@1presence/bridge 0.50.0 → 0.51.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.js +25 -7
- package/package.json +1 -1
package/dist/auth.js
CHANGED
|
@@ -47,6 +47,30 @@ function openBrowser(url) {
|
|
|
47
47
|
export class AuthCancelledError extends Error {
|
|
48
48
|
constructor() { super('Sign-in cancelled — the browser tab was closed.'); }
|
|
49
49
|
}
|
|
50
|
+
/**
|
|
51
|
+
* Applies the localhost auth server's CORS headers, scoped to the legitimate
|
|
52
|
+
* PWA origin. Exported so the Private Network Access behaviour stays under test.
|
|
53
|
+
*
|
|
54
|
+
* The `Access-Control-Allow-Private-Network` reflection is load-bearing: when
|
|
55
|
+
* the HTTPS PWA (a public/secure context) fetches this 127.0.0.1 server (a
|
|
56
|
+
* private address), Chrome sends a CORS preflight carrying
|
|
57
|
+
* `Access-Control-Request-Private-Network: true`. Without the matching allow
|
|
58
|
+
* header, Chrome (PNA enforcement, ~v130+) blocks the request outright — even a
|
|
59
|
+
* plain GET, even for localhost, which is exempt from mixed-content blocking —
|
|
60
|
+
* and the PWA shows "Could not reach the bridge" though the server is up.
|
|
61
|
+
*/
|
|
62
|
+
export function applyAuthCorsHeaders(req, res, pwaOrigin) {
|
|
63
|
+
const reqOrigin = req.headers['origin'] ?? '';
|
|
64
|
+
if (pwaOrigin && reqOrigin === pwaOrigin) {
|
|
65
|
+
res.setHeader('Access-Control-Allow-Origin', pwaOrigin);
|
|
66
|
+
}
|
|
67
|
+
res.setHeader('Vary', 'Origin');
|
|
68
|
+
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
|
|
69
|
+
res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
|
|
70
|
+
if (req.headers['access-control-request-private-network'] === 'true') {
|
|
71
|
+
res.setHeader('Access-Control-Allow-Private-Network', 'true');
|
|
72
|
+
}
|
|
73
|
+
}
|
|
50
74
|
function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
|
|
51
75
|
return new Promise((resolve, reject) => {
|
|
52
76
|
let resolved = false;
|
|
@@ -74,13 +98,7 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
|
|
|
74
98
|
}
|
|
75
99
|
})();
|
|
76
100
|
const server = createServer((req, res) => {
|
|
77
|
-
|
|
78
|
-
if (pwaOrigin && reqOrigin === pwaOrigin) {
|
|
79
|
-
res.setHeader('Access-Control-Allow-Origin', pwaOrigin);
|
|
80
|
-
}
|
|
81
|
-
res.setHeader('Vary', 'Origin');
|
|
82
|
-
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
|
|
83
|
-
res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
|
|
101
|
+
applyAuthCorsHeaders(req, res, pwaOrigin);
|
|
84
102
|
if (req.method === 'OPTIONS') {
|
|
85
103
|
res.writeHead(204);
|
|
86
104
|
res.end();
|