.
+ * Only loaded by the server when `dw_auth` cookie has role=admin.
+ *
+ * UX:
+ * - Floating "Edit" toggle button (bottom-right) and Ctrl/Cmd+E shortcut.
+ * - When edit mode is ON:
+ * • text leaf nodes get hover outline + contenteditable on click
+ * • <img> elements get hover outline + click → file picker / URL prompt
+ * • shift+click an <img> → edit alt text
+ * • right-click an <a> → edit href (preventDefault on context menu)
+ * • dblclick a [data-edit-region] → free-form HTML editor (textarea modal)
+ * - Auto-save on blur (text/html) or on selection (image/href). Debounced 700ms.
+ * - Selector strategy: prefer #id, then [data-edit-id="..."], else a
+ * stable structural selector built from nth-of-type chain.
+ */
+(function () {
+ if (window.__DW_INLINE_LOADED__) return; window.__DW_INLINE_LOADED__ = true;
+ const ctx = window.__DW_INLINE__ || {};
+ if (!ctx.editor) { console.warn('inline-editor: not authed'); return; }
+
+ // ---------- UI scaffolding ----------
+ const ui = document.createElement('div');
+ ui.id = 'dw-inline-ui';
+ ui.innerHTML = `
+ <button id="dw-inline-toggle" type="button">Edit</button>
+ <div id="dw-inline-toast"></div>
+ <div id="dw-inline-modal" hidden>
+ <div class="m-back"></div>
+ <div class="m-card">
+ <h3 id="dw-inline-modal-title">Edit</h3>
+ <textarea id="dw-inline-modal-ta"></textarea>
+ <div class="m-actions">
+ <button id="dw-inline-modal-cancel" type="button">Cancel</button>
+ <button id="dw-inline-modal-save" type="button">Save</button>
+ </div>
+ </div>
+ </div>
+ `;
+ document.body.appendChild(ui);
+ const $ = (s) => document.querySelector(s);
+ const toggleBtn = $('#dw-inline-toggle');
+ const toast = $('#dw-inline-toast');
+ const modal = $('#dw-inline-modal');
+ const modalTitle = $('#dw-inline-modal-title');
+ const modalTa = $('#dw-inline-modal-ta');
+ const modalCancel = $('#dw-inline-modal-cancel');
+ const modalSave = $('#dw-inline-modal-save');
+
+ let editMode = false;
+ let pending = new Map();
+ let saveTimer = null;
+
+ function setEditMode(on) {
+ editMode = !!on;
+ document.documentElement.classList.toggle('dw-edit-on', editMode);
+ toggleBtn.classList.toggle('on', editMode);
+ toggleBtn.textContent = editMode ? 'Editing — click Edit again to stop' : 'Edit';
+ showToast(editMode ? 'Edit mode ON' : 'Edit mode OFF');
+ if (!editMode) {
+ document.querySelectorAll('[contenteditable]').forEach(e => e.removeAttribute('contenteditable'));
+ }
+ }
+ toggleBtn.addEventListener('click', () => setEditMode(!editMode));
+ document.addEventListener('keydown', (e) => {
+ if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'e') {
+ e.preventDefault(); setEditMode(!editMode);
+ }
+ });
+
+ function showToast(msg, kind) {
+ toast.textContent = msg;
+ toast.dataset.kind = kind || '';
+ toast.classList.add('show');
+ clearTimeout(toast._t);
+ toast._t = setTimeout(() => toast.classList.remove('show'), 2200);
+ }
+
+ // ---------- selector strategy ----------
+ function makeSelector(el) {
+ if (!el || el === document.body) return 'body';
+ if (el.id) return '#' + cssEscape(el.id);
+ if (el.dataset && el.dataset.editId) return `[data-edit-id="${cssEscape(el.dataset.editId)}"]`;
+ const parts = [];
+ let cur = el;
+ while (cur && cur.nodeType === 1 && cur !== document.body) {
+ const tag = cur.tagName.toLowerCase();
+ const sib = Array.from(cur.parentNode.children).filter(c => c.tagName === cur.tagName);
+ const idx = sib.indexOf(cur) + 1;
+ parts.unshift(`${tag}:nth-of-type(${idx})`);
+ if (cur.parentNode && cur.parentNode.id) {
+ parts.unshift('#' + cssEscape(cur.parentNode.id));
+ break;
+ }
+ cur = cur.parentNode;
+ }
+ return parts.join(' > ');
+ }
+ function cssEscape(s) {
+ return String(s).replace(/[^a-zA-Z0-9_-]/g, '\\$&');
+ }
+
+ // ---------- core: handler delegation ----------
+ document.addEventListener('mouseover', onHover, true);
+ document.addEventListener('mouseout', onHoverOut, true);
+ document.addEventListener('click', onClick, true);
+ document.addEventListener('contextmenu', onContext, true);
+ document.addEventListener('dblclick', onDblClick, true);
+ document.addEventListener('blur', onBlur, true);
+
+ function isInsideEditorUi(el) { return !!el.closest('#dw-inline-ui, #dw-inline-modal'); }
+ function isEditableLeaf(el) {
+ if (!el || isInsideEditorUi(el)) return false;
+ const tag = el.tagName;
+ if (!tag) return false;
+ if (/^(HTML|HEAD|BODY|SCRIPT|STYLE|META|LINK|NOSCRIPT|IFRAME|SVG|PATH|CANVAS|VIDEO|AUDIO)$/.test(tag)) return false;
+ if (el.children.length === 0 && (el.textContent || '').trim().length > 0) return true;
+ // also allow elements explicitly marked editable
+ if (el.dataset && (el.dataset.editText === 'true' || el.dataset.editRegion === 'true')) return true;
+ return false;
+ }
+ function isImage(el) { return el && el.tagName === 'IMG' && !isInsideEditorUi(el); }
+ function isAnchor(el) { return el && el.tagName === 'A' && !isInsideEditorUi(el); }
+
+ function onHover(e) {
+ if (!editMode) return;
+ const t = e.target;
+ if (isInsideEditorUi(t)) return;
+ if (isImage(t) || isAnchor(t) || isEditableLeaf(t)) t.classList.add('dw-edit-hover');
+ }
+ function onHoverOut(e) { e.target && e.target.classList && e.target.classList.remove('dw-edit-hover'); }
+
+ function onClick(e) {
+ if (!editMode) return;
+ const t = e.target;
+ if (isInsideEditorUi(t)) return;
+ // Image edit
+ if (isImage(t)) {
+ e.preventDefault(); e.stopPropagation();
+ if (e.shiftKey) {
+ promptEditImageAlt(t);
+ } else {
+ promptEditImage(t);
+ }
+ return;
+ }
+ // Text edit
+ if (isEditableLeaf(t)) {
+ e.preventDefault(); e.stopPropagation();
+ enableContentEditable(t);
+ }
+ }
+ function onContext(e) {
+ if (!editMode) return;
+ const t = e.target;
+ if (isAnchor(t)) {
+ e.preventDefault();
+ promptEditHref(t);
+ }
+ }
+ function onDblClick(e) {
+ if (!editMode) return;
+ const t = e.target;
+ const region = t.closest && t.closest('[data-edit-region]');
+ if (region && !isInsideEditorUi(region)) {
+ e.preventDefault(); e.stopPropagation();
+ openHtmlEditorFor(region);
+ }
+ }
+ function onBlur(e) {
+ const t = e.target;
+ if (t && t.hasAttribute && t.hasAttribute('contenteditable')) {
+ flushTextEdit(t);
+ }
+ }
+
+ function enableContentEditable(el) {
+ el.setAttribute('contenteditable', 'true');
+ el.dataset._dwOriginal = el.textContent;
+ el.focus();
+ }
+ function flushTextEdit(el) {
+ const newText = el.textContent;
+ if (newText === el.dataset._dwOriginal) {
+ el.removeAttribute('contenteditable');
+ return;
+ }
+ el.removeAttribute('contenteditable');
+ const kind = (el.dataset && el.dataset.editRegion === 'true') ? 'html' : 'text';
+ const value = kind === 'html' ? el.innerHTML : newText;
+ save({ selector: makeSelector(el), kind, value });
+ }
+
+ function promptEditImage(img) {
+ openModal({
+ title: `Replace image — ${img.alt || img.src.slice(-40)}`,
+ ta: img.src,
+ help: 'Paste a new URL, OR pick a file below. (svg/jpg/png/webp/gif ≤ 5MB)',
+ file: true,
+ onSave: async (val, file) => {
+ if (file) {
+ const url = await uploadFile(file);
+ if (!url) return;
+ img.src = url;
+ save({ selector: makeSelector(img), kind: 'image', value: url });
+ } else if (val && val !== img.src) {
+ img.src = val;
+ save({ selector: makeSelector(img), kind: 'image', value: val });
+ }
+ }
+ });
+ }
+ function promptEditImageAlt(img) {
+ openModal({
+ title: 'Edit alt text',
+ ta: img.alt || '',
+ help: 'Describe what the image shows. Helps screen readers + SEO.',
+ onSave: (val) => {
+ if (val !== img.alt) {
+ img.alt = val;
+ save({ selector: makeSelector(img), kind: 'image_alt', value: val });
+ }
+ }
+ });
+ }
+ function promptEditHref(a) {
+ openModal({
+ title: 'Edit link URL',
+ ta: a.getAttribute('href') || '',
+ help: 'http(s)://, mailto:, tel:, or a /relative path',
+ onSave: (val) => {
+ if (val !== a.getAttribute('href')) {
+ a.setAttribute('href', val);
+ save({ selector: makeSelector(a), kind: 'href', value: val });
+ }
+ }
+ });
+ }
+ function openHtmlEditorFor(region) {
+ openModal({
+ title: 'Edit HTML block',
+ ta: region.innerHTML,
+ help: 'Inline HTML — script tags and on* handlers get stripped server-side.',
+ onSave: (val) => {
+ region.innerHTML = val;
+ save({ selector: makeSelector(region), kind: 'html', value: val });
+ }
+ });
+ }
+
+ // ---------- modal ----------
+ function openModal({ title, ta, help, onSave, file }) {
+ modalTitle.textContent = title;
+ modalTa.value = ta || '';
+ let existingFile = $('#dw-inline-modal-file');
+ if (existingFile) existingFile.remove();
+ if (file) {
+ const inp = document.createElement('input');
+ inp.type = 'file'; inp.id = 'dw-inline-modal-file'; inp.accept = 'image/*';
+ modalTa.after(inp);
+ }
+ const helpEl = $('#dw-inline-modal-help');
+ if (!helpEl) {
+ const h = document.createElement('div');
+ h.id = 'dw-inline-modal-help'; h.style.fontSize = '11px'; h.style.color = '#888'; h.style.margin = '6px 0';
+ modalTa.before(h);
+ }
+ $('#dw-inline-modal-help').textContent = help || '';
+ modal.hidden = false;
+ modalTa.focus(); modalTa.select();
+ modalSave.onclick = async () => {
+ const fileInput = $('#dw-inline-modal-file');
+ const chosen = fileInput && fileInput.files && fileInput.files[0];
+ modal.hidden = true;
+ await onSave(modalTa.value, chosen);
+ };
+ modalCancel.onclick = () => { modal.hidden = true; };
+ }
+
+ // ---------- save / upload ----------
+ function save(payload) {
+ pending.set(payload.selector, payload);
+ if (saveTimer) clearTimeout(saveTimer);
+ saveTimer = setTimeout(flushPending, 700);
+ }
+ async function flushPending() {
+ const batch = Array.from(pending.values());
+ pending.clear();
+ for (const item of batch) {
+ try {
+ const res = await fetch('/api/_inline/save', {
+ method: 'POST',
+ credentials: 'include',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({ path: ctx.path, ...item })
+ });
+ const j = await res.json();
+ if (!res.ok) {
+ showToast(`Save failed: ${j.error || res.status}`, 'err');
+ } else {
+ showToast(`Saved: ${item.kind} · ${item.selector.slice(0, 40)}`);
+ }
+ } catch (e) {
+ showToast(`Save error: ${e.message}`, 'err');
+ }
+ }
+ }
+ async function uploadFile(file) {
+ const fd = new FormData();
+ fd.append('image', file);
+ try {
+ const res = await fetch('/api/_inline/upload', { method: 'POST', credentials: 'include', body: fd });
+ const j = await res.json();
+ if (!res.ok) { showToast(`Upload failed: ${j.error || res.status}`, 'err'); return null; }
+ showToast(`Uploaded: ${(j.bytes/1024).toFixed(0)} KB`);
+ return j.url;
+ } catch (e) {
+ showToast(`Upload error: ${e.message}`, 'err');
+ return null;
+ }
+ }
+})();
diff --git a/src/auth.js b/src/auth.js
new file mode 100644
index 0000000..9c49deb
--- /dev/null
+++ b/src/auth.js
@@ -0,0 +1,89 @@
+/**
+ * Auth gate for inline-editor save/upload/revert endpoints.
+ *
+ * Verifies the `dw_auth` cookie issued by auth.agentabrams.com.
+ *
+ * For v1 we support two modes:
+ * - PROD: JWT verified against AUTH_JWKS_URL (issuer auth.agentabrams.com).
+ * - DEV: symmetric HS256 token signed with AUTH_DEV_SECRET (env).
+ * Lets you test locally without the production JWKS endpoint.
+ *
+ * Required claims: { email, role, exp, iss }.
+ * Allowed only when role === 'admin' (and iss === 'https://auth.agentabrams.com' in prod).
+ *
+ * Fail-closed: any missing/expired/invalid token → 401.
+ */
+const jwt = require('jsonwebtoken');
+
+const ISSUER = 'https://auth.agentabrams.com';
+const COOKIE_NAME = 'dw_auth';
+
+let jwksCache = null;
+let jwksFetchedAt = 0;
+
+async function getJwks(url) {
+ if (jwksCache && Date.now() - jwksFetchedAt < 10 * 60_000) return jwksCache;
+ const res = await fetch(url);
+ if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`);
+ jwksCache = await res.json();
+ jwksFetchedAt = Date.now();
+ return jwksCache;
+}
+
+function pemFromJwk(jwk) {
+ // Minimal RSA n/e → PEM. For HS256 dev mode this is unused.
+ // Pulled lazily — for v1 we recommend symmetric DEV mode or
+ // a thin RS256 verifier wired against auth.agentabrams.com's
+ // public key (paste into AUTH_PUBLIC_PEM env). Keep complexity
+ // out of this file; if AUTH_PUBLIC_PEM is set, use it.
+ return null;
+}
+
+async function verifyJwt(token, opts) {
+ const { authMode, devSecret, publicPem, jwksUrl } = opts;
+ if (authMode === 'dev' || (!publicPem && !jwksUrl)) {
+ if (!devSecret) throw new Error('AUTH_DEV_SECRET missing');
+ return jwt.verify(token, devSecret, { algorithms: ['HS256'], issuer: ISSUER });
+ }
+ if (publicPem) {
+ return jwt.verify(token, publicPem, { algorithms: ['RS256'], issuer: ISSUER });
+ }
+ // JWKS path — kid → key lookup left as a later enhancement; prefer publicPem.
+ throw new Error('JWKS path not implemented in v1 — set AUTH_PUBLIC_PEM');
+}
+
+function authMiddleware(opts) {
+ return async function adminGate(req, res, next) {
+ const token = (req.cookies && req.cookies[COOKIE_NAME]) || null;
+ if (!token) return res.status(401).json({ error: 'no_auth' });
+ try {
+ const claims = await verifyJwt(token, opts);
+ if (!claims || claims.role !== 'admin') {
+ return res.status(403).json({ error: 'not_admin' });
+ }
+ req.editor = {
+ email: claims.email,
+ role: claims.role,
+ iss: claims.iss
+ };
+ return next();
+ } catch (e) {
+ return res.status(401).json({ error: 'invalid_token', detail: String(e.message || e) });
+ }
+ };
+}
+
+// Soft check — readable from middleware/templates to decide whether to inject editor JS
+function readAdminFromCookie(req, opts) {
+ const token = req.cookies && req.cookies[COOKIE_NAME];
+ if (!token) return null;
+ try {
+ const decoded = jwt.decode(token);
+ if (decoded && decoded.role === 'admin' && decoded.exp * 1000 > Date.now()) {
+ return decoded;
+ }
+ } catch {}
+ return null;
+}
+
+module.exports = { authMiddleware, readAdminFromCookie, COOKIE_NAME, ISSUER };
diff --git a/src/db.js b/src/db.js
new file mode 100644
index 0000000..0a60e05
--- /dev/null
+++ b/src/db.js
@@ -0,0 +1,90 @@
+/**
+ * DB layer for inline-editor. Uses local-socket psql by default — same pattern
+ * Sister Parish viewer uses — so we avoid needing the dw_admin TCP password.
+ *
+ * If DATABASE_URL is set and contains a working password, switch to pg client.
+ */
+const { execSync, spawnSync } = require('child_process');
+
+function psql(sql, opts = {}) {
+ const res = spawnSync('psql', ['dw_unified','-At','-q'], {
+ input: sql,
+ encoding: 'utf8',
+ timeout: opts.timeout || 5000
+ });
+ if (res.status !== 0) throw new Error(`psql failed: ${res.stderr}`);
+ return res.stdout.trim();
+}
+
+function esc(s) {
+ if (s == null) return 'NULL';
+ return "'" + String(s).replace(/'/g, "''") + "'";
+}
+
+function getOverridesFor(site, path) {
+ const sql = `SELECT json_object_agg(selector, json_build_object('kind', kind, 'value', value)) FROM page_overrides WHERE site=${esc(site)} AND path=${esc(path)};`;
+ const raw = psql(sql);
+ if (!raw || raw === '') return {};
+ try { return JSON.parse(raw) || {}; } catch { return {}; }
+}
+
+function saveOverride({ site, path, selector, kind, value, editorEmail, editorIp, editorUa, isRevert = false }) {
+ // 1) get old value (for log)
+ const oldSql = `SELECT value FROM page_overrides WHERE site=${esc(site)} AND path=${esc(path)} AND selector=${esc(selector)};`;
+ const oldValue = psql(oldSql) || null;
+
+ // 2) upsert override
+ const upsertSql = `
+ INSERT INTO page_overrides (site, path, selector, kind, value, updated_at, updated_by)
+ VALUES (${esc(site)}, ${esc(path)}, ${esc(selector)}, ${esc(kind)}, ${esc(value)}, NOW(), ${esc(editorEmail)})
+ ON CONFLICT (site, path, selector) DO UPDATE
+ SET kind=EXCLUDED.kind, value=EXCLUDED.value, updated_at=NOW(), updated_by=EXCLUDED.updated_by;
+ `;
+ psql(upsertSql);
+
+ // 3) append to log
+ const logSql = `
+ INSERT INTO page_edit_log (site, path, selector, kind, old_value, new_value, editor_email, editor_ip, editor_ua, is_revert)
+ VALUES (${esc(site)}, ${esc(path)}, ${esc(selector)}, ${esc(kind)}, ${oldValue ? esc(oldValue) : 'NULL'}, ${esc(value)}, ${esc(editorEmail)}, ${editorIp ? esc(editorIp) : 'NULL'}, ${editorUa ? esc(editorUa) : 'NULL'}, ${isRevert ? 'TRUE' : 'FALSE'});
+ `;
+ psql(logSql);
+ return { oldValue };
+}
+
+function getLogFor(site, path, limit = 50) {
+ const sql = `SELECT json_agg(t) FROM (SELECT id, selector, kind, old_value, new_value, editor_email, is_revert, ts FROM page_edit_log WHERE site=${esc(site)} AND path=${esc(path)} ORDER BY ts DESC LIMIT ${limit | 0}) t;`;
+ const raw = psql(sql);
+ try { return JSON.parse(raw) || []; } catch { return []; }
+}
+
+function recordUpload({ site, url, absPath, mimeType, bytes, uploadedBy, uploaderIp }) {
+ const sql = `
+ INSERT INTO page_uploads (site, url, abs_path, mime_type, bytes, uploaded_by, uploader_ip)
+ VALUES (${esc(site)}, ${esc(url)}, ${esc(absPath)}, ${esc(mimeType)}, ${bytes | 0}, ${esc(uploadedBy)}, ${uploaderIp ? esc(uploaderIp) : 'NULL'});
+ `;
+ psql(sql);
+}
+
+function rateLimitCheck(editorEmail, perMinute = 10) {
+ // Insert + count last 60s. If count > perMinute, block.
+ const sql = `
+ INSERT INTO page_edit_ratelimit (editor_email) VALUES (${esc(editorEmail)});
+ DELETE FROM page_edit_ratelimit WHERE ts < NOW() - INTERVAL '5 minutes';
+ SELECT COUNT(*) FROM page_edit_ratelimit WHERE editor_email=${esc(editorEmail)} AND ts > NOW() - INTERVAL '1 minute';
+ `;
+ const out = psql(sql);
+ const n = parseInt(out, 10);
+ return { count: n, blocked: n > perMinute };
+}
+
+function deleteOverride({ site, path, selector, editorEmail, editorIp, editorUa, kind }) {
+ const oldSql = `SELECT value FROM page_overrides WHERE site=${esc(site)} AND path=${esc(path)} AND selector=${esc(selector)};`;
+ const oldValue = psql(oldSql) || null;
+ psql(`DELETE FROM page_overrides WHERE site=${esc(site)} AND path=${esc(path)} AND selector=${esc(selector)};`);
+ psql(`
+ INSERT INTO page_edit_log (site, path, selector, kind, old_value, new_value, editor_email, editor_ip, editor_ua, is_revert)
+ VALUES (${esc(site)}, ${esc(path)}, ${esc(selector)}, ${esc(kind || 'text')}, ${oldValue ? esc(oldValue) : 'NULL'}, '', ${esc(editorEmail)}, ${editorIp ? esc(editorIp) : 'NULL'}, ${editorUa ? esc(editorUa) : 'NULL'}, TRUE);
+ `);
+}
+
+module.exports = { psql, esc, getOverridesFor, saveOverride, deleteOverride, getLogFor, recordUpload, rateLimitCheck };
diff --git a/src/middleware.js b/src/middleware.js
new file mode 100644
index 0000000..7ea3c64
--- /dev/null
+++ b/src/middleware.js
@@ -0,0 +1,219 @@
+/**
+ * @dw/inline-editor — Express middleware for the DW sister-site fleet.
+ *
+ * Usage:
+ * const inlineEditor = require('@dw/inline-editor');
+ * app.use(inlineEditor({
+ * site: 'corkwallcovering.com',
+ * uploadDir: path.join(__dirname, 'public', 'uploads'),
+ * authMode: 'dev' | 'prod', // 'dev' uses AUTH_DEV_SECRET
+ * }));
+ *
+ * What it does:
+ * 1. Mounts /_inline/editor.js, /_inline/editor.css (static)
+ * 2. Mounts /api/_inline/{state,save,upload,revert,log} (auth-gated except state)
+ * 3. Wraps res.send for text/html responses — walks DOM via cheerio, applies
+ * matching overrides from PG, and injects the editor bootstrap.
+ */
+const path = require('path');
+const fs = require('fs');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const cheerio = require('cheerio');
+const multer = require('multer');
+const crypto = require('crypto');
+
+const { sanitizeByKind } = require('./sanitize');
+const { authMiddleware, readAdminFromCookie } = require('./auth');
+const { getOverridesFor, saveOverride, getLogFor, recordUpload, rateLimitCheck } = require('./db');
+
+const PUBLIC_DIR = path.join(__dirname, '..', 'public');
+
+function inlineEditor(opts = {}) {
+ const {
+ site,
+ uploadDir,
+ authMode = process.env.NODE_ENV === 'production' ? 'prod' : 'dev',
+ devSecret = process.env.AUTH_DEV_SECRET || 'dev-secret-change-me',
+ publicPem = process.env.AUTH_PUBLIC_PEM || null,
+ jwksUrl = process.env.AUTH_JWKS_URL || null,
+ cacheTtlMs = 30_000,
+ maxUploadBytes = 5 * 1024 * 1024,
+ } = opts;
+ if (!site) throw new Error('inlineEditor: { site } is required');
+
+ const authOpts = { authMode, devSecret, publicPem, jwksUrl };
+ const cache = new Map(); // key=site|path → { overrides, ts }
+
+ const router = express.Router();
+ router.use(cookieParser());
+
+ // -------- static editor assets --------
+ router.use('/_inline', express.static(PUBLIC_DIR, { maxAge: '1h' }));
+
+ // -------- /api/_inline/state — read overrides for a path (admin-only) --------
+ router.get('/api/_inline/state', authMiddleware(authOpts), (req, res) => {
+ const p = req.query.path || '/';
+ const overrides = getOverridesFor(site, p);
+ res.json({ site, path: p, overrides });
+ });
+
+ // -------- /api/_inline/log --------
+ router.get('/api/_inline/log', authMiddleware(authOpts), (req, res) => {
+ const p = req.query.path || '/';
+ res.json({ site, path: p, log: getLogFor(site, p) });
+ });
+
+ // -------- /api/_inline/save --------
+ router.post('/api/_inline/save', express.json({ limit: '256kb' }), authMiddleware(authOpts), (req, res) => {
+ try {
+ const { path: p, selector, kind, value } = req.body || {};
+ if (!p || !selector || !kind || value == null) return res.status(400).json({ error: 'missing_fields' });
+ if (!isStableSelector(selector)) return res.status(400).json({ error: 'unstable_selector', selector });
+
+ const rate = rateLimitCheck(req.editor.email);
+ if (rate.blocked) return res.status(429).json({ error: 'rate_limited', count: rate.count });
+
+ const clean = sanitizeByKind(kind, value, { site });
+ saveOverride({
+ site, path: p, selector, kind, value: clean,
+ editorEmail: req.editor.email,
+ editorIp: clientIp(req),
+ editorUa: (req.get('user-agent') || '').slice(0, 500)
+ });
+ cache.delete(site + '|' + p);
+ res.json({ ok: true, cleaned: clean });
+ } catch (e) {
+ res.status(500).json({ error: 'save_failed', detail: String(e.message || e) });
+ }
+ });
+
+ // -------- /api/_inline/revert -------- v1 semantics: revert = drop override
+ // (restores source-HTML content). Log row records the deletion. Step-back UI
+ // is v2 (walk the log and selectively restore prior overrides).
+ router.post('/api/_inline/revert', express.json(), authMiddleware(authOpts), (req, res) => {
+ try {
+ const { path: p, selector } = req.body || {};
+ if (!p || !selector) return res.status(400).json({ error: 'missing_fields' });
+ const log = getLogFor(site, p, 200);
+ const target = log.find(e => e.selector === selector);
+ const kind = target ? target.kind : 'text';
+ const { deleteOverride } = require('./db');
+ deleteOverride({ site, path: p, selector, kind,
+ editorEmail: req.editor.email,
+ editorIp: clientIp(req),
+ editorUa: (req.get('user-agent') || '').slice(0, 500)
+ });
+ cache.delete(site + '|' + p);
+ res.json({ ok: true, deleted: true });
+ } catch (e) {
+ res.status(500).json({ error: 'revert_failed', detail: String(e.message || e) });
+ }
+ });
+
+ // -------- /api/_inline/upload --------
+ if (uploadDir) {
+ try { fs.mkdirSync(uploadDir, { recursive: true }); } catch {}
+ const upload = multer({
+ storage: multer.diskStorage({
+ destination: uploadDir,
+ filename: (_req, file, cb) => {
+ const ext = (file.originalname.match(/\.[a-zA-Z0-9]+$/) || [''])[0].toLowerCase();
+ const safeExt = /^\.(jpg|jpeg|png|gif|webp|svg)$/i.test(ext) ? ext : '.bin';
+ cb(null, crypto.randomBytes(8).toString('hex') + safeExt);
+ }
+ }),
+ limits: { fileSize: maxUploadBytes, files: 1 },
+ fileFilter: (_req, file, cb) => cb(null, /^image\//.test(file.mimetype))
+ });
+ router.post('/api/_inline/upload',
+ authMiddleware(authOpts),
+ upload.single('image'),
+ (req, res) => {
+ if (!req.file) return res.status(400).json({ error: 'no_file' });
+ const url = '/uploads/' + req.file.filename;
+ recordUpload({
+ site,
+ url,
+ absPath: req.file.path,
+ mimeType: req.file.mimetype,
+ bytes: req.file.size,
+ uploadedBy: req.editor.email,
+ uploaderIp: clientIp(req)
+ });
+ res.json({ ok: true, url, bytes: req.file.size, mime: req.file.mimetype });
+ }
+ );
+ }
+
+ // -------- HTML rewriter (wraps res.send) --------
+ router.use((req, res, next) => {
+ const originalSend = res.send;
+ res.send = function (body) {
+ try {
+ const ct = res.get('Content-Type') || '';
+ if (ct.includes('text/html') && typeof body === 'string' && body.length < 2_000_000) {
+ const editor = readAdminFromCookie(req, authOpts);
+ const reqPath = req.path || '/';
+ const cacheKey = site + '|' + reqPath;
+ let cached = cache.get(cacheKey);
+ if (!cached || Date.now() - cached.ts > cacheTtlMs) {
+ cached = { overrides: getOverridesFor(site, reqPath), ts: Date.now() };
+ cache.set(cacheKey, cached);
+ }
+ body = applyOverrides(body, cached.overrides, { admin: !!editor, editor, site, path: reqPath });
+ }
+ } catch (e) {
+ // Fail-open: never break the page on rewriter error
+ console.error('[inline-editor] rewrite failed:', e.message);
+ }
+ return originalSend.call(this, body);
+ };
+ next();
+ });
+
+ return router;
+}
+
+function clientIp(req) {
+ const xff = req.get('x-forwarded-for');
+ if (xff) return xff.split(',')[0].trim();
+ return req.ip || null;
+}
+
+// Selectors we accept: #id, [data-edit-id="..."], or structural like "main > section:nth-of-type(2) > h1"
+function isStableSelector(s) {
+ if (typeof s !== 'string' || s.length > 500) return false;
+ // Strip the only function-form we allow — :nth-of-type(N) and :nth-child(N) — then validate remainder
+ const stripped = s.replace(/:nth-(?:of-type|child)\(\d+\)/g, '');
+ // Allowed in remainder: #, ., [, ], =, ", ', word chars, hyphen, space, >, +, ~, :, ,
+ if (!/^[#.\[\]\w\-\=\"\'\s>+~:,]+$/.test(stripped)) return false;
+ // Block obvious nasties even though regex above already excludes them
+ if (/[<\\\(\){}|]/.test(stripped)) return false;
+ return true;
+}
+
+function applyOverrides(html, overrides, ctx) {
+ const $ = cheerio.load(html, { decodeEntities: false });
+ for (const [selector, ov] of Object.entries(overrides || {})) {
+ try {
+ const el = $(selector);
+ if (!el.length) continue;
+ if (ov.kind === 'text') el.first().text(ov.value);
+ else if (ov.kind === 'html') el.first().html(ov.value);
+ else if (ov.kind === 'image') el.first().attr('src', ov.value);
+ else if (ov.kind === 'image_alt') el.first().attr('alt', ov.value);
+ else if (ov.kind === 'href') el.first().attr('href', ov.value);
+ } catch (e) { /* skip a broken selector */ }
+ }
+ // Inject editor bootstrap when admin is signed in
+ if (ctx.admin) {
+ $('head').append(`<link rel="stylesheet" href="/_inline/editor.css">`);
+ $('body').append(`<script>window.__DW_INLINE__=${JSON.stringify({ site: ctx.site, path: ctx.path, editor: ctx.editor.email })};</script>`);
+ $('body').append(`<script src="/_inline/editor.js" defer></script>`);
+ }
+ return $.html();
+}
+
+module.exports = inlineEditor;
+module.exports.inlineEditor = inlineEditor;
diff --git a/src/sanitize.js b/src/sanitize.js
new file mode 100644
index 0000000..fcb7bb9
Binary files /dev/null and b/src/sanitize.js differ
diff --git a/test/pilot.js b/test/pilot.js
new file mode 100644
index 0000000..a8cf396
--- /dev/null
+++ b/test/pilot.js
@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * Local smoke-test pilot — spins up a tiny Express app that serves a sample
+ * sister-site page, mounts @dw/inline-editor with site=test.local, and
+ * uses HS256 dev-secret auth.
+ *
+ * Usage:
+ * node test/pilot.js
+ * Then open http://127.0.0.1:9791 with a dev admin cookie:
+ * curl http://127.0.0.1:9791/_devlogin > /dev/null --cookie-jar /tmp/dw.cookies
+ * # then visit http://127.0.0.1:9791/ in your browser with that cookie
+ */
+const path = require('path');
+const express = require('express');
+const jwt = require('jsonwebtoken');
+const inlineEditor = require('../src/middleware');
+
+const PORT = 9791;
+const SITE = 'test.local';
+const DEV_SECRET = 'pilot-dev-secret';
+process.env.AUTH_DEV_SECRET = DEV_SECRET;
+
+const app = express();
+const uploadDir = path.join(__dirname, '..', 'tmp', 'uploads');
+app.use('/uploads', express.static(uploadDir));
+
+// Dev login — sets a signed HS256 JWT cookie as 'admin@dw'.
+app.get('/_devlogin', (_req, res) => {
+ const token = jwt.sign({
+ email: 'admin@dw',
+ role: 'admin',
+ iss: 'https://auth.agentabrams.com'
+ }, DEV_SECRET, { algorithm: 'HS256', expiresIn: '8h' });
+ res.cookie('dw_auth', token, { httpOnly: false });
+ res.type('text/plain').send(`Logged in as admin@dw. Refresh /\n`);
+});
+app.get('/_devlogout', (_req, res) => {
+ res.clearCookie('dw_auth'); res.type('text/plain').send('Logged out\n');
+});
+
+// Mount the inline editor (BEFORE the page handler that calls res.send)
+app.use(inlineEditor({
+ site: SITE,
+ uploadDir,
+ authMode: 'dev',
+ devSecret: DEV_SECRET
+}));
+
+// Sample sister-site page (kept simple — same structure as a stripped corkwallcovering or retrowalls front)
+app.get('/', (_req, res) => {
+ res.type('text/html').send(`<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8"><title>retrowalls — sample sister site</title>
+<style>
+ body { font-family: -apple-system, system-ui, sans-serif; margin: 0; color: #1a1a1a; }
+ header { padding: 32px 48px; border-bottom: 1px solid #eee; }
+ header h1 { margin: 0; font-weight: 300; letter-spacing: .5px; }
+ .hero { padding: 80px 48px; text-align: center; background: #f5f1eb; }
+ .hero h2 { font-size: 48px; font-weight: 200; margin: 0 0 16px; }
+ .hero p { font-size: 17px; color: #555; max-width: 640px; margin: 0 auto; }
+ .hero img { max-width: 100%; margin-top: 32px; }
+ .grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 32px; padding: 48px; }
+ .grid .item { border: 1px solid #eee; padding: 20px; }
+ .grid h3 { margin: 0 0 8px; }
+ footer { text-align: center; padding: 32px; border-top: 1px solid #eee; color: #888; }
+</style></head><body>
+<header>
+ <h1 id="brand">retrowalls</h1>
+ <p id="tagline">Mid-century wallcovering reissued for the modern home.</p>
+</header>
+<section class="hero" data-edit-region="true">
+ <h2>Discover the archive.</h2>
+ <p>Hand-printed wallpaper drawn from 1960s and 1970s pattern books, reissued in trade-spec rolls.</p>
+ <p><a href="/catalog">Browse the catalog</a> · <a href="/samples">Order samples</a></p>
+ <img src="https://placehold.co/1280x640/333/fff?text=Hero+Image" alt="Hero pattern showcase">
+</section>
+<section class="grid">
+ <div class="item"><h3>Nostalgia</h3><p>Patterns straight from the period archives.</p></div>
+ <div class="item"><h3>Trade-spec</h3><p>Yards, repeats, fire ratings — all there.</p></div>
+ <div class="item"><h3>Samples</h3><p>Order before you commit.</p></div>
+</section>
+<footer><a href="mailto:hi@retrowalls.example">hi@retrowalls.example</a></footer>
+</body></html>`);
+});
+
+app.listen(PORT, '127.0.0.1', () => {
+ console.log(`pilot → http://127.0.0.1:${PORT}`);
+ console.log(` admin login: http://127.0.0.1:${PORT}/_devlogin`);
+});
(oldest)
·
back to Inline Editor
·
gitignore: add backup file patterns to prevent accidental so f2e1140 →