@amplifyup/sdk 0.1.8 → 0.1.10

package/dist/react.js

@@ -1083,6 +1083,39 @@ Available Console Commands:
       this.attachEventListeners();
     }
   }
+  /** Origins allowed to send Composer postMessage commands to the SDK. */
+  isAllowedComposerOrigin(origin) {
+    if (typeof window === "undefined") return false;
+    if (origin === window.location.origin) return true;
+    const staticAllowed = [
+      "http://localhost:5001",
+      "http://localhost:3001",
+      "https://amplifyup.ai",
+      "https://orchestrator.amplifyup.com"
+    ];
+    if (staticAllowed.includes(origin)) return true;
+    try {
+      const host = new URL(origin).hostname;
+      if (host === "amplifyup.ai" || host.endsWith(".amplifyup.ai")) return true;
+    } catch {
+    }
+    const orchestratorFromQuery = (() => {
+      try {
+        const value = new URLSearchParams(window.location.search).get("orchestratorUrl");
+        return value ? new URL(value).origin : null;
+      } catch {
+        return null;
+      }
+    })();
+    if (orchestratorFromQuery && origin === orchestratorFromQuery) return true;
+    if (this.orchestratorUrl) {
+      try {
+        if (new URL(this.orchestratorUrl).origin === origin) return true;
+      } catch {
+      }
+    }
+    return false;
+  }
   /**
    * Set up postMessage listener for highlighting commands from orchestrator
    */
@@ -1098,18 +1131,10 @@ Available Console Commands:
         currentOrigin: window.location.origin,
         data: event.data
       });
-      const allowedOrigins = [
-        "http://localhost:5001",
-        "http://localhost:3001",
-        "https://orchestrator.amplifyup.com"
-      ];
-      const isSameOrigin = event.origin === window.location.origin;
-      const isAllowedOrigin = allowedOrigins.some((origin) => event.origin.startsWith(origin));
-      if (!isSameOrigin && !isAllowedOrigin) {
+      if (!this.isAllowedComposerOrigin(event.origin)) {
         console.warn("[AmplifyUp SDK] Rejected message from unauthorized origin:", {
           eventOrigin: event.origin,
-          currentOrigin: window.location.origin,
-          allowedOrigins
+          currentOrigin: window.location.origin
         });
         return;
       }
@@ -1922,7 +1947,7 @@ function AmplifyRenderer({
   return /* @__PURE__ */ jsxRuntime.jsx("main", { children: layoutTree.map((node) => /* @__PURE__ */ jsxRuntime.jsx("div", { children: renderNode(node) }, node.id)) });
 }
 function defaultPreviewCanvas() {
-  return /* @__PURE__ */ jsxRuntime.jsx("main", { className: "min-h-[50vh] w-full", children: /* @__PURE__ */ jsxRuntime.jsx(
+  return /* @__PURE__ */ jsxRuntime.jsx(
     "div",
     {
       "data-slot-id": "main",
@@ -1930,7 +1955,7 @@ function defaultPreviewCanvas() {
       "data-slot-empty": "true",
       className: "min-h-[50vh] w-full"
     }
-  ) });
+  );
 }
 function hasAmplifyLayout(pageConfig) {
   return !!(pageConfig && pageConfig.id !== "default" && Array.isArray(pageConfig.layoutTree) && pageConfig.layoutTree.length > 0);