@nanobpm/urban 0.88.0 → 0.88.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.88.0",
+	"version": "0.88.1",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/browser/runtime.browser.js

@@ -175,6 +175,74 @@ function installThemeBridge() {
   window.parent.postMessage({ type: "nano-app-ready" }, window.location.origin);
 }
 
+// ── App-View message relay (#518) ─────────────────────────────────────────
+// The App-View iframes this page currently mounts (renderAppView adds each one;
+// teardown removes it so a switched-away page's frames leave the relay set). The
+// bridge below uses this set as the trust membership: a message is only relayed
+// if ev.source is one of THESE frames' contentWindows (a nested App-View of this
+// page), never an arbitrary framed window.
+/** @type {Set<HTMLIFrameElement>} */
+const APP_VIEW_FRAMES = new Set();
+
+// The relay primitive. A nested App-View posts to `window.parent` (this page),
+// but this page installs no bridge, so the message is dropped: it never reaches
+// the console host (forward-UP) nor the page's other App-Views (relay-ACROSS).
+// This forwards a whitelisted `nano-navigate` UP to the host (chaining the same
+// hostNavigate boundary the page's own links use, so a nested App-View can drive
+// the console explorer — Preview DI, instance deep-links) and relays any other
+// App-View message ACROSS to the page's sibling App-Views (e.g. Library "Reuse"
+// → Compose fill). Deliberately generic (forward-up + broadcast-across), not a
+// per-message special case, so the whole cross-frame failure class is closed at
+// once rather than patched button-by-button.
+//
+// Trust boundary: the message must be same-origin AND from a known App-View
+// iframe of THIS page. `ev.source` alone is insufficient — the origin pin plus
+// the membership check are what actually gate the boundary, so a message from a
+// non-App-View source or a cross-origin frame is never relayed.
+/**
+ * @param {{ origin: string, source: any, data: any }} ev
+ * @param {Iterable<{ contentWindow: any }>} frames
+ * @param {{ origin: string, parent: any, embedded: boolean }} ctx
+ */
+function relayAppViewMessage(ev, frames, ctx) {
+  if (ev.origin !== ctx.origin) return;
+  const list = Array.isArray(frames) ? frames : [...frames];
+  let originFrame = null;
+  for (const f of list) {
+    if (f.contentWindow && f.contentWindow === ev.source) { originFrame = f; break; }
+  }
+  // Unknown source: not one of this page's App-Views — reject (trust boundary).
+  if (!originFrame) return;
+  const data = ev.data;
+  if (data && data.type === "nano-navigate") {
+    // Forward upward to the host/console, gated on the same same-origin embed
+    // boundary as hostNavigate: standalone (no same-origin console parent) there
+    // is nothing to forward to, so the message stays within the page.
+    if (ctx.embedded && ctx.parent) ctx.parent.postMessage(data, ctx.origin);
+    return;
+  }
+  // Relay across to the page's OTHER App-Views (never back to the originator).
+  for (const f of list) {
+    if (f === originFrame) continue;
+    const w = f.contentWindow;
+    if (w) w.postMessage(data, ctx.origin);
+  }
+}
+
+// Install the App-View relay as a single page-level `message` listener. Unlike
+// the theme bridge this is NOT gated on NANO_EMBEDDED: the sibling relay-across
+// works within a standalone page too; only the forward-up leg is embed-gated
+// (via ctx.embedded in relayAppViewMessage).
+function installAppViewBridge() {
+  window.addEventListener("message", (ev) => {
+    relayAppViewMessage(ev, APP_VIEW_FRAMES, {
+      origin: window.location.origin,
+      parent: window.parent,
+      embedded: NANO_EMBEDDED,
+    });
+  });
+}
+
 // Resolve every app endpoint against where THIS module was actually served from,
 // so absolute-looking "/app/…" paths work both at the origin root (direct run,
 // e.g. the CLI on :3000) and under a path-prefixed reverse proxy (the Nano
@@ -2769,6 +2837,13 @@ function renderAppView(node) {
   });
 
   const section = el("section", { class: "pc-appview" + (fill ? " pc-appview-fill" : "") });
+  // Register this frame in the App-View relay set (#518) so the page-level bridge
+  // can (a) recognise its outbound postMessages as coming from a known App-View of
+  // this page and (b) address it as a sibling target for another App-View's relay.
+  // A teardown disposer drops it again, so a switched-away page's frames don't
+  // linger as phantom relay endpoints.
+  APP_VIEW_FRAMES.add(frame);
+  disposers.push(() => APP_VIEW_FRAMES.delete(frame));
   // The title is an <h2> (the tag EVERY card renderer uses and makeCollapsible lifts into the
   // collapse header), not a <div>: a collapsible appView's title must be lifted out of the body,
   // otherwise it double-renders (header label + leftover in-body title). The .pc-appview-title CSS
@@ -2934,6 +3009,7 @@ function boot() {
   PARAM = parseRoute().param;
   NANO_EMBEDDED = computeEmbedded();
   installThemeBridge();
+  installAppViewBridge();
   window.addEventListener("hashchange", renderPage);
   // Re-render when the viewport crosses the mobile breakpoint so a Tier-2 'mobile'
   // variant swaps in/out on rotation or a window resize (the grid card flip, nav
@@ -2953,4 +3029,4 @@ function boot() {
 // renderer functions / RENDERERS registry can be imported directly.
 if (typeof document !== "undefined" && document.getElementById("page")) boot();
 
-export { RENDERERS, renderText, renderButton, renderProse, renderNav, renderAppView, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell, buildDetailForm, buildEngineForm, evalDetailCondition, normalizeDetailOptions, chevronToggle, setChevronOpen };
+export { RENDERERS, renderText, renderButton, renderProse, renderNav, renderAppView, relayAppViewMessage, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell, buildDetailForm, buildEngineForm, evalDetailCondition, normalizeDetailOptions, chevronToggle, setChevronOpen };

package/src/runtime/browser/runtime.browser.test.ts

@@ -7,7 +7,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { PAGE_NODE_TYPES } from "../core/page-nodes.ts";
-import { RENDERERS, renderText, renderAppView, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell } from "./runtime.browser.js";
+import { RENDERERS, renderText, renderAppView, relayAppViewMessage, navLink, sameOriginPath, wireNavBadge, applyNavBadge, teardown, fmtCellValue, gridCell } from "./runtime.browser.js";
 
 // ── Minimal fake DOM ────────────────────────────────────────────────────────
 // Just enough of the Element/Document surface that el()/renderText touch:
@@ -574,3 +574,128 @@ test("#338: a param-scoped nav badge with no route param degrades to 0 without q
   assert.equal(pill.textContent, "0", "badge degrades to 0 rather than an empty-string-filtered count");
   assert.equal(pill.hidden, false, "0 is shown (hideWhenZero is off) rather than a stale count");
 });
+
+// ── #518: App-View message relay (host-up + sibling-across bridge) ───────────
+// A nested App-View posts to `window.parent` (the Urban page). Before this fix
+// the page installed no bridge for those inbound postMessages, so a
+// `nano-navigate` never chained up to the console host (DI Preview did nothing)
+// and a sibling-directed message never reached the page's other App-Views
+// (Library "Reuse" filled nothing). relayAppViewMessage is the primitive that
+// closes that whole class: forward-up for nano-navigate, broadcast-across for
+// everything else, both behind a strict same-origin + known-App-View-source
+// trust boundary. These drive the primitive directly with fake frame windows.
+
+// A minimal Window stand-in that records its postMessage calls, used both as an
+// App-View iframe's contentWindow and as the host `window.parent`.
+function fakeWindow(): { posts: Array<{ data: unknown; origin: string }> } & {
+  postMessage(data: unknown, origin: string): void;
+} {
+  const posts: Array<{ data: unknown; origin: string }> = [];
+  return {
+    posts,
+    postMessage(data: unknown, origin: string): void {
+      posts.push({ data, origin });
+    },
+  };
+}
+
+// An App-View iframe stand-in exposing just the `.contentWindow` the relay reads.
+function fakeFrame(win: unknown): { contentWindow: unknown } {
+  return { contentWindow: win };
+}
+
+const ORIGIN = "https://app.test";
+
+test("#518: relayAppViewMessage forwards a child App-View's nano-navigate UP to the host", () => {
+  const parent = fakeWindow();
+  const composeWin = fakeWindow();
+  const compose = fakeFrame(composeWin);
+  const frames = [compose];
+  const data = { type: "nano-navigate", target: "definitionPreview", params: { xml: "<x/>" } };
+
+  relayAppViewMessage(
+    { origin: ORIGIN, source: composeWin, data },
+    frames,
+    { origin: ORIGIN, parent, embedded: true },
+  );
+
+  assert.equal(parent.posts.length, 1, "the host (window.parent) must receive the forwarded nano-navigate");
+  assert.deepEqual(parent.posts[0], { data, origin: ORIGIN });
+  // A forward-up is NOT also broadcast back into the page's App-Views.
+  assert.equal(composeWin.posts.length, 0, "nano-navigate is forwarded up, not relayed across");
+});
+
+test("#518: relayAppViewMessage relays a sibling-directed message ACROSS to the other App-Views only", () => {
+  const parent = fakeWindow();
+  const libraryWin = fakeWindow();
+  const composeWin = fakeWindow();
+  const stagedWin = fakeWindow();
+  const library = fakeFrame(libraryWin);
+  const compose = fakeFrame(composeWin);
+  const staged = fakeFrame(stagedWin);
+  const frames = [library, compose, staged];
+  const data = { type: "nano-delivery-graph-compose-fill", xml: "<definitions/>" };
+
+  relayAppViewMessage(
+    { origin: ORIGIN, source: libraryWin, data },
+    frames,
+    { origin: ORIGIN, parent, embedded: true },
+  );
+
+  // Delivered to BOTH siblings...
+  assert.deepEqual(composeWin.posts, [{ data, origin: ORIGIN }], "sibling Compose must receive the relayed message");
+  assert.deepEqual(stagedWin.posts, [{ data, origin: ORIGIN }], "sibling Staged must receive the relayed message");
+  // ...but never echoed back to the originator, nor forwarded up to the host.
+  assert.equal(libraryWin.posts.length, 0, "the originating App-View must not receive its own message back");
+  assert.equal(parent.posts.length, 0, "a sibling-directed (non-navigate) message must not be forwarded to the host");
+});
+
+test("#518: relayAppViewMessage does NOT forward up when the page is standalone (not embedded)", () => {
+  const parent = fakeWindow();
+  const composeWin = fakeWindow();
+  const compose = fakeFrame(composeWin);
+  const data = { type: "nano-navigate", target: "processExplorer", params: {} };
+
+  relayAppViewMessage(
+    { origin: ORIGIN, source: composeWin, data },
+    [compose],
+    { origin: ORIGIN, parent, embedded: false },
+  );
+
+  assert.equal(parent.posts.length, 0, "standalone: there is no same-origin console host to forward to");
+});
+
+test("#518: relayAppViewMessage rejects a message from a NON-App-View source (trust boundary)", () => {
+  const parent = fakeWindow();
+  const composeWin = fakeWindow();
+  const compose = fakeFrame(composeWin);
+  const strangerWin = fakeWindow(); // some other framed window, not one of our App-Views
+  const data = { type: "nano-navigate", target: "definitionPreview", params: {} };
+
+  relayAppViewMessage(
+    { origin: ORIGIN, source: strangerWin, data },
+    [compose],
+    { origin: ORIGIN, parent, embedded: true },
+  );
+
+  assert.equal(parent.posts.length, 0, "a message from an unknown source must not be forwarded up");
+  assert.equal(composeWin.posts.length, 0, "a message from an unknown source must not be relayed across");
+});
+
+test("#518: relayAppViewMessage rejects a CROSS-ORIGIN message even from a known App-View window", () => {
+  const parent = fakeWindow();
+  const composeWin = fakeWindow();
+  const stagedWin = fakeWindow();
+  const compose = fakeFrame(composeWin);
+  const staged = fakeFrame(stagedWin);
+  const data = { type: "nano-delivery-graph-compose-fill", xml: "<x/>" };
+
+  relayAppViewMessage(
+    { origin: "https://evil.test", source: composeWin, data },
+    [compose, staged],
+    { origin: ORIGIN, parent, embedded: true },
+  );
+
+  assert.equal(stagedWin.posts.length, 0, "a cross-origin message must not be relayed across");
+  assert.equal(parent.posts.length, 0, "a cross-origin message must not be forwarded up");
+});