feat(hk): persist named table views for staff accounts

src/lib/admin/table-view-state.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import {
+	captureTableView,
+	namedTableView,
+	tableViewPath,
+} from "./table-view-state";
+
+describe("saved table views", () => {
+	it("keeps filters and sorting but discards page and credentials", () => {
+		expect(
+			captureTableView(
+				"search=test&page=4&sort=id&order=asc&filter_rank=7&token=secret&redirect=https://evil.invalid",
+				["name"],
+			),
+		).toEqual({
+			params: { search: "test", sort: "id", order: "asc", filter_rank: "7" },
+			hidden: ["name"],
+		});
+	});
+	it("rejects external and traversal paths", () => {
+		for (const path of [
+			"https://evil.invalid/admin/users",
+			"/admin/../me",
+			"//admin/users",
+			"/me",
+		])
+			expect(tableViewPath.safeParse(path).success).toBe(false);
+		expect(tableViewPath.safeParse("/admin/tickets/desk").success).toBe(true);
+	});
+	it("rejects unsafe or oversized stored state", () => {
+		expect(
+			namedTableView.safeParse({
+				name: "Test",
+				state: { params: { password: "secret" }, hidden: [] },
+			}).success,
+		).toBe(false);
+		expect(
+			namedTableView.safeParse({ name: " ", state: { params: {}, hidden: [] } })
+				.success,
+		).toBe(false);
+		expect(
+			namedTableView.safeParse({
+				name: "Test",
+				state: { params: { search: "x".repeat(201) }, hidden: [] },
+			}).success,
+		).toBe(false);
+	});
+});