@ixo/editor 6.30.1 → 6.30.2

package/dist/{chunk-MJUVGIIR.js → chunk-2XPZAUWP.js}

@@ -52374,7 +52374,7 @@ var GeneralTab18 = ({
         onHeightChange(v);
       }
     }
-  ), /* @__PURE__ */ React442.createElement(Stack323, { gap: "xs" }, /* @__PURE__ */ React442.createElement(Switch22, { label: "Allow authenticated embeds", checked: allowAuth, onChange: (event) => onAllowAuthChange(event.currentTarget.checked) }), /* @__PURE__ */ React442.createElement(Text305, { size: "xs", c: "dimmed" }, "Enable for services like Google Calendar that require cookie access. Only use with trusted URLs.")));
+  ), /* @__PURE__ */ React442.createElement(Stack323, { gap: "xs" }, /* @__PURE__ */ React442.createElement(Switch22, { label: "Allow authenticated embeds", checked: allowAuth, onChange: (event) => onAllowAuthChange(event.currentTarget.checked) }), /* @__PURE__ */ React442.createElement(Text305, { size: "xs", c: "dimmed" }, "Enable for services like Google Calendar that require cookie access. Only use with trusted URLs. Origins your workspace administrator has marked as trusted are granted this automatically.")));
 };
 
 // src/mantine/blocks/embed/template/TemplateConfig.tsx
@@ -52415,6 +52415,8 @@ var TemplateConfig18 = ({ editor, block }) => {
 
 // src/mantine/blocks/embed/sanitizeUrl.ts
 var ALLOWED_PROTOCOLS = ["https:"];
+var BASE_EMBED_SANDBOX = ["allow-scripts", "allow-forms", "allow-popups"];
+var AUTHENTICATED_EMBED_SANDBOX = ["allow-same-origin", "allow-downloads"];
 function sanitizeEmbedUrl(raw) {
   if (!raw) return null;
   try {
@@ -52426,6 +52428,30 @@ function sanitizeEmbedUrl(raw) {
   }
   return null;
 }
+function buildEmbedSandbox(raw, allowAuth, trustedOrigins = []) {
+  if (isImageUrl(raw)) return "";
+  const sandbox = new Set(BASE_EMBED_SANDBOX);
+  if ((allowAuth || isTrustedAppEmbedUrl(raw, trustedOrigins)) && !isHostOriginUrl(raw)) {
+    AUTHENTICATED_EMBED_SANDBOX.forEach((permission) => sandbox.add(permission));
+  }
+  return Array.from(sandbox).join(" ");
+}
+function isHostOriginUrl(raw) {
+  if (typeof window === "undefined") return false;
+  try {
+    return new URL(raw).origin === window.location.origin;
+  } catch {
+    return true;
+  }
+}
+function isTrustedAppEmbedUrl(raw, trustedOrigins) {
+  if (!trustedOrigins.length) return false;
+  try {
+    return trustedOrigins.includes(new URL(raw).origin);
+  } catch {
+    return false;
+  }
+}
 var IMAGE_EXTENSIONS = /\.(png|jpe?g|gif|webp|svg|bmp|ico|avif)(\?.*)?$/i;
 function isImageUrl(url) {
   try {
@@ -52445,9 +52471,10 @@ var EmbedTemplateView = ({ editor, block }) => {
   const panelId = `${EMBED_TEMPLATE_PANEL_ID}-${block.id}`;
   const panelContent = useMemo179(() => /* @__PURE__ */ React444.createElement(TemplateConfig18, { editor, block }), [editor, block]);
   const { open } = usePanel(panelId, panelContent);
+  const handlers = useBlocknoteHandlers();
   const safeUrl = sanitizeEmbedUrl(block.props.url);
   const height = Number(block.props.height) || 400;
-  const sandbox = block.props.allowAuth === "true" ? "allow-scripts allow-same-origin allow-forms allow-popups" : "allow-scripts allow-forms allow-popups";
+  const sandbox = buildEmbedSandbox(safeUrl ?? "", block.props.allowAuth === "true", handlers?.getTrustedEmbedOrigins?.() ?? []);
   return /* @__PURE__ */ React444.createElement(BaseContainer, { blockId: block.id, onClick: open, style: { minHeight: 90, justifyContent: "center" } }, /* @__PURE__ */ React444.createElement(Stack324, { gap: "xs", justify: "center" }, /* @__PURE__ */ React444.createElement(Group182, { wrap: "nowrap", align: "center" }, getIcon("code", block.props.icon), /* @__PURE__ */ React444.createElement(Stack324, { gap: 2 }, /* @__PURE__ */ React444.createElement(Text306, { fw: 500, size: "sm", contentEditable: false }, block.props.title || "Embed"), /* @__PURE__ */ React444.createElement(Text306, { size: "xs", c: "dimmed", contentEditable: false, lineClamp: 1 }, block.props.description || safeUrl || "Click to configure"))), safeUrl && /* @__PURE__ */ React444.createElement(Box79, { style: { borderRadius: 8, overflow: "hidden" } }, /* @__PURE__ */ React444.createElement(
     "iframe",
     {
@@ -52511,9 +52538,10 @@ var EmbedFlowView = ({ editor, block }) => {
   const panelId = `${EMBED_FLOW_PANEL_ID}-${block.id}`;
   const panelContent = useMemo180(() => /* @__PURE__ */ React446.createElement(FlowConfig4, { editor, block }), [editor, block]);
   const { open } = usePanel(panelId, panelContent);
+  const handlers = useBlocknoteHandlers();
   const safeUrl = sanitizeEmbedUrl(block.props.url);
   const height = Number(block.props.height) || 400;
-  const sandbox = block.props.allowAuth === "true" ? "allow-scripts allow-same-origin allow-forms allow-popups" : "allow-scripts allow-forms allow-popups";
+  const sandbox = buildEmbedSandbox(safeUrl ?? "", block.props.allowAuth === "true", handlers?.getTrustedEmbedOrigins?.() ?? []);
   return /* @__PURE__ */ React446.createElement(BaseContainer, { blockId: block.id, onClick: open, style: { minHeight: 90, justifyContent: "center" } }, /* @__PURE__ */ React446.createElement(Stack325, { gap: "xs", justify: "center" }, /* @__PURE__ */ React446.createElement(Group183, { wrap: "nowrap", align: "center" }, getIcon("code", block.props.icon), /* @__PURE__ */ React446.createElement(Stack325, { gap: 2 }, /* @__PURE__ */ React446.createElement(Text307, { fw: 500, size: "sm", contentEditable: false }, block.props.title || "Embed"), /* @__PURE__ */ React446.createElement(Text307, { size: "xs", c: "dimmed", contentEditable: false, lineClamp: 1 }, block.props.description || safeUrl || "No URL configured"))), safeUrl && /* @__PURE__ */ React446.createElement(Box80, { style: { borderRadius: 8, overflow: "hidden" } }, /* @__PURE__ */ React446.createElement(
     "iframe",
     {
@@ -57841,4 +57869,4 @@ export {
   ixoGraphQLClient,
   getEntity
 };
-//# sourceMappingURL=chunk-MJUVGIIR.js.map
+//# sourceMappingURL=chunk-2XPZAUWP.js.map