@elliemae/pui-app-bridge 2.28.5 → 2.28.6

package/dist/types/lib/tests/resolveSameOriginFrameSrc.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/lib/utils.d.ts

@@ -6,3 +6,39 @@ export declare const resolveManifestBaseUrl: (hostUrl: string, manifestPath: str
 export declare const resolveManifestUrl: (hostUrl: string, manifestPath: string) => string;
 export declare const isJSDOM: () => boolean;
 export declare const escapeRegExp: (str: string) => string;
+/**
+ * Rewrites a child iframe `src` so it is same-origin with the document that
+ * creates it.
+ *
+ * App Bridge must read and mutate the child iframe's `contentDocument` after
+ * load (inject `<base href>`, etc.). Browsers only expose `contentDocument`
+ * when the iframe URL shares the creator's origin.
+ *
+ * Consider a three-level stack — **grandparent → parent → child** (e.g.
+ * encw → prospects → incomplete-apps):
+ *
+ * - **Grandparent** hosts the parent inside its iframe (e.g. encw at
+ * `http://localhost:3000`).
+ * - **Parent** is a guest of the grandparent but acts as a **host** when it
+ * opens the child. Its JavaScript runs in the grandparent's iframe document
+ * (e.g. `http://localhost:3000/latest/frame.html`), not on the parent's
+ * dev-server origin (e.g. `http://localhost:4004`).
+ * - **Child** is loaded by the parent via App Bridge. The bundled default
+ * `frame.html` URL is built from the parent's build and often points at the
+ * parent's or child's dev-server origin (e.g. `:4004` or `:8080`).
+ *
+ * If the parent creates the child's iframe with that cross-origin `frame.html`
+ * URL while its own code executes on `:3000`, the browser treats the child
+ * shell as cross-origin. `Frame.create` cannot access `contentDocument` and
+ * times out after 10s.
+ *
+ * When origins differ, this helper rewrites the src to
+ * `{window.location.origin}/{version}/frame.html` — the **parent document's**
+ * origin (which, when nested, is the grandparent's iframe origin). The child's
+ * JS bundles are still fetched from the correct guest URL via `<base href>`.
+ * @param frameSrc - Raw iframe src from bundled `frame.html` or caller
+ *   `frameOptions.src`.
+ * @returns The original src when already same-origin; otherwise a same-origin
+ *   `frame.html` URL. On parse failure, returns `frameSrc` unchanged.
+ */
+export declare const resolveSameOriginFrameSrc: (frameSrc: string) => string;