- types.ts re-exported the interface srcset.ts declares, so every build of
an app with the layer warned Duplicated imports "JournalImageVariant"
- a test checks that every name of app/utils and app/composables has one
home
- JournalFeaturedImage renders <picture> from featured_images[].variants:
a WebP source and the original format as srcset fallback, the
original's width and height, alt; lazy in cards, eager with
fetchpriority high on the post page; unchanged without variants
- app/utils/srcset.ts (imageSrcsets) with node tests
- acme fixtures and SSR expectations for both cases
The post page links previous_in_category and next_in_category (the
Journal's opt-in scored related mode) as server-rendered links with the
title in the anchor text when the Journal answers one, else the
site-wide previous_post and next_post (postNeighbours). Types, a fixture
post and expectation lines for both cases.
The layer on vue-seo-layer: the CMS head and fallback meta, ItemList
nodes, the body link pipeline, breadcrumbs and pagination, the heading
convention in both Journal H1 modes, the postTitleTag and breadcrumbs
options, the post-title tokens, the purge route's new home, the smoke
grammar and expectation files, and upgrade notes from 0.7.
The index, category, tag and author pages add an ItemList node
(@id <page URL>#itemlist, a ListItem with the absolute URL of each post
shown, positions continuing across pages) through vue-seo-layer's
useSchemaNode, so the page keeps one JSON-LD script with one @graph
(useJournalItemList, journalItemList).
- post, index, category, tag and author pages render <SeoBreadcrumbs>
at the top of their content while journal.breadcrumbs is on (default);
false leaves the trail to the site's layout, the BreadcrumbList data
is unchanged
- JournalPagination renders <SeoPagination class-prefix="journal-pagination">
with the journal's labels: the same class names, plus page 1, the last
page, gap items, aria labels and head rel prev/next, with links in the
CMS's pagination form
- with vue-seo-layer's seo.pagination.form 'path' the module registers
<listing>/<segment>/:page routes (journalPagedRoutes), and the listing
pages read the page from the :page param or ?page (pageFromRoute)
- the category pillar text renders on page 1 only, the description on
every page; an h1 in it becomes h2 while the category row's
content_h1_to_h2 is on (absent counts as on)
- JournalPostCard: the title link is the card's only anchor; the image is
no longer a link and the separate read-more link is gone; the whole card
stays clickable through a CSS stretched link with the focus ring on the
card; prop headingLevel (2 | 3, default 2)
- related posts keep their h2 and render their cards at h3; JournalPostList
passes headingLevel through
- smoke checks headings=strict (one h1, no skipped level) and cardlinks=N
on every fixture page; expectation files for postTitleTag forced to h1
and p (the documented two-h1 and no-h1 consequences)
BREAKING CHANGE: .journal-post-card__more and the image link
(.journal-post-card__image is now a div) are removed from post cards.
- renderJournalBody runs the UI-SPEC L7 order on the sanitized body:
h1 demotion, the CMS phrase auto-links, the outbound rules and lazy,
async images, with vue-seo-layer's autolink, applyOutbound and
imageAttrs; PostBody feeds it the page's resolve answer (autolinks,
autolink_max, outbound, url) and the seo.links.newTabHint option
- the sanitizer keeps a link rel of only nofollow, sponsored and ugc
(the Blog Editor's link form, as the Journal plugin's policy does);
target is never kept, the outbound rules add it
- editor-corpus.json copied again from sm-journal-plugin (link-rel and
image-decorative entries)
- smoke:ssr script; expectations for auto-links, both new-tab modes and
the hint switched off
- extend vue-seo-layer (link dependency during development) and drop
@nuxtjs/seo: the page head, canonical and the one JSON-LD graph come
from the CMS resolve answer; the post's own title, excerpt and image
apply only while there is no CMS answer
- remove the journal sitemap source and the copied shared purge route,
library and plugin (the SEO layer serves POST /api/__site__/cache/purge);
the deprecated POST /api/__journal__/cache/purge keeps working
- post title is h1 while the Journal API reports content_h1_to_h2 on
(or absent) and p.journal-post__title while off; journal.postTitleTag
('auto' | 'h1' | 'p') overrides it; body h1 headings are demoted to h2
while the setting is on (gateJournalHtml/sanitizeJournalHtml demoteH1)
- journal.breadcrumbs option and post-title CSS tokens
- smoke harness: count=, header=, noheader= and resolves lines; the
fixture API also answers the SEO resolve and site endpoints
BREAKING CHANGE: the layer no longer installs @nuxtjs/seo (no
nuxt-site-config, nuxt-schema-org, robots or sitemap module, no
/api/__sitemap__/journal source, no useSiteConfig()); apps take their
head, sitemaps and robots from the SEO plugin through vue-seo-layer.
- journal.routes.search (off by default) registers journal-search, the
results page for ?q= in the API's relevance order (no sort is sent),
server-rendered with a Polish-aware result count.
- JournalSearchBox: an icon button and a WAI-ARIA combobox with debounced
?fields=suggest suggestions, stale answers dropped, query words marked
ignoring diacritics; a plain GET form without JS.
- The module keeps the search path out of the route cache and the sitemap
and marks it noindex, follow.
- Client: suggestPosts and the fields option; useJournalLinks.searchLink.
nuxt-site-config copies every NUXT_SITE_* variable into the public site
config, so NUXT_SITE_CACHE_PURGE_TOKEN reached every page's payload as
cachePurgeToken (and NUXT_SITE_CACHE_ALLOW_PROXIED as cacheAllowProxied).
- The purge settings move to runtimeConfig cachePurge.token
(NUXT_CACHE_PURGE_TOKEN) and cachePurge.allowProxied
(NUXT_CACHE_PURGE_ALLOW_PROXIED), outside that prefix.
- The old siteCache.* names keep working for one release: a non-empty
new token wins, either allowProxied flag turns it on, and one
deprecation warning per process names the variables (never a value).
- The shared Nitro plugin server/plugins/site-cache-purge.ts strips
cachePurgeToken and cacheAllowProxied from nuxt-site-config's stack on
site-config:init, so a site on the old names leaks nothing either; it
does nothing without nuxt-site-config.
- The shared lib, route and plugin and tests/sitePurge.test.ts are
byte-identical in vue-journal-layer, vue-menu-layer and vue-faq-layer,
with three sha256 pins.
- README: new names, the deprecation, the stripping and the advice to
rotate a token ever set under the old name.
- runtimeConfig.siteCache.allowProxied (NUXT_SITE_CACHE_ALLOW_PROXIED, default
false) lets the shared purge route accept a request that came through a
TLS-terminating proxy; the bearer token is then the only gate
- shared lib, route and spec stay byte-identical across the three layers,
with updated sha256 pins and two new sitePurge specs
- version 0.5.0
- server/lib/siteCachePurge.ts and the route, byte for byte from
vue-faq-layer (sha256 pinned in tests/sitePurge.test.ts)
- runtimeConfig.siteCache.purgeToken (NUXT_SITE_CACHE_PURGE_TOKEN) and the
'/api/__site__/**': { cache: false } route rule
- /api/__journal__/cache/purge, app/utils/siteCache.ts and
journal.cachePurgeToken unchanged, documented as aliases for one release
- version 0.4.0
Nitro's cached handler renders from a header-less copy of the request, so
under swr route rules useJournalApi, /rss.xml and the sitemap source
forwarded only the Nuxt peer and every cache miss shared one Journal API
rate-limit bucket (deferred in Phase 16). A Nitro plugin records
x-forwarded-for plus the peer in event.context.journalForwardedFor on the
request hook; the three callers forward it. Same key as the host app's
workaround, which keeps working. The acme SSR smoke's x-forwarded-for check
on the now route-cached playground is the test.
- exact names: purge auth disabled, proxied before the token, missing or
wrong bearer; purge removes every route cache entry and only those
- parsePurgeEvent kinds, control characters, 200-character cap, non-objects
- privateRevalidate with and without max-age, the 304 form, static values
- privateRevalidate sets max-age=0 on cache-control values with s-maxage
- server/plugins/journal-revalidate.ts wraps res.setHeader per request, so
Nitro's 200 and h3's 304 answers both carry it
- purge-check: max-age=0 on 200 and 304, purged _payload.json, a second
purge after re-caching, X-Real-IP refused, 404 on a server without a token
- README: cachePurgeToken row and a Site cache purge section
- POST /api/__journal__/cache/purge removes every Nitro route-cache entry
- 404 without a 32-character token or behind a proxy, 401 on a wrong bearer
token (constant-time over sha256 digests)
- routeRules keep /api/__journal__/** out of the route cache
- runtimeConfig.journal.cachePurgeToken (NUXT_JOURNAL_CACHE_PURGE_TOKEN)
- fixture API reload(); testing/purge-check.mjs proves a cached page shows
a change after a purge; the playground caches with swr 300
- expansion runs last at the sinks, never in payload transforms
- only the exact placeholder serialization expands; stable across calls
- the Go policy negatives are stripped the same way in the mirror
- htmlGate.ts mirrors the four editor-output rules of the Go policy:
figure data-embed (^youtube$) and data-id (^[A-Za-z0-9_-]{11}$),
img alt with any text, ol start (integer)
- embeds.ts: EMBED_PROVIDERS (youtube on youtube-nocookie.com),
EMBED_PLACEHOLDER and expandEmbeds
- JournalPostBody and JournalCategoryHeader render
expandEmbeds(sanitizeJournalHtml(html)); payload transforms only sanitize
- .journal-embed styles (16 / 9 block, borderless iframe)
- tests: byte copy of the editor corpus, mirror and pipeline cases;
acme hello-acme carries a placeholder and the SSR smoke checks the iframe
- README Embeds section and decision note Policy amendment
The three-regex gate could be bypassed (an attribute without a space,
<svg/onload>, entity-encoded or tab-split javascript: URLs, MathML
xlink:href, base, meta refresh, forms) and it blanked a whole post or
category when ordinary text such as "Data: 12 maja 2024" matched.
- sanitizeJournalHtml runs sanitize-html with the Journal plugin's
bluemonday policy: UGC elements plus footer, class, schema.org
microdata, four validated inline styles, footnote roles, dir=auto,
two chat transcript data attributes; http, https, mailto and
relative URLs only
- gateJournalHtml and isSafeJournalHtml keep their signatures; html is
always the sanitized value and is never blanked
- post body, category content and both page payloads are sanitized;
the blocked notice, its style and string, and the blocked props and
content_blocked field are removed
- toPostView moves to postView.ts so list pages and cards do not load
the sanitizer
- tests cover every bypass from the review, the Data:/metadata: text
and an imported author footer; the SSR smoke expects the unsafe
sample's safe paragraphs
- sanitize-html over isomorphic-dompurify: same parser and output on
server and client, no jsdom, and a declarative policy that mirrors
the Journal plugin's bluemonday allow-list
- the policy, sanitize-not-blank, and the client bundle cost
- node --test over routes, client (fake fetcher, include_empty=1),
pagination, htmlGate (Go FormatHTML parity cases), sitemap, seo and
pl/en i18n parity
- package script test and a Testing line in the README
- author pages resolve slug or login and canonicalise to the slug
- tag pages, per-page SEO meta and canonicals that keep ?page=N
- sitemap source pages the API and builds locs from journal.routes
- /rss.xml proxies the API feed with x-forwarded-for
- neutral README; version 0.1.0
- index and category pages paginate with ?page=N and 404 out of range
- category content renders above the list through the html gate
- related posts fall back to the latest posts
- --journal-* tokens and neutral base styles
- pl/en strings registered only for locales the app enables
- journal module registers the Journal pages at journal.routes paths
- typed anonymous-GET client, html gate, SSR x-forwarded-for forwarding
- fixture API, built-server SSR smoke and git-tag install check
