@heybox/hb-sdk 0.7.3 → 0.7.4-alpha.4

package/dist/protocol.cjs.js

@@ -1,293 +1,32 @@
 'use strict';
 
-/** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
-const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
-/** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 2;
-/** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
-const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
-/** SDK 初始化时发给父容器的握手方法名。 */
-const SDK_HANDSHAKE_METHOD = 'sdk.handshake';
-/** Runtime 主动探测 SDK 当前文档地址的内部方法名。 */
-const RUNTIME_LOCATION_PROBE_METHOD = 'runtime.location.probe';
-/** SDK 向 Runtime 报告当前文档地址的内部方法名。 */
-const SDK_LOCATION_REPORT_METHOD = 'sdk.location.report';
-/** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
-const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
-
-/**
- * 判断未知数据是否符合小程序 bridge 消息信封。
- *
- * @param value 待判断的未知数据。
- * @returns 当数据满足小程序 bridge 消息基础结构时返回 `true`。
- */
-function isMiniProgramBridgeMessage(value) {
-    if (!value || typeof value !== 'object') {
-        return false;
-    }
-    const message = value;
-    return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
-        (message.version === 1 || message.version === 2) &&
-        typeof message.nonce === 'string' &&
-        typeof message.type === 'string');
-}
-
-function readBrowserEnvironment() {
-    try {
-        return {
-            activeElement: globalThis.document?.activeElement ?? null,
-            userActivation: globalThis.navigator?.userActivation,
-        };
-    }
-    catch {
-        return { activeElement: null };
-    }
-}
-/** 按当前浏览器消息、用户激活和目标 iframe 焦点生成请求级可信手势快照。 */
-function computeTrustedIframeUserGesture(event, iframe, environment = readBrowserEnvironment()) {
-    return (event.isTrusted === true
-        && environment.userActivation?.isActive === true
-        && environment.activeElement === iframe);
-}
-
-const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
-/**
- * 判断 permission key 是否由 Runtime 权限快照管理。
- *
- * @param key 待判断的 permission key。
- * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
- */
-function isManagedMiniProgramRuntimePermissionKey(key) {
-    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
-}
-/**
- * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
- *
- * @param snapshot 待校验的服务端权限快照。
- * @returns 解析状态和通过校验的受管权限。
- */
-function parseMiniProgramRuntimePermissions(snapshot) {
-    if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
-        return { valid: false, permissions: {} };
-    }
-    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
-        return { valid: false, permissions: {} };
-    }
-    const seenKeys = new Set();
-    const permissions = {};
-    for (const rawEntry of snapshot.entries) {
-        if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
-            return { valid: false, permissions: {} };
-        }
-        const key = rawEntry.key.trim();
-        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
-            return { valid: false, permissions: {} };
-        }
-        seenKeys.add(key);
-        if (!isManagedMiniProgramRuntimePermissionKey(key)) {
-            continue;
-        }
-        if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
-            return { valid: false, permissions: {} };
-        }
-        permissions[key] = {
-            key,
-            status: rawEntry.status,
-            config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
-        };
-    }
-    return { valid: true, permissions };
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
-    'xiaoheihe.cn',
-    'max-c.com',
-    'debugmode.cn',
-    'maxjia.com',
-];
-/** Runtime / Host 在 `network.request` 分发前拒绝的小程序服务端私有路径前缀。 */
-const MINI_PROGRAM_NETWORK_PROTECTED_PATHS = [
-    '/user_miniprogram/runtime/auth',
-    '/user_miniprogram/openapi/v1',
-];
-const NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS = 4;
-/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
-function isOfficialMiniProgramNetworkUrl(value) {
-    try {
-        const url = new URL(value);
-        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-            return false;
-        }
-        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
-        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * 规范化并判断 pathname 是否命中 Runtime Auth / OpenAPI 保护前缀。
- * 解码失败或仍可继续解码时视为不安全路径。
- */
-function isProtectedMiniProgramNetworkPath(pathname) {
-    const normalized = normalizeMiniProgramNetworkPathname(pathname);
-    if (normalized === null) {
-        return true;
-    }
-    return MINI_PROGRAM_NETWORK_PROTECTED_PATHS.some(prefix => normalized === prefix || normalized.startsWith(`${prefix}/`));
-}
-function normalizeMiniProgramNetworkPathname(pathname) {
-    let decoded = pathname;
-    for (let round = 0; round < NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
-        let next;
-        try {
-            next = decodeURIComponent(decoded);
-        }
-        catch {
-            return null;
-        }
-        if (next === decoded) {
-            return normalizeDecodedNetworkPathname(decoded);
-        }
-        decoded = next;
-    }
-    try {
-        if (decodeURIComponent(decoded) !== decoded) {
-            return null;
-        }
-    }
-    catch {
-        return null;
-    }
-    return normalizeDecodedNetworkPathname(decoded);
-}
-function normalizeDecodedNetworkPathname(decoded) {
-    const segments = [];
-    for (const segment of decoded.replace(/\\/g, '/').split('/')) {
-        if (!segment || segment === '.') {
-            continue;
-        }
-        if (segment === '..') {
-            segments.pop();
-            continue;
-        }
-        segments.push(segment);
-    }
-    return `/${segments.join('/')}`;
-}
-
-/**
- * 登录授权能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const AUTH_LOGIN_METHOD = 'auth.login';
-/** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
 const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
-/** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
 const USER_GET_STEAM_GAME_LIST_METHOD = 'user.getSteamGameList';
-/**
- * 展示分享面板能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const SHARE_SHOW_SHARE_MENU_METHOD = 'share.showShareMenu';
-/**
- * 截图分享能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const SHARE_SCREENSHOT_METHOD = 'share.screenshot';
-/**
- * 视口窗口信息能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const VIEWPORT_GET_WINDOW_INFO_METHOD = 'viewport.getWindowInfo';
-/**
- * 设置导航栏样式能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD = 'viewport.setNavigationBarStyle';
-/**
- * 读取小程序隔离 storage 能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const STORAGE_GET_STORAGE_METHOD = 'storage.getStorage';
-/**
- * 写入小程序隔离 storage 能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const STORAGE_SET_STORAGE_METHOD = 'storage.setStorage';
-/**
- * 发起网络请求能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const NETWORK_REQUEST_METHOD = 'network.request';
-/** 展示 toast 能力方法名。 */
 const UI_SHOW_TOAST_METHOD = 'ui.showToast';
-/** 展示全局 loading 能力方法名。 */
 const UI_SHOW_LOADING_METHOD = 'ui.showLoading';
-/** 隐藏全局 loading 能力方法名。 */
 const UI_HIDE_LOADING_METHOD = 'ui.hideLoading';
-/** 震动反馈能力方法名。 */
 const DEVICE_VIBRATE_METHOD = 'device.vibrate';
-/** 写入文本剪贴板能力方法名。 */
 const DEVICE_SET_CLIPBOARD_METHOD = 'device.setClipboard';
-/** 关闭当前小程序容器能力方法名。 */
 const NAVIGATION_CLOSE_METHOD = 'navigation.close';
-/** 重载当前小程序容器能力方法名。 */
 const NAVIGATION_RELOAD_METHOD = 'navigation.reload';
-/** 打开黑盒 App 页面能力方法名。 */
 const NAVIGATION_OPEN_APP_PAGE_METHOD = 'navigation.openAppPage';
-/** 提交当前用户排行榜分数能力方法名。 */
 const CLOUD_LEADERBOARD_SUBMIT_METHOD = 'cloud.leaderboard.submit';
-/** 读取排行榜列表能力方法名。 */
 const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
-/** 读取当前用户排行榜记录能力方法名。 */
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
-/** 删除当前用户排行榜记录能力方法名。 */
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
-/** 读取排行榜基础信息能力方法名。 */
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
-/**
- * 小程序开放能力目录。
- *
- * @remarks
- * 新增 bridge method 时应先更新这里，再分别补齐 SDK 模块、runtime handler 与测试。
- */
 const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
-    {
-        method: AUTH_LOGIN_METHOD,
-        module: 'auth',
-        capability: AUTH_LOGIN_METHOD,
-        permission: 'auth.login',
-        risk: 'medium',
-    },
-    {
-        method: USER_GET_INFO_METHOD,
-        module: 'user',
-        capability: USER_GET_INFO_METHOD,
-        permission: 'user.getInfo',
-        risk: 'medium',
-    },
+    { method: AUTH_LOGIN_METHOD, module: 'auth', capability: AUTH_LOGIN_METHOD, permission: 'auth.login', risk: 'medium' },
+    { method: USER_GET_INFO_METHOD, module: 'user', capability: USER_GET_INFO_METHOD, permission: 'user.getInfo', risk: 'medium' },
     {
         method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
@@ -302,20 +41,8 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'user.platformAccount.steam',
         risk: 'high',
     },
-    {
-        method: SHARE_SHOW_SHARE_MENU_METHOD,
-        module: 'share',
-        capability: SHARE_SHOW_SHARE_MENU_METHOD,
-        permission: 'share.basic',
-        risk: 'low',
-    },
-    {
-        method: SHARE_SCREENSHOT_METHOD,
-        module: 'share',
-        capability: SHARE_SCREENSHOT_METHOD,
-        permission: 'share.screenshot',
-        risk: 'medium',
-    },
+    { method: SHARE_SHOW_SHARE_MENU_METHOD, module: 'share', capability: SHARE_SHOW_SHARE_MENU_METHOD, permission: 'share.basic', risk: 'low' },
+    { method: SHARE_SCREENSHOT_METHOD, module: 'share', capability: SHARE_SCREENSHOT_METHOD, permission: 'share.screenshot', risk: 'medium' },
     {
         method: VIEWPORT_GET_WINDOW_INFO_METHOD,
         module: 'viewport',
@@ -330,55 +57,13 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'viewport.navigationBarStyle',
         risk: 'low',
     },
-    {
-        method: STORAGE_GET_STORAGE_METHOD,
-        module: 'storage',
-        capability: STORAGE_GET_STORAGE_METHOD,
-        permission: 'storage.read',
-        risk: 'low',
-    },
-    {
-        method: STORAGE_SET_STORAGE_METHOD,
-        module: 'storage',
-        capability: STORAGE_SET_STORAGE_METHOD,
-        permission: 'storage.write',
-        risk: 'medium',
-    },
-    {
-        method: NETWORK_REQUEST_METHOD,
-        module: 'network',
-        capability: NETWORK_REQUEST_METHOD,
-        permission: 'network.request',
-        risk: 'high',
-    },
-    {
-        method: UI_SHOW_TOAST_METHOD,
-        module: 'ui',
-        capability: UI_SHOW_TOAST_METHOD,
-        permission: 'ui.toast',
-        risk: 'low',
-    },
-    {
-        method: UI_SHOW_LOADING_METHOD,
-        module: 'ui',
-        capability: UI_SHOW_LOADING_METHOD,
-        permission: 'ui.loading',
-        risk: 'low',
-    },
-    {
-        method: UI_HIDE_LOADING_METHOD,
-        module: 'ui',
-        capability: UI_HIDE_LOADING_METHOD,
-        permission: 'ui.loading',
-        risk: 'low',
-    },
-    {
-        method: DEVICE_VIBRATE_METHOD,
-        module: 'device',
-        capability: DEVICE_VIBRATE_METHOD,
-        permission: 'device.vibrate',
-        risk: 'low',
-    },
+    { method: STORAGE_GET_STORAGE_METHOD, module: 'storage', capability: STORAGE_GET_STORAGE_METHOD, permission: 'storage.read', risk: 'low' },
+    { method: STORAGE_SET_STORAGE_METHOD, module: 'storage', capability: STORAGE_SET_STORAGE_METHOD, permission: 'storage.write', risk: 'medium' },
+    { method: NETWORK_REQUEST_METHOD, module: 'network', capability: NETWORK_REQUEST_METHOD, permission: 'network.request', risk: 'high' },
+    { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, permission: 'ui.toast', risk: 'low' },
+    { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
+    { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
+    { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, permission: 'device.vibrate', risk: 'low' },
     {
         method: DEVICE_SET_CLIPBOARD_METHOD,
         module: 'device',
@@ -386,20 +71,8 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'device.clipboard.write',
         risk: 'medium',
     },
-    {
-        method: NAVIGATION_CLOSE_METHOD,
-        module: 'navigation',
-        capability: NAVIGATION_CLOSE_METHOD,
-        permission: 'navigation.close',
-        risk: 'medium',
-    },
-    {
-        method: NAVIGATION_RELOAD_METHOD,
-        module: 'navigation',
-        capability: NAVIGATION_RELOAD_METHOD,
-        permission: 'navigation.reload',
-        risk: 'medium',
-    },
+    { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, permission: 'navigation.close', risk: 'medium' },
+    { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, permission: 'navigation.reload', risk: 'medium' },
     {
         method: NAVIGATION_OPEN_APP_PAGE_METHOD,
         module: 'navigation',
@@ -444,9 +117,66 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
-/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
+const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
+const SDK_HANDSHAKE_METHOD = 'sdk.handshake';
+const RUNTIME_LOCATION_PROBE_METHOD = 'runtime.location.probe';
+const SDK_LOCATION_REPORT_METHOD = 'sdk.location.report';
+const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
+
+function isMiniProgramBridgeMessage(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const message = value;
+    return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
+        (message.version === 1 || message.version === 2) &&
+        typeof message.nonce === 'string' &&
+        typeof message.type === 'string');
+}
+
+/** 当前用户信息与登录能力支持的完整 scope 目录。 */
 const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
 
+const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
+function isManagedMiniProgramRuntimePermissionKey(key) {
+    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
+}
+function parseMiniProgramRuntimePermissions(snapshot) {
+    if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+        return { valid: false, permissions: {} };
+    }
+    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
+        return { valid: false, permissions: {} };
+    }
+    const seenKeys = new Set();
+    const permissions = {};
+    for (const rawEntry of snapshot.entries) {
+        if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+            return { valid: false, permissions: {} };
+        }
+        const key = rawEntry.key.trim();
+        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
+            return { valid: false, permissions: {} };
+        }
+        seenKeys.add(key);
+        if (!isManagedMiniProgramRuntimePermissionKey(key))
+            continue;
+        if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
+            return { valid: false, permissions: {} };
+        }
+        permissions[key] = {
+            key,
+            status: rawEntry.status,
+            config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
+        };
+    }
+    return { valid: true, permissions };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 exports.AUTH_LOGIN_METHOD = AUTH_LOGIN_METHOD;
 exports.CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD;
 exports.CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD;
@@ -458,7 +188,6 @@ exports.DEVICE_VIBRATE_METHOD = DEVICE_VIBRATE_METHOD;
 exports.MINI_PROGRAM_BRIDGE_NONCE_PARAM = MINI_PROGRAM_BRIDGE_NONCE_PARAM;
 exports.MINI_PROGRAM_MESSAGE_NAMESPACE = MINI_PROGRAM_MESSAGE_NAMESPACE;
 exports.MINI_PROGRAM_MESSAGE_VERSION = MINI_PROGRAM_MESSAGE_VERSION;
-exports.MINI_PROGRAM_NETWORK_PROTECTED_PATHS = MINI_PROGRAM_NETWORK_PROTECTED_PATHS;
 exports.MINI_PROGRAM_PROTOCOL_CAPABILITIES = MINI_PROGRAM_PROTOCOL_CAPABILITIES;
 exports.NAVIGATION_CLOSE_METHOD = NAVIGATION_CLOSE_METHOD;
 exports.NAVIGATION_OPEN_APP_PAGE_METHOD = NAVIGATION_OPEN_APP_PAGE_METHOD;
@@ -481,10 +210,6 @@ exports.USER_INFO_AUTHORIZATION_SCOPES = USER_INFO_AUTHORIZATION_SCOPES;
 exports.USER_REVOKE_AUTHORIZATION_METHOD = USER_REVOKE_AUTHORIZATION_METHOD;
 exports.VIEWPORT_GET_WINDOW_INFO_METHOD = VIEWPORT_GET_WINDOW_INFO_METHOD;
 exports.VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD = VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD;
-exports.computeTrustedIframeUserGesture = computeTrustedIframeUserGesture;
 exports.isManagedMiniProgramRuntimePermissionKey = isManagedMiniProgramRuntimePermissionKey;
 exports.isMiniProgramBridgeMessage = isMiniProgramBridgeMessage;
-exports.isOfficialMiniProgramNetworkUrl = isOfficialMiniProgramNetworkUrl;
-exports.isProtectedMiniProgramNetworkPath = isProtectedMiniProgramNetworkPath;
-exports.normalizeMiniProgramNetworkPathname = normalizeMiniProgramNetworkPathname;
 exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;