@lvce-editor/iframe-worker 1.0.0 → 1.1.0

package/dist/iframeWorkerMain.js

@@ -1,3 +1,22 @@
+const SemiColon = ';';
+const Space = ' ';
+
+const addSemicolon = line => {
+  return line + SemiColon;
+};
+
+const getContentSecurityPolicy = items => {
+  return items.map(addSemicolon).join(Space);
+};
+
+const getWebViewCsp = webView => {
+  if (webView && webView.contentSecurityPolicy) {
+    return getContentSecurityPolicy(webView.contentSecurityPolicy);
+  }
+  const csp = getContentSecurityPolicy([`default-src 'none'`, `script-src 'self'`, `style-src 'self'`, `img-src 'self'`, `media-src 'self'`]);
+  return csp;
+};
+
 const createUrl = (protocol, host) => {
   return protocol + '//' + host;
 };
@@ -7,6 +26,70 @@ const getWebViewFrameAncestors = (locationProtocol, locationHost) => {
   return frameAncestors;
 };
 
+const Web = 1;
+const Electron = 2;
+const Remote = 3;
+const Test = 4;
+
+/* istanbul ignore file */
+
+// TODO this should always be completely tree shaken out during build, maybe need to be marked as @__Pure for terser to work
+
+// TODO treeshake this function out when targeting electron
+
+/**
+ * @returns {number}
+ */
+const getPlatform = () => {
+  // @ts-ignore
+  if (typeof PLATFORM !== 'undefined') {
+    // @ts-ignore
+    return PLATFORM;
+  }
+  if (typeof process !== 'undefined' && process.env.NODE_ENV === 'test') {
+    return Test;
+  }
+  // TODO find a better way to pass runtime environment
+  if (typeof name !== 'undefined' && name.endsWith('(Electron)')) {
+    return Electron;
+  }
+  if (typeof name !== 'undefined' && name.endsWith('(Web)')) {
+    return Web;
+  }
+  return Remote;
+};
+const platform = getPlatform();
+
+const WebView = 'lvce-oss-webview';
+
+const getWebViewOrigin = webViewPort => {
+  // TODO don't hardcode protocol
+  let origin = '';
+  if (platform === Electron) {
+    origin = `${WebView}://-/`;
+  } else if (platform === Remote) {
+    origin = `http://localhost:${webViewPort}`;
+  } else {
+    origin = '*'; // TODO
+  }
+  return origin;
+};
+
+const AllowScripts = 'allow-scripts';
+const AllowSameOrigin = 'allow-same-origin';
+
+const getIframeSandbox = (webView, platform) => {
+  const extensionSandbox = webView.sandbox || [];
+  if (platform === Remote) {
+    return [AllowScripts, AllowSameOrigin, ...extensionSandbox]; // TODO maybe disallow same origin
+  }
+  if (platform === Web) {
+    return [AllowScripts, ...extensionSandbox];
+  }
+  // TODO set something for electron
+  return [...extensionSandbox];
+};
+
 const getOrigin = () => {
   return location.origin;
 };
@@ -18,10 +101,13 @@ const getProtocol = () => {
 };
 
 const commandMap = {
-  'Location.getProtocol': getProtocol,
   'Location.getHost': getHost,
   'Location.getOrigin': getOrigin,
-  'WebView.getFrameAncestors': getWebViewFrameAncestors
+  'Location.getProtocol': getProtocol,
+  'WebView.getFrameAncestors': getWebViewFrameAncestors,
+  'WebView.getOrigin': getWebViewOrigin,
+  'WebView.getSandbox': getIframeSandbox,
+  'WebView.getWebViewCsp': getWebViewCsp
 };
 
 const state = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/iframe-worker",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "",
   "main": "dist/iframeWorkerMain.js",
   "type": "module",