@iasiv5/dsh-skins 1.5.30 → 1.5.31

package/lib/client.js

@@ -2976,7 +2976,7 @@ ${references.join("\n")}`,
     if (typeof extension !== "string" || !/^[a-z0-9]+$/.test(extension)) {
       throw new RangeError(`builtinAssetUrl: invalid extension ${JSON.stringify(extension)}`);
     }
-    const rev = "1.5.30";
+    const rev = "1.5.31";
     return `/dsh-skins/assets/b_${skinId}_${assetKey}.${extension}?v=${rev}`;
   }
 

package/lib/index.js

@@ -1183,10 +1183,31 @@ function decodeDisplayName(request) {
     throw codedError("FILENAME_INVALID", "x-filename 不是合法的 encodeURIComponent 输出");
   }
 }
+function createOfficialRejection(ctx) {
+  return (request) => {
+    let connection, reject;
+    try {
+      connection = ctx?.get?.("connection");
+      reject = connection?.requestRejection;
+    } catch {
+      return void 0;
+    }
+    if (typeof reject !== "function") return void 0;
+    try {
+      return reject.call(connection, { headers: request.headers }) ?? void 0;
+    } catch {
+      return 403;
+    }
+  };
+}
 function mountPersonalizationRoutes(host, options) {
-  const { store, assetsBasePath = "/dsh-skins/assets", trustedHosts = [], serveBuiltinAsset } = options;
+  const { store, assetsBasePath = "/dsh-skins/assets", trustedHosts = [], rejection, serveBuiltinAsset } = options;
   const disposers = [];
   const fence = (request, response) => {
+    if (rejection !== void 0 && rejection(request) !== void 0) {
+      sendJson(response, 403, { error: "trusted DSH Web request required" });
+      return false;
+    }
     if (isTrustedRequest(request, typeof trustedHosts === "function" ? trustedHosts() : trustedHosts)) return true;
     sendJson(response, 403, { error: "trusted DSH Web request required" });
     return false;
@@ -1402,6 +1423,7 @@ function apply(ctx) {
       return mountPersonalizationRoutes(hostContext, {
         store: personalization,
         trustedHosts: () => resolveTrustedHosts(ctx),
+        rejection: createOfficialRejection(ctx),
         serveBuiltinAsset
       });
     }, "dsh-skins: personalization routes");

package/package.json

@@ -2,7 +2,7 @@
   "name": "@iasiv5/dsh-skins",
   "description": "DSH Web 皮肤插件：多套品牌皮肤侧栏热切换。",
   "icon": "./icon.svg",
-  "version": "1.5.30",
+  "version": "1.5.31",
   "homepage": "https://github.com/iasiv5/dsh-skins#readme",
   "repository": {
     "type": "git",