@neta-art/cohub 8.20.0 → 8.20.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +15 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -4648,6 +4648,20 @@ function clonePermissionScopes(scopes) {
|
|
|
4648
4648
|
return Array.from(scopes ?? []).filter((scope) => typeof scope === "string");
|
|
4649
4649
|
}
|
|
4650
4650
|
/**
|
|
4651
|
+
* Invocation contexts can originate in reactive host state. Copy nested
|
|
4652
|
+
* objects before putting the context on a postMessage payload: a shallow copy
|
|
4653
|
+
* of the invocation itself would leave `embedder` as a framework Proxy.
|
|
4654
|
+
*/
|
|
4655
|
+
function cloneInvocation(invocation) {
|
|
4656
|
+
return {
|
|
4657
|
+
...invocation,
|
|
4658
|
+
...invocation.embedder ? { embedder: {
|
|
4659
|
+
appId: invocation.embedder.appId,
|
|
4660
|
+
slug: invocation.embedder.slug
|
|
4661
|
+
} } : {}
|
|
4662
|
+
};
|
|
4663
|
+
}
|
|
4664
|
+
/**
|
|
4651
4665
|
* Scopes arriving over postMessage are untrusted: keep only known permission
|
|
4652
4666
|
* names (in first-seen order, deduplicated) so a malicious app cannot push
|
|
4653
4667
|
* arbitrary strings, duplicates, or oversized arrays into the consent dialog.
|
|
@@ -4918,7 +4932,7 @@ function createAppBridgeCore(config) {
|
|
|
4918
4932
|
},
|
|
4919
4933
|
space: { id: app.spaceId },
|
|
4920
4934
|
viewer: viewerUuid ? { userUuid: viewerUuid } : null,
|
|
4921
|
-
...invocation ? { invocation:
|
|
4935
|
+
...invocation ? { invocation: cloneInvocation(invocation) } : {},
|
|
4922
4936
|
...shell ? { shell: {
|
|
4923
4937
|
...shell,
|
|
4924
4938
|
space: shell.space ? { ...shell.space } : null,
|