feat: SaaS hero and verified-core redesign, Impact Estimator, internal-link validation in the broken-link scan

apps/cms/src/payload/lib/broken-links/extract.test.ts

@@ -82,8 +82,72 @@ describe('extractAllLinks', () => {
     );
   });
 
-  it('drops site-relative URLs and non-string scalar fields', () => {
-    const links = extractAllLinks({ body: null, applyUrl: '/internal-path', registrationUrl: null, atsUrl: 42 });
+  it('resolves site-relative URLs against the public origin, and drops non-string scalars', () => {
+    // Reverses the previous contract, which dropped these. Nothing else
+    // validates a hand-typed internal path: it carries no relationship for the
+    // slug-change hook, so `/guide/orchestration` shipped as a live 404.
+    const links = extractAllLinks(
+      { body: null, applyUrl: '/internal-path', registrationUrl: null, atsUrl: 42 },
+      'https://www.cleanstart.com',
+    );
+    expect(links).toEqual([
+      { url: 'https://www.cleanstart.com/internal-path', anchorText: null, location: 'Apply URL' },
+    ]);
+  });
+
+  it('resolves site-relative body links too, keeping the anchor text', () => {
+    const links = extractAllLinks(
+      {
+        body: wrap([
+          { type: 'link', fields: { url: '/guide/orchestration' }, children: [{ type: 'text', text: 'orchestration guide' }] },
+        ]),
+      },
+      'https://www.cleanstart.com',
+    );
+    expect(links).toEqual([
+      { url: 'https://www.cleanstart.com/guide/orchestration', anchorText: 'orchestration guide', location: 'Body' },
+    ]);
+  });
+
+  it('never rewrites a protocol-relative URL into one of ours', () => {
+    // `//other.example/path` is another host, not a site path. Prefixing the
+    // origin would silently retarget it at ourselves and report a foreign
+    // link as healthy. It has no scheme, so the SSRF guard drops it instead —
+    // the property under test is that it is not absorbed into our origin.
+    const links = extractAllLinks(
+      { body: null, applyUrl: '//other.example/path' },
+      'https://www.cleanstart.com',
+    );
+    expect(links).toEqual([]);
+    expect(JSON.stringify(links)).not.toContain('cleanstart.com');
+  });
+
+  it('collapses a relative and an absolute reference to the same page into one check', () => {
+    const links = extractAllLinks(
+      {
+        body: wrap([
+          { type: 'link', fields: { url: '/pricing' }, children: [{ type: 'text', text: 'pricing' }] },
+        ]),
+        applyUrl: 'https://www.cleanstart.com/pricing',
+      },
+      'https://www.cleanstart.com',
+    );
+    expect(links).toEqual([
+      { url: 'https://www.cleanstart.com/pricing', anchorText: 'pricing', location: 'Body' },
+    ]);
+  });
+
+  it('does not resolve anchors, mailto or tel into page URLs', () => {
+    const links = extractAllLinks(
+      {
+        body: wrap([
+          { type: 'link', fields: { url: '#section-2' } },
+          { type: 'link', fields: { url: 'mailto:hi@cleanstart.com' } },
+          { type: 'link', fields: { url: 'tel:+911234567890' } },
+        ]),
+      },
+      'https://www.cleanstart.com',
+    );
     expect(links).toEqual([]);
   });
 

apps/cms/src/payload/lib/broken-links/extract.ts

@@ -1,13 +1,21 @@
+import { resolveSiteUrl } from '../site-url';
 import { isSafePublicHttpUrl } from '../url-safety/ssrf-guard';
 
 /**
  * Walk a Lexical body + adjacent doc fields and return every external
  * URL the editor referenced, with the visible anchor text and a
  * human-readable location. Used by the nightly broken-link scanner.
  *
- * Internal-doc relationships (`linkType === 'internal'`, `doc != null`)
+ * Internal-doc *relationships* (`linkType === 'internal'`, `doc != null`)
  * are skipped — Payload's slug-change hook keeps those resolvable.
  *
+ * Hand-typed site-relative paths are NOT skipped. They carry no relationship
+ * for the slug-change hook to follow, so nothing else in the system validates
+ * them: `/guide/orchestration` and `/images/redis/details` both shipped in
+ * published bodies as 404s and went unnoticed until a manual crawl. They are
+ * resolved against the public origin so the scanner HEAD-checks them like any
+ * other link.
+ *
  * SSRF defence: every emitted URL passes `isSafePublicHttpUrl`.
  */
 
@@ -71,6 +79,17 @@ export const extractLinksFromLexical = (body: unknown): LexicalLink[] => {
 
 const isFetchSafeHttpUrl = (raw: string): boolean => isSafePublicHttpUrl(raw).ok;
 
+/**
+ * Resolve a root-relative editor link against the public origin.
+ *
+ * Only `/path` is rewritten. `//host/path` is protocol-relative and points at
+ * another origin, so prefixing it would silently retarget the link; anything
+ * else (absolute URLs, `#anchor`, `mailto:`, `tel:`) is returned untouched and
+ * falls to the SSRF guard to accept or drop.
+ */
+const absolutiseInternal = (raw: string, origin: string): string =>
+  raw.startsWith('/') && !raw.startsWith('//') ? `${origin}${raw}` : raw;
+
 const SCALAR_URL_FIELDS: ReadonlyArray<readonly [key: string, label: string]> = [
   ['applyUrl', 'Apply URL'],
   ['atsUrl', 'ATS URL'],
@@ -86,9 +105,14 @@ const SCALAR_URL_FIELDS: ReadonlyArray<readonly [key: string, label: string]> =
  * by field label). Returns absolute http(s) URLs that pass the SSRF
  * guard; first occurrence of a URL wins (body before typed fields).
  */
-export const extractAllLinks = (doc: Record<string, unknown>): ExtractedLink[] => {
+export const extractAllLinks = (
+  doc: Record<string, unknown>,
+  siteOrigin: string = resolveSiteUrl(),
+): ExtractedLink[] => {
   const byUrl = new Map<string, ExtractedLink>();
-  const add = (url: string, anchorText: string | null, location: string): void => {
+  const add = (raw: string, anchorText: string | null, location: string): void => {
+    // Dedupe on the resolved URL so `/x` and `https://site/x` collapse to one check.
+    const url = absolutiseInternal(raw, siteOrigin);
     if (isFetchSafeHttpUrl(url) && !byUrl.has(url)) {
       byUrl.set(url, { url, anchorText, location });
     }

apps/cms/src/payload/lib/page-registry-seed.ts

@@ -59,6 +59,9 @@ export const PAGE_REGISTRY_SEED: readonly PageRegistrySeedRow[] = [
   { path: '/software-bill-materials', title: 'Software Bill of Materials', kind: 'static', order: 7, webPageType: 'WebPage' },
   { path: '/for-developers', title: 'For Developers', kind: 'static', order: 8, webPageType: 'WebPage' },
   { path: '/for-ciso', title: 'For CISO', kind: 'static', order: 9, webPageType: 'WebPage' },
+  // Solutions › Capability tool. Order sits after every seeded row so existing
+  // dashboard positions keep their numbers.
+  { path: '/impact-estimator', title: 'Impact Estimator', kind: 'static', order: 49, webPageType: 'WebPage' },
 
   // Resources (mega-menu)
   { path: '/blogs', title: 'Blogs', kind: 'cms-listing', order: 10, backingCollection: 'blogs' },

apps/web/next.config.ts

@@ -79,6 +79,24 @@ const nextConfig: NextConfig = {
         destination: "/guide/:slug*",
         permanent: true,
       },
+      // Industry pages live under `/industries/`, but the slug already names
+      // the industry, so the shorter path is the natural guess and returns a
+      // hard 404. Same courtesy 301 as `/guides` above: it was never a live
+      // URL, just one worth catching. The sibling /industries/modern-applications
+      // was never indexed or linked under its earlier slugs, so it carries none.
+      {
+        source: "/financial-services-container-security",
+        destination: "/industries/financial-services-container-security",
+        permanent: true,
+      },
+      // The operational-impact estimator launched at `/roi-calculator` and was
+      // renamed while still noindex,nofollow, so nothing is indexed under the
+      // old path. It is live in the client's review links, though, so 308 it.
+      {
+        source: "/roi-calculator",
+        destination: "/impact-estimator",
+        permanent: true,
+      },
       // Canonical detail routes are singular `/event/[slug]` and `/job/[slug]`
       // (matching the indexed Webflow URLs). The redesign also shipped plural
       // aliases that rendered the same content and self-canonicalled to