@accelerated-agency/visual-editor 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/vite.js +15 -2
- package/package.json +1 -1
package/dist/vite.js
CHANGED
|
@@ -1769,6 +1769,19 @@ var getDefaultAnthropicApiKey = () => {
|
|
|
1769
1769
|
function createVisualEditorMiddleware(options) {
|
|
1770
1770
|
const anthropicApiKey = options?.anthropicApiKey || getDefaultAnthropicApiKey();
|
|
1771
1771
|
const enableGenerateTestApi = options?.enableGenerateTestApi ?? true;
|
|
1772
|
+
const allowedFrameOrigins = options?.allowedFrameOrigins ?? ["*"];
|
|
1773
|
+
function setFrameHeaders(req, res) {
|
|
1774
|
+
const requestOrigin = req.headers?.["origin"] || req.headers?.["referer"] || "";
|
|
1775
|
+
if (allowedFrameOrigins.includes("*")) {
|
|
1776
|
+
const frameOrigin = requestOrigin ? new URL(requestOrigin).origin : "*";
|
|
1777
|
+
res.setHeader("Content-Security-Policy", `frame-ancestors 'self' ${frameOrigin}`);
|
|
1778
|
+
} else {
|
|
1779
|
+
res.setHeader(
|
|
1780
|
+
"Content-Security-Policy",
|
|
1781
|
+
`frame-ancestors 'self' ${allowedFrameOrigins.join(" ")}`
|
|
1782
|
+
);
|
|
1783
|
+
}
|
|
1784
|
+
}
|
|
1772
1785
|
return async (req, res, next) => {
|
|
1773
1786
|
const pathname = (req.url || "").split("?")[0];
|
|
1774
1787
|
if (pathname === "/bridge.js") {
|
|
@@ -1780,7 +1793,7 @@ function createVisualEditorMiddleware(options) {
|
|
|
1780
1793
|
if (pathname === "/vvveb-editor") {
|
|
1781
1794
|
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
|
1782
1795
|
res.setHeader("Cache-Control", "no-store");
|
|
1783
|
-
|
|
1796
|
+
setFrameHeaders(req, res);
|
|
1784
1797
|
res.end(buildVvvebEditorHtml());
|
|
1785
1798
|
return;
|
|
1786
1799
|
}
|
|
@@ -1996,7 +2009,7 @@ function createVisualEditorMiddleware(options) {
|
|
|
1996
2009
|
</body>`) : html + bridgeScript;
|
|
1997
2010
|
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
|
1998
2011
|
res.setHeader("Access-Control-Allow-Origin", "*");
|
|
1999
|
-
|
|
2012
|
+
setFrameHeaders(req, res);
|
|
2000
2013
|
res.end(html);
|
|
2001
2014
|
} catch (err) {
|
|
2002
2015
|
res.statusCode = 500;
|