@atlaskit/rovo-triggers 10.22.0 → 10.23.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @atlaskit/rovo-triggers
 
+## 10.23.0
+
+### Minor Changes
+
+- [`e07b1d5a5706a`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/e07b1d5a5706a) -
+  SECASR-8596 / SECASR-8597: pin the extension context bridge transport to a single peer origin, and
+  restrict which `set-message-context` context keys may cross it.
+
+  `createWindowTransport` gains an optional `acceptOrigin`, checked before a message is dispatched
+  to a subscriber. It defaults to `targetOrigin`, and the wildcard is refused. The chat-iframe
+  client no longer posts to `'*'`: it resolves the side panel's origin from the `extensionOrigin`
+  URL parameter and requires it to be a member of a consumer-supplied `allowedOrigins` list, so the
+  channel is pinned to the consumer's own extension rather than to any installed one. Absent either,
+  it builds no transport.
+
+  `set-message-context` now relays only allowlisted `contextKey`s. Its `data.value` is arbitrary
+  product-supplied context, so an unrecognised key is dropped before `setContext` is invoked.
+
+  `ExtensionContextBridgeHost` gains an optional `isAiEnabled`, and relays nothing when it is
+  explicitly `false`, so a tenant without Rovo entitlement never has page content cross into the
+  extension. `ChatOpenerSubscriber` resolves it from the product's Rovo entitlement store and passes
+  it down.
+
 ## 10.22.0
 
 ### Minor Changes

package/dist/cjs/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -17,6 +17,24 @@ function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbol
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 /** Selection shape preserved across editor focus loss. */
 
+/**
+ * The side panel's own origin, supplied by `buildIframeUrl()` in the extension's `sidepanel.ts`.
+ * Serves as both the `postMessage` target and the only origin this client accepts messages from.
+ *
+ * The parameter only selects which of `allowedOrigins` is the peer; it can never introduce one. So
+ * an absent parameter, an unknown extension, and an absent list all resolve to `undefined`, leaving
+ * the Client without a transport. `useSBSEvaluationBridge` reads the same parameter but falls back to
+ * `'*'` — tolerable for telemetry, not for a channel that drives editor writes.
+ */
+var getSidePanelOrigin = function getSidePanelOrigin(allowedOrigins) {
+  try {
+    var value = new URLSearchParams(window.location.search).get('extensionOrigin');
+    return value && allowedOrigins !== null && allowedOrigins !== void 0 && allowedOrigins.includes(value) ? value : undefined;
+  } catch (_unused) {
+    return undefined;
+  }
+};
+
 /**
  * Whether focus currently sits inside the chat. Confluence clears `selection` on
  * `editor-context-payload` both when the user clicks into chat and when they genuinely deselect;
@@ -40,7 +58,8 @@ var isChatFocused = function isChatFocused() {
  * Headless.
  */
 var ExtensionContextBridgeClient = exports.ExtensionContextBridgeClient = function ExtensionContextBridgeClient(_ref) {
-  var transport = _ref.transport;
+  var transport = _ref.transport,
+    allowedOrigins = _ref.allowedOrigins;
   // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
   var active = (0, _fg.fg)('rovo-ext_context_bridge');
   var publish = (0, _main.usePublish)('ai-mate');
@@ -55,14 +74,18 @@ var ExtensionContextBridgeClient = exports.ExtensionContextBridgeClient = functi
     if (typeof window === 'undefined') {
       return undefined;
     }
-    // `targetOrigin: '*'`: the receiving window (the side panel) is a different origin, so the
-    // default (`selfWindow.location.origin`) would not match.
+    var sidePanelOrigin = getSidePanelOrigin(allowedOrigins);
+    if (!sidePanelOrigin) {
+      return undefined;
+    }
+    // The side panel is a different origin to this iframe, so `targetOrigin` cannot fall back to
+    // `selfWindow.location.origin`. `acceptOrigin` follows it: the panel is the only peer.
     return (0, _transport.createWindowTransport)({
       targetWindow: window.parent,
       self: window,
-      targetOrigin: '*'
+      targetOrigin: sidePanelOrigin
     });
-  }, [active, transport]);
+  }, [active, transport, allowedOrigins]);
 
   // Inbound (READ): product context -> iframe bus.
   (0, _react.useEffect)(function () {
@@ -122,7 +145,7 @@ var ExtensionContextBridgeClient = exports.ExtensionContextBridgeClient = functi
     }
     try {
       activeTransport.send((0, _defineProperty2.default)((0, _defineProperty2.default)((0, _defineProperty2.default)({}, _constants.BRIDGE_MESSAGE_MARKER, true), "direction", _constants.BRIDGE_TO_PRODUCT), "payload", serialized));
-    } catch (_unused) {
+    } catch (_unused2) {
       // Never let bridging break the chat iframe.
     }
   });

package/dist/cjs/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -41,7 +41,8 @@ var stampProductContentId = function stampProductContentId(serialized, targetCon
  */
 var ExtensionContextBridgeHost = exports.ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref) {
   var transport = _ref.transport,
-    getContentId = _ref.getContentId;
+    getContentId = _ref.getContentId,
+    isAiEnabled = _ref.isAiEnabled;
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
   // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
   var active = (0, _fg.fg)('rovo-ext_context_bridge');
@@ -63,6 +64,12 @@ var ExtensionContextBridgeHost = exports.ExtensionContextBridgeHost = function E
     if (!activeTransport) {
       return;
     }
+    // Checked at relay time rather than when the transport is built: the product renders its
+    // `RovoEntitlementSetter` as a sibling of `ChatOpenerSubscriber`, so the store is still
+    // unpopulated on this component's first render. By the time a payload arrives it has settled.
+    if (isAiEnabled === false) {
+      return;
+    }
     // Loop guard.
     if (payload.interactionSource === _constants.BRIDGE_SOURCE) {
       return;

package/dist/cjs/common/utils/extension-context-bridge/policy.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.shouldRelayToProduct = exports.getInboundDecision = void 0;
+exports.shouldRelayToProduct = exports.isRelayableContextKey = exports.getInboundDecision = void 0;
 /**
  * Bridge relay policy, asymmetric by direction:
  * - Product → extension (context): relayed iff allowlisted and not denylisted. The denylist is a
@@ -18,6 +18,26 @@ exports.shouldRelayToProduct = exports.getInboundDecision = void 0;
 /** Inbound allowlist — payload types the bridge supports. Widen only as a feature needs it. */
 var INBOUND_ALLOWLIST = new Set(['editor-context-payload', 'set-message-context']);
 
+/**
+ * Inbound `set-message-context` allowlist, keyed on `contextKey`.
+ *
+ * The type-level allowlist is not enough for this one payload. Its `data.value` is arbitrary
+ * product-supplied context, so — unlike `editor-context-payload`, whose content a co-resident script
+ * could equally read from the DOM — it can carry data the extension has no other route to. An
+ * allowlist rather than a denylist because a denylist cannot cover keys publishers add later, which
+ * is the drift this guards against (SECASR-8597).
+ */
+var INBOUND_CONTEXT_KEYS = new Set([
+// The key every Jira view-context publisher uses. Not reachable yet — only Confluence opts into
+// the bridge, and its own publishers are merge-style, which `./registry` drops. Seeded so the
+// Jira read-context work does not have to rediscover this list.
+'jira_view_context']);
+
+/** True if a `set-message-context` payload carrying this `contextKey` may cross to the extension. */
+var isRelayableContextKey = exports.isRelayableContextKey = function isRelayableContextKey(contextKey) {
+  return INBOUND_CONTEXT_KEYS.has(contextKey);
+};
+
 /** Inbound denylist — control-plane/auth events that must never reach the extension chat. */
 var INBOUND_DENYLIST = new Set(['message-send', 'chat-new', 'chat-open', 'chat-close', 'open-smart-creation-modal', 'open-browse-agent-modal', 'open-browse-agent-sidebar', 'open-chat-debug-modal', 'open-chat-feedback-modal', 'forge-auth-success', 'forge-auth-failure', 'chat-smartlink-3p-post-auth-launch']);
 

package/dist/cjs/common/utils/extension-context-bridge/registry.js

@@ -8,6 +8,7 @@ exports.serializePayload = exports.deserializePayload = void 0;
 var _typeof2 = _interopRequireDefault(require("@babel/runtime/helpers/typeof"));
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
 var _constants = require("./constants");
+var _policy = require("./policy");
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 var base = function base(payload) {
@@ -51,6 +52,10 @@ var SHIMS = {
       if (!data || typeof data.setContext !== 'function') {
         return null;
       }
+      // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
+      if (!(0, _policy.isRelayableContextKey)(data.contextKey)) {
+        return null;
+      }
       var value;
       try {
         value = data.setContext((0, _defineProperty2.default)({}, MERGE_PROBE_KEY, true));

package/dist/cjs/common/utils/extension-context-bridge/transport.js

@@ -29,16 +29,24 @@ var createWindowTransport = exports.createWindowTransport = function createWindo
     _ref$self = _ref.self,
     selfWindow = _ref$self === void 0 ? window : _ref$self,
     _ref$targetOrigin = _ref.targetOrigin,
-    targetOrigin = _ref$targetOrigin === void 0 ? selfWindow.location.origin : _ref$targetOrigin;
+    targetOrigin = _ref$targetOrigin === void 0 ? selfWindow.location.origin : _ref$targetOrigin,
+    _ref$acceptOrigin = _ref.acceptOrigin,
+    acceptOrigin = _ref$acceptOrigin === void 0 ? targetOrigin : _ref$acceptOrigin;
   return {
     send: function send(message) {
       targetWindow.postMessage(message, targetOrigin);
     },
-    // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
     subscribe: function subscribe(handler) {
+      if (acceptOrigin === '*') {
+        return function () {};
+      }
+      // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
       return (0, _bindEventListener.bind)(selfWindow, {
         type: 'message',
         listener: function listener(event) {
+          if (event.origin !== acceptOrigin) {
+            return;
+          }
           if (isBridgeMessage(event.data)) {
             handler(event.data);
           }

package/dist/es2019/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -8,6 +8,24 @@ import { createWindowTransport } from './transport';
 
 /** Selection shape preserved across editor focus loss. */
 
+/**
+ * The side panel's own origin, supplied by `buildIframeUrl()` in the extension's `sidepanel.ts`.
+ * Serves as both the `postMessage` target and the only origin this client accepts messages from.
+ *
+ * The parameter only selects which of `allowedOrigins` is the peer; it can never introduce one. So
+ * an absent parameter, an unknown extension, and an absent list all resolve to `undefined`, leaving
+ * the Client without a transport. `useSBSEvaluationBridge` reads the same parameter but falls back to
+ * `'*'` — tolerable for telemetry, not for a channel that drives editor writes.
+ */
+const getSidePanelOrigin = allowedOrigins => {
+  try {
+    const value = new URLSearchParams(window.location.search).get('extensionOrigin');
+    return value && allowedOrigins !== null && allowedOrigins !== void 0 && allowedOrigins.includes(value) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
 /**
  * Whether focus currently sits inside the chat. Confluence clears `selection` on
  * `editor-context-payload` both when the user clicks into chat and when they genuinely deselect;
@@ -31,7 +49,8 @@ const isChatFocused = () => {
  * Headless.
  */
 export const ExtensionContextBridgeClient = ({
-  transport
+  transport,
+  allowedOrigins
 }) => {
   // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
   const active = fg('rovo-ext_context_bridge');
@@ -47,14 +66,18 @@ export const ExtensionContextBridgeClient = ({
     if (typeof window === 'undefined') {
       return undefined;
     }
-    // `targetOrigin: '*'`: the receiving window (the side panel) is a different origin, so the
-    // default (`selfWindow.location.origin`) would not match.
+    const sidePanelOrigin = getSidePanelOrigin(allowedOrigins);
+    if (!sidePanelOrigin) {
+      return undefined;
+    }
+    // The side panel is a different origin to this iframe, so `targetOrigin` cannot fall back to
+    // `selfWindow.location.origin`. `acceptOrigin` follows it: the panel is the only peer.
     return createWindowTransport({
       targetWindow: window.parent,
       self: window,
-      targetOrigin: '*'
+      targetOrigin: sidePanelOrigin
     });
-  }, [active, transport]);
+  }, [active, transport, allowedOrigins]);
 
   // Inbound (READ): product context -> iframe bus.
   useEffect(() => {

package/dist/es2019/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -33,7 +33,8 @@ const stampProductContentId = (serialized, targetContentId) => {
  */
 export const ExtensionContextBridgeHost = ({
   transport,
-  getContentId
+  getContentId,
+  isAiEnabled
 }) => {
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
   // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
@@ -56,6 +57,12 @@ export const ExtensionContextBridgeHost = ({
     if (!activeTransport) {
       return;
     }
+    // Checked at relay time rather than when the transport is built: the product renders its
+    // `RovoEntitlementSetter` as a sibling of `ChatOpenerSubscriber`, so the store is still
+    // unpopulated on this component's first render. By the time a payload arrives it has settled.
+    if (isAiEnabled === false) {
+      return;
+    }
     // Loop guard.
     if (payload.interactionSource === BRIDGE_SOURCE) {
       return;

package/dist/es2019/common/utils/extension-context-bridge/policy.js

@@ -12,6 +12,24 @@
 /** Inbound allowlist — payload types the bridge supports. Widen only as a feature needs it. */
 const INBOUND_ALLOWLIST = new Set(['editor-context-payload', 'set-message-context']);
 
+/**
+ * Inbound `set-message-context` allowlist, keyed on `contextKey`.
+ *
+ * The type-level allowlist is not enough for this one payload. Its `data.value` is arbitrary
+ * product-supplied context, so — unlike `editor-context-payload`, whose content a co-resident script
+ * could equally read from the DOM — it can carry data the extension has no other route to. An
+ * allowlist rather than a denylist because a denylist cannot cover keys publishers add later, which
+ * is the drift this guards against (SECASR-8597).
+ */
+const INBOUND_CONTEXT_KEYS = new Set([
+// The key every Jira view-context publisher uses. Not reachable yet — only Confluence opts into
+// the bridge, and its own publishers are merge-style, which `./registry` drops. Seeded so the
+// Jira read-context work does not have to rediscover this list.
+'jira_view_context']);
+
+/** True if a `set-message-context` payload carrying this `contextKey` may cross to the extension. */
+export const isRelayableContextKey = contextKey => INBOUND_CONTEXT_KEYS.has(contextKey);
+
 /** Inbound denylist — control-plane/auth events that must never reach the extension chat. */
 const INBOUND_DENYLIST = new Set(['message-send', 'chat-new', 'chat-open', 'chat-close', 'open-smart-creation-modal', 'open-browse-agent-modal', 'open-browse-agent-sidebar', 'open-chat-debug-modal', 'open-chat-feedback-modal', 'forge-auth-success', 'forge-auth-failure', 'chat-smartlink-3p-post-auth-launch']);
 

package/dist/es2019/common/utils/extension-context-bridge/registry.js

@@ -1,4 +1,5 @@
 import { BRIDGE_SOURCE } from './constants';
+import { isRelayableContextKey } from './policy';
 const base = payload => ({
   type: payload.type,
   source: payload.source,
@@ -37,6 +38,10 @@ const SHIMS = {
       if (!data || typeof data.setContext !== 'function') {
         return null;
       }
+      // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
+      if (!isRelayableContextKey(data.contextKey)) {
+        return null;
+      }
       let value;
       try {
         value = data.setContext({

package/dist/es2019/common/utils/extension-context-bridge/transport.js

@@ -18,18 +18,27 @@ export const isBridgeMessage = value => typeof value === 'object' && value !== n
 export const createWindowTransport = ({
   targetWindow,
   self: selfWindow = window,
-  targetOrigin = selfWindow.location.origin
+  targetOrigin = selfWindow.location.origin,
+  acceptOrigin = targetOrigin
 }) => ({
   send: message => {
     targetWindow.postMessage(message, targetOrigin);
   },
-  // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
-  subscribe: handler => bind(selfWindow, {
-    type: 'message',
-    listener: event => {
-      if (isBridgeMessage(event.data)) {
-        handler(event.data);
-      }
+  subscribe: handler => {
+    if (acceptOrigin === '*') {
+      return () => {};
     }
-  })
+    // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
+    return bind(selfWindow, {
+      type: 'message',
+      listener: event => {
+        if (event.origin !== acceptOrigin) {
+          return;
+        }
+        if (isBridgeMessage(event.data)) {
+          handler(event.data);
+        }
+      }
+    });
+  }
 });

package/dist/esm/common/utils/extension-context-bridge/ExtensionContextBridgeClient.js

@@ -11,6 +11,24 @@ import { createWindowTransport } from './transport';
 
 /** Selection shape preserved across editor focus loss. */
 
+/**
+ * The side panel's own origin, supplied by `buildIframeUrl()` in the extension's `sidepanel.ts`.
+ * Serves as both the `postMessage` target and the only origin this client accepts messages from.
+ *
+ * The parameter only selects which of `allowedOrigins` is the peer; it can never introduce one. So
+ * an absent parameter, an unknown extension, and an absent list all resolve to `undefined`, leaving
+ * the Client without a transport. `useSBSEvaluationBridge` reads the same parameter but falls back to
+ * `'*'` — tolerable for telemetry, not for a channel that drives editor writes.
+ */
+var getSidePanelOrigin = function getSidePanelOrigin(allowedOrigins) {
+  try {
+    var value = new URLSearchParams(window.location.search).get('extensionOrigin');
+    return value && allowedOrigins !== null && allowedOrigins !== void 0 && allowedOrigins.includes(value) ? value : undefined;
+  } catch (_unused) {
+    return undefined;
+  }
+};
+
 /**
  * Whether focus currently sits inside the chat. Confluence clears `selection` on
  * `editor-context-payload` both when the user clicks into chat and when they genuinely deselect;
@@ -34,7 +52,8 @@ var isChatFocused = function isChatFocused() {
  * Headless.
  */
 export var ExtensionContextBridgeClient = function ExtensionContextBridgeClient(_ref) {
-  var transport = _ref.transport;
+  var transport = _ref.transport,
+    allowedOrigins = _ref.allowedOrigins;
   // Self-gated. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
   var active = fg('rovo-ext_context_bridge');
   var publish = usePublish('ai-mate');
@@ -49,14 +68,18 @@ export var ExtensionContextBridgeClient = function ExtensionContextBridgeClient(
     if (typeof window === 'undefined') {
       return undefined;
     }
-    // `targetOrigin: '*'`: the receiving window (the side panel) is a different origin, so the
-    // default (`selfWindow.location.origin`) would not match.
+    var sidePanelOrigin = getSidePanelOrigin(allowedOrigins);
+    if (!sidePanelOrigin) {
+      return undefined;
+    }
+    // The side panel is a different origin to this iframe, so `targetOrigin` cannot fall back to
+    // `selfWindow.location.origin`. `acceptOrigin` follows it: the panel is the only peer.
     return createWindowTransport({
       targetWindow: window.parent,
       self: window,
-      targetOrigin: '*'
+      targetOrigin: sidePanelOrigin
     });
-  }, [active, transport]);
+  }, [active, transport, allowedOrigins]);
 
   // Inbound (READ): product context -> iframe bus.
   useEffect(function () {
@@ -116,7 +139,7 @@ export var ExtensionContextBridgeClient = function ExtensionContextBridgeClient(
     }
     try {
       activeTransport.send(_defineProperty(_defineProperty(_defineProperty({}, BRIDGE_MESSAGE_MARKER, true), "direction", BRIDGE_TO_PRODUCT), "payload", serialized));
-    } catch (_unused) {
+    } catch (_unused2) {
       // Never let bridging break the chat iframe.
     }
   });

package/dist/esm/common/utils/extension-context-bridge/ExtensionContextBridgeHost.js

@@ -34,7 +34,8 @@ var stampProductContentId = function stampProductContentId(serialized, targetCon
  */
 export var ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref) {
   var transport = _ref.transport,
-    getContentId = _ref.getContentId;
+    getContentId = _ref.getContentId,
+    isAiEnabled = _ref.isAiEnabled;
   // Self-gated (not taken from the consumer) so this cannot mount by mistake wherever
   // `ChatOpenerSubscriber` renders. Matches `BRIDGE_FEATURE_GATE` in `./constants`.
   var active = fg('rovo-ext_context_bridge');
@@ -56,6 +57,12 @@ export var ExtensionContextBridgeHost = function ExtensionContextBridgeHost(_ref
     if (!activeTransport) {
       return;
     }
+    // Checked at relay time rather than when the transport is built: the product renders its
+    // `RovoEntitlementSetter` as a sibling of `ChatOpenerSubscriber`, so the store is still
+    // unpopulated on this component's first render. By the time a payload arrives it has settled.
+    if (isAiEnabled === false) {
+      return;
+    }
     // Loop guard.
     if (payload.interactionSource === BRIDGE_SOURCE) {
       return;

package/dist/esm/common/utils/extension-context-bridge/policy.js

@@ -12,6 +12,26 @@
 /** Inbound allowlist — payload types the bridge supports. Widen only as a feature needs it. */
 var INBOUND_ALLOWLIST = new Set(['editor-context-payload', 'set-message-context']);
 
+/**
+ * Inbound `set-message-context` allowlist, keyed on `contextKey`.
+ *
+ * The type-level allowlist is not enough for this one payload. Its `data.value` is arbitrary
+ * product-supplied context, so — unlike `editor-context-payload`, whose content a co-resident script
+ * could equally read from the DOM — it can carry data the extension has no other route to. An
+ * allowlist rather than a denylist because a denylist cannot cover keys publishers add later, which
+ * is the drift this guards against (SECASR-8597).
+ */
+var INBOUND_CONTEXT_KEYS = new Set([
+// The key every Jira view-context publisher uses. Not reachable yet — only Confluence opts into
+// the bridge, and its own publishers are merge-style, which `./registry` drops. Seeded so the
+// Jira read-context work does not have to rediscover this list.
+'jira_view_context']);
+
+/** True if a `set-message-context` payload carrying this `contextKey` may cross to the extension. */
+export var isRelayableContextKey = function isRelayableContextKey(contextKey) {
+  return INBOUND_CONTEXT_KEYS.has(contextKey);
+};
+
 /** Inbound denylist — control-plane/auth events that must never reach the extension chat. */
 var INBOUND_DENYLIST = new Set(['message-send', 'chat-new', 'chat-open', 'chat-close', 'open-smart-creation-modal', 'open-browse-agent-modal', 'open-browse-agent-sidebar', 'open-chat-debug-modal', 'open-chat-feedback-modal', 'forge-auth-success', 'forge-auth-failure', 'chat-smartlink-3p-post-auth-launch']);
 

package/dist/esm/common/utils/extension-context-bridge/registry.js

@@ -3,6 +3,7 @@ import _defineProperty from "@babel/runtime/helpers/defineProperty";
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 import { BRIDGE_SOURCE } from './constants';
+import { isRelayableContextKey } from './policy';
 var base = function base(payload) {
   return {
     type: payload.type,
@@ -44,6 +45,10 @@ var SHIMS = {
       if (!data || typeof data.setContext !== 'function') {
         return null;
       }
+      // Checked before `setContext` runs, so a non-allowlisted key never invokes product code.
+      if (!isRelayableContextKey(data.contextKey)) {
+        return null;
+      }
       var value;
       try {
         value = data.setContext(_defineProperty({}, MERGE_PROBE_KEY, true));

package/dist/esm/common/utils/extension-context-bridge/transport.js

@@ -23,16 +23,24 @@ export var createWindowTransport = function createWindowTransport(_ref) {
     _ref$self = _ref.self,
     selfWindow = _ref$self === void 0 ? window : _ref$self,
     _ref$targetOrigin = _ref.targetOrigin,
-    targetOrigin = _ref$targetOrigin === void 0 ? selfWindow.location.origin : _ref$targetOrigin;
+    targetOrigin = _ref$targetOrigin === void 0 ? selfWindow.location.origin : _ref$targetOrigin,
+    _ref$acceptOrigin = _ref.acceptOrigin,
+    acceptOrigin = _ref$acceptOrigin === void 0 ? targetOrigin : _ref$acceptOrigin;
   return {
     send: function send(message) {
       targetWindow.postMessage(message, targetOrigin);
     },
-    // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
     subscribe: function subscribe(handler) {
+      if (acceptOrigin === '*') {
+        return function () {};
+      }
+      // `bind` returns its own unbind function, which is exactly the `subscribe` contract.
       return bind(selfWindow, {
         type: 'message',
         listener: function listener(event) {
+          if (event.origin !== acceptOrigin) {
+            return;
+          }
           if (isBridgeMessage(event.data)) {
             handler(event.data);
           }

package/dist/types/common/utils/extension-context-bridge/ExtensionContextBridgeClient.d.ts

@@ -2,6 +2,16 @@ import { type Transport } from './transport';
 type Props = {
     /** Override the transport (tests). Defaults to iframe<->parent `postMessage`. */
     transport?: Transport;
+    /**
+     * Full origins the chat will talk to, e.g. `chrome-extension://<id>` — not bare ids. Supplied by
+     * the consumer, which knows its own published ids, so a new extension channel needs no platform
+     * release. Must be a stable reference; the transport is memoised on it.
+     *
+     * Omitted, the Client is inert. `frame-ancestors` on this app already limits who can frame it, but
+     * any extension holding `declarativeNetRequest` can strip that header, so this list is what
+     * actually pins the channel to our own extension rather than any installed one.
+     */
+    allowedOrigins?: readonly string[];
 };
 /**
  * Chat-iframe half of the bridge.
@@ -15,5 +25,5 @@ type Props = {
  *
  * Headless.
  */
-export declare const ExtensionContextBridgeClient: ({ transport }: Props) => null;
+export declare const ExtensionContextBridgeClient: ({ transport, allowedOrigins }: Props) => null;
 export {};

package/dist/types/common/utils/extension-context-bridge/ExtensionContextBridgeHost.d.ts

@@ -4,6 +4,16 @@ type Props = {
     transport?: Transport;
     /** Resolves the current content id at relay time (a getter, so the Host reads it lazily). */
     getContentId?: () => string | undefined;
+    /**
+     * Whether the viewer is entitled to Rovo. `false` relays nothing, so a tenant with AI turned off
+     * never has page content cross into the extension (SECASR-8597).
+     *
+     * Supplied by the consumer for the same reason as `getContentId`: the signal lives in
+     * `conversation-assistant-entitlement` and this package stays clear of that dependency.
+     * `undefined` means the consumer expressed no opinion, and relaying proceeds — every in-tree
+     * mount passes it explicitly, so that only covers bespoke embeddings.
+     */
+    isAiEnabled?: boolean;
 };
 /**
  * Product-window half of the bridge. Observes the `ai-mate` bus and mirrors allowlisted context out
@@ -12,5 +22,5 @@ type Props = {
  * The reverse direction is handled by the sibling `RovoPostMessagePubsubListener` in
  * `ChatOpenerSubscriber`, not here. Headless; mounts at product root via `ChatOpenerSubscriber`.
  */
-export declare const ExtensionContextBridgeHost: ({ transport, getContentId }: Props) => null;
+export declare const ExtensionContextBridgeHost: ({ transport, getContentId, isAiEnabled, }: Props) => null;
 export {};

package/dist/types/common/utils/extension-context-bridge/policy.d.ts

@@ -1,4 +1,6 @@
 import { type Payload } from '../../../types';
+/** True if a `set-message-context` payload carrying this `contextKey` may cross to the extension. */
+export declare const isRelayableContextKey: (contextKey: string) => boolean;
 /** Why a product-bus payload was or was not relayed. */
 type InboundDecision = 'allow' | 'not-allowlisted' | 'denylisted';
 /** Classify a product-bus payload. Relay iff `allow`. */

package/dist/types/common/utils/extension-context-bridge/transport.d.ts

@@ -30,9 +30,19 @@ export type Transport = {
 };
 export declare const isBridgeMessage: (value: unknown) => value is BridgeMessage;
 /** `postMessage`-based transport. Callers override `targetWindow`/`self` for the iframe side. */
-export declare const createWindowTransport: ({ targetWindow, self: selfWindow, targetOrigin, }: {
+export declare const createWindowTransport: ({ targetWindow, self: selfWindow, targetOrigin, acceptOrigin, }: {
     targetWindow: Window;
     self?: Window;
     targetOrigin?: string;
+    /**
+     * The only origin whose messages `subscribe` dispatches. Defaults to `targetOrigin`, which is
+     * right for both halves of the bridge: each has exactly one peer, and it is the same peer in
+     * both directions.
+     *
+     * `'*'` is refused. A wildcard here would let anything able to reach this window inject context
+     * that drives editor writes. It disables `subscribe` rather than throwing, because the bridge
+     * must never break the page it runs on.
+     */
+    acceptOrigin?: string;
 }) => Transport;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@atlaskit/rovo-triggers",
-	"version": "10.22.0",
+	"version": "10.23.0",
 	"description": "Provides various trigger events to drive Rovo Chat functionality, such as a publish-subscribe and URL parameter hooks",
 	"author": "Atlassian Pty Ltd",
 	"publishConfig": {
@@ -28,7 +28,7 @@
 	],
 	"atlaskit:src": "src/index.ts",
 	"dependencies": {
-		"@atlaskit/adf-schema": "^57.1.0",
+		"@atlaskit/adf-schema": "^57.2.0",
 		"@atlaskit/platform-feature-flags": "^2.1.0",
 		"@atlaskit/react-compiler-gating": "^0.2.0",
 		"@babel/runtime": "^7.0.0",
@@ -40,11 +40,11 @@
 	"devDependencies": {
 		"@af/integration-testing": "workspace:^",
 		"@af/visual-regression": "workspace:^",
-		"@atlaskit/css": "^1.0.0",
+		"@atlaskit/css": "^1.1.0",
 		"@atlaskit/primitives": "^22.4.0",
 		"@atlaskit/ssr": "workspace:^",
 		"@atlassian/a11y-jest-testing": "^0.17.0",
-		"@atlassian/conversation-assistant-service-api": "^17.0.0",
+		"@atlassian/conversation-assistant-service-api": "^17.1.0",
 		"@atlassian/feature-flags-test-utils": "^1.2.0",
 		"@atlassian/testing-library": "^0.11.0",
 		"@testing-library/react": "^16.3.0",