@every-app/sdk 0.1.10 → 0.1.12

package/src/tanstack/server/authenticateRequest.ts

@@ -8,6 +8,11 @@ import {
 
 import type { AuthConfig } from "./types.js";
 import { env } from "cloudflare:workers";
+import {
+  BYPASS_GATEWAY_LOCAL_ONLY_TOKEN,
+  createBypassGatewayLocalOnlySessionPayload,
+  isBypassGatewayLocalOnlyServer,
+} from "../../shared/bypassGatewayLocalOnly.js";
 
 /**
  * JWT payload structure for embedded app session tokens.
@@ -35,6 +40,14 @@ export async function authenticateRequest(
   const request = providedRequest || getRequest();
   const authHeader = request.headers.get("authorization");
 
+  const bypassGatewayLocalOnlyEnv = (
+    env as { BYPASS_GATEWAY_LOCAL_ONLY?: string }
+  ).BYPASS_GATEWAY_LOCAL_ONLY;
+  const isBypassGatewayLocalOnly =
+    import.meta.env.PROD !== true &&
+    (bypassGatewayLocalOnlyEnv === "true" ||
+      isBypassGatewayLocalOnlyServer() === true);
+
   if (!authHeader) {
     return null;
   }
@@ -45,6 +58,14 @@ export async function authenticateRequest(
     return null;
   }
 
+  if (isBypassGatewayLocalOnly) {
+    if (token !== BYPASS_GATEWAY_LOCAL_ONLY_TOKEN) {
+      return null;
+    }
+
+    return createBypassGatewayLocalOnlySessionPayload(authConfig.audience);
+  }
+
   try {
     const session = await verifySessionToken(token, authConfig);
     return session;

package/src/tanstack/useEveryAppRouter.tsx

@@ -1,6 +1,7 @@
 import { useEffect } from "react";
 import { SessionManager } from "../core/sessionManager.js";
 import { useRouter } from "@tanstack/react-router";
+import { parseMessagePayload } from "../shared/parseMessagePayload.js";
 
 interface UseEveryAppRouterParams {
   sessionManager: SessionManager | null;
@@ -11,15 +12,20 @@ export function useEveryAppRouter({ sessionManager }: UseEveryAppRouterParams) {
   // Route synchronization effect
   useEffect(() => {
     if (!sessionManager) return;
+
     // Listen for route sync messages from parent
     const handleMessage = (event: MessageEvent) => {
-      if (event.origin !== sessionManager.parentOrigin) return;
+      // Validate origin based on environment
+      if (!sessionManager.isTrustedHostMessage(event)) return;
+
+      const data = parseMessagePayload(event.data);
+      if (!data) return;
 
       if (
-        event.data.type === "ROUTE_CHANGE" &&
-        event.data.direction === "parent-to-child"
+        data.type === "ROUTE_CHANGE" &&
+        data.direction === "parent-to-child"
       ) {
-        const targetRoute = event.data.route;
+        const targetRoute = typeof data.route === "string" ? data.route : null;
         const currentRoute = window.location.pathname;
 
         // Only navigate if the route is different from current location
@@ -44,16 +50,17 @@ export function useEveryAppRouter({ sessionManager }: UseEveryAppRouterParams) {
 
       lastReportedPath = currentPath;
 
-      if (window.parent !== window) {
-        window.parent.postMessage(
-          {
-            type: "ROUTE_CHANGE",
-            route: currentPath,
-            appId: sessionManager.appId,
-            direction: "child-to-parent",
-          },
-          sessionManager.parentOrigin,
-        );
+      const message = {
+        type: "ROUTE_CHANGE",
+        route: currentPath,
+        appId: sessionManager.appId,
+        direction: "child-to-parent",
+      };
+
+      try {
+        sessionManager.postToHost(message);
+      } catch {
+        return;
       }
     };
     // Listen to popstate for browser back/forward

package/src/tanstack/useSessionTokenClientMiddleware.ts

@@ -1,9 +1,21 @@
 import { createMiddleware } from "@tanstack/react-start";
 import type { SessionManager } from "../core/sessionManager.js";
+import {
+  BYPASS_GATEWAY_LOCAL_ONLY_TOKEN,
+  isBypassGatewayLocalOnlyClient,
+} from "../shared/bypassGatewayLocalOnly.js";
 
 export const useSessionTokenClientMiddleware = createMiddleware({
   type: "function",
 }).client(async ({ next }) => {
+  if (isBypassGatewayLocalOnlyClient()) {
+    return next({
+      headers: {
+        Authorization: `Bearer ${BYPASS_GATEWAY_LOCAL_ONLY_TOKEN}`,
+      },
+    });
+  }
+
   // Get the global sessionManager - this MUST be available for embedded apps
   const sessionManager = (window as any)
     .__embeddedSessionManager as SessionManager;