@flowselections/floriday-voorraad 1.0.36 → 1.0.38

package/dist-lib/integrations/supabase/previewAuthStorage.js

@@ -0,0 +1,92 @@
+// This file is automatically generated. Do not edit it directly.
+// On a Lovable preview surface, broker the auth session to the editor over
+// postMessage so the project's preview surfaces share one login; else localStorage.
+export function brokeredPreviewStorage() {
+    if (typeof window === 'undefined')
+        return undefined;
+    const host = location.hostname;
+    const PREVIEW_ZONES = ['lovableproject.com', 'lovableproject-dev.com', 'lovable.app', 'gpt-eng.com', 'gptengineer.run'];
+    const onPreviewZone = PREVIEW_ZONES.some((z) => host === z || host.endsWith('.' + z));
+    // Read the id only from non-user-controlled host positions, so a user-named
+    // preview--<name> host can't smuggle another project's id.
+    const UUID = '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
+    const projectId = onPreviewZone
+        ? (host.match(new RegExp('^(?:id-preview(?:-[a-z0-9]+)?|project)--(' + UUID + ')(?:-dev)?(?=\\.|$)', 'i'))?.[1]
+            ?? host.match(new RegExp('^(' + UUID + ')(?=[.-])', 'i'))?.[1])
+        : undefined;
+    const framed = window.parent && window.parent !== window;
+    if (!projectId || !framed)
+        return localStorage;
+    // Post only to the real editor ancestor, validated as a Lovable origin, so the
+    // session token can never reach an untrusted embedder.
+    const dev = host.endsWith('.lovableproject-dev.com') || host.endsWith('.gpt-eng.com');
+    const EDITOR = dev
+        ? /^https:\/\/([a-z0-9-]+\.)*(lovable\.dev|gptengineer\.app)$|^http:\/\/localhost:3000$/
+        : /^https:\/\/([a-z0-9-]+\.)*(lovable\.dev|gptengineer\.app)$/;
+    const ancestor = (location.ancestorOrigins && location.ancestorOrigins[0]) || (document.referrer ? new URL(document.referrer).origin : '');
+    const editorOrigins = ancestor && EDITOR.test(ancestor)
+        ? [ancestor]
+        : (dev ? ['https://lovable.dev', 'http://localhost:3000'] : ['https://lovable.dev']);
+    const RESULT = 'lovable-preview-auth:result';
+    const TIMEOUT = 2000;
+    const newId = () => Math.random().toString(36).slice(2) + Date.now().toString(36);
+    const request = (type, key, value) => new Promise((resolve) => {
+        const requestId = newId();
+        let done = false;
+        let timer;
+        const finish = (r) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            window.removeEventListener('message', onMessage);
+            resolve(r);
+        };
+        const onMessage = (e) => {
+            if (editorOrigins.indexOf(e.origin) < 0)
+                return;
+            const d = e.data;
+            if (d && d.type === RESULT && d.requestId === requestId)
+                finish(d);
+        };
+        window.addEventListener('message', onMessage);
+        const msg = { type, requestId, projectId, key };
+        if (value !== undefined)
+            msg['value'] = value;
+        // targetOrigin per trusted editor origin, so a session token never reaches an arbitrary embedder.
+        for (const origin of editorOrigins)
+            window.parent.postMessage(msg, origin);
+        timer = setTimeout(() => finish(null), TIMEOUT);
+    });
+    // The editor may not be listening yet at the first getItem, so retry once.
+    let firstGet = true;
+    const RETRY_DELAY = 250;
+    return {
+        getItem: async (key) => {
+            let res = await request('lovable-preview-auth:get', key);
+            if (!res && firstGet) {
+                await new Promise((r) => setTimeout(r, RETRY_DELAY));
+                res = await request('lovable-preview-auth:get', key);
+            }
+            firstGet = false;
+            // '' is the logout tombstone: clear the local copy too so it can't resurrect if
+            // the broker later goes silent. A null reply means never-synced -> keep local.
+            if (res && res.ok && typeof res.value === 'string') {
+                if (res.value === '') {
+                    localStorage.removeItem(key);
+                    return null;
+                }
+                return res.value;
+            }
+            return localStorage.getItem(key);
+        },
+        setItem: (key, value) => {
+            localStorage.setItem(key, value);
+            return request('lovable-preview-auth:set', key, value).then(() => undefined);
+        },
+        removeItem: (key) => {
+            localStorage.removeItem(key);
+            return request('lovable-preview-auth:remove', key).then(() => undefined);
+        },
+    };
+}