seo: align public identity and social metadata
This commit is contained in:
@@ -26,11 +26,6 @@ const prohibitedSurfaces = [
|
||||
];
|
||||
|
||||
const escapeRegularExpression = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
|
||||
const escapeHtml = (value) => value
|
||||
.replace(/&/gu, '&')
|
||||
.replace(/</gu, '<')
|
||||
.replace(/>/gu, '>')
|
||||
.replace(/"/gu, '"');
|
||||
|
||||
const readRequiredText = async (root, name) => {
|
||||
try {
|
||||
@@ -272,22 +267,79 @@ const assertSemanticHtml = (html, inputs, contract) => {
|
||||
}
|
||||
};
|
||||
|
||||
const assertMetadata = (html, inputs) => {
|
||||
const expectedTitle = escapeHtml(inputs.content.metadata.title);
|
||||
const title = exactlyOneMatch(html, /<title>([\s\S]*?)<\/title>/gu, 'page title');
|
||||
if (title[1] !== expectedTitle) throw new Error('Page title does not match public content.');
|
||||
const canonical = exactlyOneMatch(html, /<link rel="canonical" href="([^"]+)" \/>/gu, 'canonical link');
|
||||
if (canonical[1] !== inputs.site.canonicalUrl) throw new Error('Canonical URL does not match site config.');
|
||||
const description = exactlyOneMatch(html, /<meta name="description" content="([^"]+)" \/>/gu, 'meta description');
|
||||
if (description[1] !== escapeHtml(inputs.content.metadata.description)) {
|
||||
throw new Error('Meta description does not match public content.');
|
||||
}
|
||||
for (const property of ['og:type', 'og:title', 'og:description', 'og:url']) {
|
||||
exactlyOneMatch(html, new RegExp(`<meta property="${property}" content="[^"]+" \\/>`, 'gu'), `${property} metadata`);
|
||||
}
|
||||
const ogImages = [...html.matchAll(/<meta property="og:image"/gu)];
|
||||
if (inputs.content.metadata.socialPreviewAssetId === undefined && ogImages.length !== 0) {
|
||||
throw new Error('Open Graph image must be omitted without an approved manifest asset.');
|
||||
const exactlyOneElement = (document, selector, label) => {
|
||||
const elements = [...document.querySelectorAll(selector)];
|
||||
if (elements.length !== 1) throw new Error(`Expected exactly one ${label}.`);
|
||||
return elements[0];
|
||||
};
|
||||
|
||||
const assertMetadata = (html, expected) => {
|
||||
const window = new Window();
|
||||
window.document.write(html);
|
||||
const document = window.document;
|
||||
try {
|
||||
const title = exactlyOneElement(document, 'title', 'page title');
|
||||
if (title.textContent !== expected.title) throw new Error('Page title does not match public metadata.');
|
||||
const canonical = exactlyOneElement(document, 'link[rel~="canonical"]', 'canonical link');
|
||||
if (canonical.getAttribute('href') !== expected.canonicalUrl) {
|
||||
throw new Error('Canonical URL does not match public metadata.');
|
||||
}
|
||||
const description = exactlyOneElement(document, 'meta[name="description"]', 'meta description');
|
||||
if (description.getAttribute('content') !== expected.description) {
|
||||
throw new Error('Meta description does not match public metadata.');
|
||||
}
|
||||
const robots = exactlyOneElement(document, 'meta[name="robots"]', 'robots metadata');
|
||||
if (robots.getAttribute('content') !== expected.robots) {
|
||||
throw new Error('Robots metadata does not match the configured environment.');
|
||||
}
|
||||
if (document.querySelectorAll('meta[name="keywords"]').length !== 0) {
|
||||
throw new Error('Meta keywords are not part of the public metadata contract.');
|
||||
}
|
||||
|
||||
for (const [property, value] of [
|
||||
['og:type', expected.openGraph.type],
|
||||
['og:title', expected.openGraph.title],
|
||||
['og:description', expected.openGraph.description],
|
||||
['og:url', expected.openGraph.url],
|
||||
]) {
|
||||
const node = exactlyOneElement(document, `meta[property="${property}"]`, `${property} metadata`);
|
||||
if (node.getAttribute('content') !== value) {
|
||||
throw new Error(`${property} metadata does not match public metadata or the canonical URL.`);
|
||||
}
|
||||
}
|
||||
const ogImages = [...document.querySelectorAll('meta[property="og:image"]')];
|
||||
if (expected.openGraph.image === undefined) {
|
||||
if (ogImages.length !== 0) throw new Error('og:image must be omitted without an approved manifest asset.');
|
||||
} else {
|
||||
const image = exactlyOneElement(document, 'meta[property="og:image"]', 'og:image metadata');
|
||||
if (image.getAttribute('content') !== expected.openGraph.image) {
|
||||
throw new Error('og:image metadata does not match the approved manifest image.');
|
||||
}
|
||||
}
|
||||
|
||||
for (const [name, value] of [
|
||||
['twitter:card', expected.twitter.card],
|
||||
['twitter:title', expected.twitter.title],
|
||||
['twitter:description', expected.twitter.description],
|
||||
]) {
|
||||
const node = exactlyOneElement(document, `meta[name="${name}"]`, `${name} metadata`);
|
||||
if (node.getAttribute('content') !== value) {
|
||||
throw new Error(`${name} metadata does not match public metadata.`);
|
||||
}
|
||||
}
|
||||
const twitterImages = [...document.querySelectorAll('meta[name="twitter:image"]')];
|
||||
if (expected.twitter.image === undefined) {
|
||||
if (twitterImages.length !== 0) {
|
||||
throw new Error('twitter:image must be omitted without an approved manifest image.');
|
||||
}
|
||||
} else {
|
||||
const image = exactlyOneElement(document, 'meta[name="twitter:image"]', 'twitter:image metadata');
|
||||
if (image.getAttribute('content') !== expected.twitter.image) {
|
||||
throw new Error('twitter:image metadata does not match the approved manifest image.');
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
window.close();
|
||||
}
|
||||
|
||||
const jsonLdMatch = exactlyOneMatch(
|
||||
@@ -301,21 +353,17 @@ const assertMetadata = (html, inputs) => {
|
||||
} catch {
|
||||
throw new Error('JSON-LD is malformed.');
|
||||
}
|
||||
if (/"(?:streetAddress|postalCode|telephone|image|interactionStatistic)"\s*:/iu.test(jsonLdMatch[1])) {
|
||||
throw new Error('JSON-LD contains unsafe private, portrait, or interaction metadata.');
|
||||
}
|
||||
if (jsonLd['@type'] !== 'ProfilePage' || jsonLd.mainEntity?.['@type'] !== 'Person') {
|
||||
throw new Error('JSON-LD must contain one ProfilePage with one nested Person.');
|
||||
}
|
||||
const person = jsonLd.mainEntity;
|
||||
if (
|
||||
person.name !== inputs.content.identity.name ||
|
||||
person.jobTitle !== inputs.content.identity.role ||
|
||||
person.url !== inputs.site.canonicalUrl ||
|
||||
jsonLd.url !== inputs.site.canonicalUrl
|
||||
) {
|
||||
throw new Error('JSON-LD identity or canonical URL is inconsistent.');
|
||||
if (JSON.stringify(jsonLd.mainEntity.homeLocation) !== JSON.stringify(expected.jsonLd.mainEntity.homeLocation)) {
|
||||
throw new Error('JSON-LD location must contain only the approved public city and country code.');
|
||||
}
|
||||
const expectedSameAs = inputs.content.contact.social.map((link) => link.url);
|
||||
if (JSON.stringify(person.sameAs ?? []) !== JSON.stringify(expectedSameAs)) {
|
||||
throw new Error('JSON-LD sameAs contains an unverified or missing profile.');
|
||||
if (jsonLdMatch[1] !== expected.serializedJsonLd) {
|
||||
throw new Error('JSON-LD does not exactly match the derived public metadata.');
|
||||
}
|
||||
if (jsonLdMatch[1].toLowerCase().includes('</script')) throw new Error('JSON-LD contains a script-closing hazard.');
|
||||
return jsonLdMatch[1];
|
||||
@@ -379,11 +427,8 @@ const assertCrawlArtifacts = async (root, inputs, headers) => {
|
||||
}
|
||||
};
|
||||
|
||||
const assertExactHostArtifacts = async (root, inputs) => {
|
||||
const expected = createStaticHostArtifacts(
|
||||
createPageMetadata(inputs.content, inputs.manifest, inputs.site),
|
||||
inputs.site,
|
||||
);
|
||||
const assertExactHostArtifacts = async (root, inputs, metadata) => {
|
||||
const expected = createStaticHostArtifacts(metadata, inputs.site);
|
||||
const actualHeaders = await readRequiredText(root, '_headers.example');
|
||||
if (actualHeaders !== expected.headers) throw new Error('Headers must exactly equal the generated expected headers.');
|
||||
const actualRobots = await readRequiredText(root, 'robots.txt');
|
||||
@@ -397,6 +442,7 @@ const assertExactHostArtifacts = async (root, inputs) => {
|
||||
};
|
||||
|
||||
export const verifyArtifactDirectory = async (root, inputs, contractInput) => {
|
||||
const metadata = createPageMetadata(inputs.content, inputs.manifest, inputs.site);
|
||||
const contract = parseArtifactContract(contractInput);
|
||||
const html = await readRequiredText(root, 'index.html');
|
||||
const files = await listArtifacts(root);
|
||||
@@ -405,8 +451,8 @@ export const verifyArtifactDirectory = async (root, inputs, contractInput) => {
|
||||
await assertNoProhibitedSurfaces(root, files);
|
||||
assertTrustedHtmlAssets(html, contract);
|
||||
assertSemanticHtml(html, inputs, contract);
|
||||
const serializedJsonLd = assertMetadata(html, inputs);
|
||||
await assertExactHostArtifacts(root, inputs);
|
||||
const serializedJsonLd = assertMetadata(html, metadata);
|
||||
await assertExactHostArtifacts(root, inputs, metadata);
|
||||
const headers = await readRequiredText(root, '_headers.example');
|
||||
assertSecurityHeaders(headers, inputs, serializedJsonLd);
|
||||
await assertCrawlArtifacts(root, inputs, headers);
|
||||
|
||||
Reference in New Issue
Block a user