fix(website): validate prompt API metadata

Author: ppapsmoken

website/src/lib/prompt-library.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { fetchCliMediaPromptItems } from "./prompt-library";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+function apiItem(overrides: Record<string, unknown> = {}) {
+  return {
+    artifact: { alt: "Result", kind: "image", url: "https://cdn.example.com/result.png" },
+    category: "image",
+    model: "gpt-image-2",
+    output: { label: { en: "Image" }, ratio: "4:5" },
+    prompt: "Create a product portrait.",
+    slug: "product-portrait",
+    source: { label: "Example", platform: "External", url: "https://example.com/source" },
+    summary: { en: "A product portrait prompt." },
+    tags: ["product"],
+    title: { en: "Product portrait" },
+    updatedAt: "2026-09-07",
+    ...overrides,
+  };
+}
+
+function mockPromptApi(items: unknown[]) {
+  globalThis.fetch = mock(async () =>
+    new Response(JSON.stringify({ data: { items } }), {
+      headers: { "content-type": "application/json" },
+      status: 200,
+    })) as typeof fetch;
+}
+
+describe("prompt library API normalization", () => {
+  test("preserves explicit upstream output ratios", async () => {
+    mockPromptApi([apiItem()]);
+
+    const items = await fetchCliMediaPromptItems("image");
+
+    expect(items).toHaveLength(1);
+    expect(items[0]?.output.ratio).toBe("4:5");
+  });
+
+  test("rejects non-http source URLs before they can reach links", async () => {
+    mockPromptApi([
+      apiItem({ slug: "unsafe-source", source: { label: "Unsafe", platform: "External", url: "javascript:alert(1)" } }),
+      apiItem({ slug: "safe-source" }),
+    ]);
+
+    const items = await fetchCliMediaPromptItems("image");
+
+    expect(items.map((item) => item.slug)).toEqual(["safe-source"]);
+    expect(items[0]?.source.url).toBe("https://example.com/source");
+  });
+});

website/src/lib/prompt-library.ts

@@ -1261,18 +1261,29 @@ function promptSource(value: unknown, sourcePlatform = "", sourceUrl = ""): Prom
     capturedAt: String(record.captured_at || record.capturedAt || today),
     label: String(record.label || sourcePlatform || "External"),
     platform: ["GitHub", "Social", "Official docs", "Flatkey generated", "Local migration", "External"].includes(platform) ? platform : "External",
-    url: String(record.url || sourceUrl || ""),
+    url: safeHttpUrl(record.url || sourceUrl),
   };
 }
 
+function safeHttpUrl(value: unknown): string {
+  const rawUrl = String(value || "").trim();
+  if (!rawUrl) return "";
+  try {
+    const parsed = new URL(rawUrl);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.toString() : "";
+  } catch {
+    return "";
+  }
+}
+
 function isOwnedPromptSource(source: PromptSource): boolean {
   const value = `${source.platform} ${source.label}`.toLowerCase();
   return source.platform === "Local migration" || value.includes("flatkey generated") || value.includes("owned") || value.includes("自有");
 }
 
 function outputRatio(value: unknown, artifact: PromptArtifact): PromptItem["output"]["ratio"] {
   const ratio = isRecord(value) ? String(value.ratio || "") : "";
-  if (["1:1", "3:2", "4:3", "9:16", "16:9", "3x3"].includes(ratio)) return ratio as PromptItem["output"]["ratio"];
+  if (ratio) return ratio as PromptItem["output"]["ratio"];
   return artifact.kind === "video" ? "16:9" : "1:1";
 }