export interface StandaloneDashboardOptions {
title?: string;
projectName: string;
authToken: string;
}
function escapeHtml(value: string): string {
return value
.replaceAll("&", "&")
.replaceAll("<", "<")
.replaceAll(">", ">")
.replaceAll('"', """)
.replaceAll("'", "'");
}
/**
* JSON is valid JavaScript, but raw `<`, `&`, and the two JavaScript line
* separator characters are unsafe inside an inline script element. Escaping
* them keeps even an attacker-controlled token from terminating the script.
*/
function serializeInlineJson(value: string): string {
return JSON.stringify(value)
.replaceAll("<", "\\u003c")
.replaceAll(">", "\\u003e")
.replaceAll("&", "\\u0026")
.replaceAll("\u2028", "\\u2028")
.replaceAll("\u2029", "\\u2029");
}
/**
* Render the dependency-free dashboard served by the standalone workflow
* runtime. All run data is rendered client-side with textContent/createElement;
* the only dynamic values in the initial document are escaped here.
*/
export function renderStandaloneDashboard(options: StandaloneDashboardOptions): string {
const title = escapeHtml(options.title ?? "动态工作流");
const projectName = escapeHtml(options.projectName);
const authToken = serializeInlineJson(options.authToken);
return `
${title}
`;
}