@pyric/cli 0.1.0-alpha.27 → 0.1.0-alpha.28

package/src/remote/local-storage-url.ts

@@ -1,61 +1,4 @@
 /**
  * The host's URL for an object an app server holds a production download URL for.
  */
-import { parseStorageUrl, type StorageLocation } from 'pyric/storage/internal';
-import { storageObjectPath } from '../serve/worker/protocol.js';
-
-/** The hosts production serves Storage objects from. */
-const PRODUCTION_STORAGE_HOSTS = new Set([
-  'firebasestorage.googleapis.com',
-  'storage.googleapis.com',
-  'storage.cloud.google.com',
-]);
-
-/** Cloud Storage's JSON API paths, which share `storage.googleapis.com` but do not start with a bucket. */
-const JSON_API_PATH = /^\/(?:download\/|upload\/)?storage\/v1\//;
-
-/** The bucket and object a production URL names, or undefined when it names none. */
-function productionLocationOf(url: URL): StorageLocation | undefined {
-  const isProductionHost = PRODUCTION_STORAGE_HOSTS.has(url.hostname);
-  if (!isProductionHost) return undefined;
-  const isJsonApi = JSON_API_PATH.test(url.pathname);
-  if (isJsonApi) return undefined;
-  let location: StorageLocation;
-  try {
-    location = parseStorageUrl(url.href);
-  } catch {
-    return undefined;
-  }
-  const namesAnObject = location.path !== '';
-  if (!namesAnObject) return undefined;
-  return location;
-}
-
-/**
- * The byte route URL, on the host at `hostOrigin`, for the object a production
- * download URL names.
- *
- * It takes the download URL form
- * (`https://firebasestorage.googleapis.com/v0/b/<bucket>/o/<path>?alt=media&token=…`)
- * and the Cloud Storage forms (`https://storage.googleapis.com/<bucket>/<path>`,
- * `storage.cloud.google.com`), names the same bucket and object on the host's
- * byte route, and keeps the URL's `token`. A token set through
- * `firebaseStorageDownloadTokens` therefore grants the local URL as it granted
- * the production one. Other query parameters, such as `generation`, name
- * production state and are dropped. A Cloud Storage URL carries no token, so
- * the host grants its local URL only once a token is added to it.
- *
- * Returns undefined for a URL that names no object on those hosts.
- */
-export function localStorageUrl(productionUrl: string, hostOrigin: string): string | undefined {
-  let url: URL;
-  try {
-    url = new URL(productionUrl);
-  } catch {
-    return undefined;
-  }
-  const location = productionLocationOf(url);
-  if (location === undefined) return undefined;
-  const token = url.searchParams.get('token') ?? undefined;
-  return new URL(storageObjectPath(location.bucket, location.path, token), hostOrigin).href;
-}
+export { localStorageUrl } from 'pyric/storage/internal';

package/src/serve/assets/avatar-route.ts

@@ -76,7 +76,11 @@ export function avatarUidFromPath(pathname: string): string | null {
  * invokes the configured source, which may cost money and writes a cache
  * file. `Sec-Fetch-Site` is set by the browser, not the page, so a
  * `cross-site` value is a reliable statement that the application under
- * development did not make this request.
+ * development did not start the source. Such a request is still answered
+ * from the cache, the pool, or the generated fallback, because the
+ * application's own opaque-origin documents (a sandboxed blob-URL or srcdoc
+ * iframe showing `user.photoURL`) are cross-site too, and a production photo
+ * URL loads anywhere.
  *
  * Absence means allow: native clients, `curl`, and older browsers send no
  * such header, and this route is not the place to break them.
@@ -123,15 +127,10 @@ export async function handleAvatar(
       .end('method not allowed');
     return;
   }
-  if (isCrossSiteRequest(req)) {
-    res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
-      .end('cross-site avatar requests are refused');
-    return;
-  }
-
   const assetRequest: AssetRequest = {
     key: uid,
     seed: seedFor(uid, url.searchParams.get('d')),
+    ...(isCrossSiteRequest(req) ? { sourceAllowed: false } : {}),
     context: {
       uid,
       displayName: url.searchParams.get('n'),

package/src/serve/assets/resolver.ts

@@ -22,6 +22,9 @@ export interface AssetRequest {
   key: string;
   seed: string;
   context: Record<string, unknown>;
+  /** `false` answers from the cache, the pool, or the fallback and never
+   *  starts the source. Absent means the source may run. */
+  sourceAllowed?: boolean;
 }
 
 export type AssetResult = { url: string } | { data: Uint8Array; contentType: string };
@@ -259,7 +262,7 @@ export function createAssetResolver(opts: AssetResolverOptions): AssetResolver {
       // Missing/unreadable file: fall through as a miss, same as no entry.
     }
 
-    if (opts.source) {
+    if (opts.source && req.sourceAllowed !== false) {
       let pending = inFlight.get(req.key);
       if (!pending) {
         // Counted per new invocation, not per request: joining an in-flight

package/src/serve/entries/app-client.ts

@@ -5,6 +5,7 @@ import type { ClientDb } from '../worker/client.js';
 import type { InboundMessage } from '../worker/protocol.js';
 import { ownClientUntilPagehide } from '../worker/client/pagehide.js';
 import { openWorkerDb } from './worker-runtime.js';
+import { realmOrigin } from 'pyric/sandbox/internal';
 
 const clients = new WeakMap<FirebaseApp, ClientDb>();
 
@@ -21,7 +22,13 @@ export function workerClientForApp(app: FirebaseApp): ClientDb {
   client.port.postMessage({
     t: 'appConfig',
     options: app.options as Record<string, unknown>,
+    ...pageOriginScope(),
   } satisfies InboundMessage);
   clients.set(app, client);
   return client;
 }
+
+function pageOriginScope(): { origin?: string } {
+  const origin = realmOrigin();
+  return origin === null ? {} : { origin };
+}

package/src/serve/vite-plugin.ts

@@ -60,6 +60,7 @@ import { createVitePageRuntime } from './vite-page-runtime.js';
 import { stampHostedTarget } from './runtime/hosted-target.js';
 import { installViteNetGuard } from './vite-net-guard.js';
 import { attachViteSsrActivation } from './vite-ssr-activation.js';
+import { createServiceWorkerWiring, type ServiceWorkerWiringContext } from './vite-service-worker.js';
 import type { SwapEnvironment, SwapResolveContext } from './vite-module-swap.js';
 
 /** Vite 6's `configEnvironment` hook, which the Vite 5 `Plugin` type does not declare. */
@@ -199,6 +200,12 @@ export interface PyricOptions {
    *  the avatar route entirely. An object supplies a custom source that
    *  runs in the dev server, never the browser. */
   avatars?: PyricAvatarsOptions;
+  /** The app's own service worker module (path from the Vite root), such as a
+   *  `vite-plugin-pwa` `injectManifest` source. In dev, the plugin adds a fetch
+   *  listener to it that answers production Storage download URLs from the
+   *  sandbox (`sandboxStorageFetch` from `pyric/storage/sw`), so the file needs
+   *  no Pyric import. Builds are untouched. */
+  serviceWorker?: string;
 }
 
 function resolveFunctionsOptions(
@@ -255,6 +262,8 @@ export function pyric(options: PyricOptions = {}): Plugin & EnvironmentHooks {
     workerRuntime,
   };
   const pageRuntime = createVitePageRuntime(pageRuntimeInput);
+  const serviceWorkerWiring = createServiceWorkerWiring(options.serviceWorker);
+  let serviceWorkerContext: ServiceWorkerWiringContext = { root: process.cwd(), devServer: false };
   const moduleSwap = createViteModuleSwap(moduleContext, {
     getAiMode: () => pageRuntime.ai().mode,
   });
@@ -290,6 +299,7 @@ export function pyric(options: PyricOptions = {}): Plugin & EnvironmentHooks {
       // the dev server: a build or a preview runs no server-rendered app code.
       const isDevServer = env.command === 'serve' && env.isPreview !== true;
       if (isDevServer) installViteNetGuard();
+      serviceWorkerContext = { ...serviceWorkerContext, devServer: isDevServer };
       const moduleConfig = moduleSwap.config({ devServer: isDevServer });
       const pageConfig = pageRuntime.config(config, env);
       const serverWatchConfig: UserConfig = {
@@ -309,6 +319,7 @@ export function pyric(options: PyricOptions = {}): Plugin & EnvironmentHooks {
 
     async configResolved(resolved) {
       moduleSwap.configResolved(resolved);
+      serviceWorkerContext = { ...serviceWorkerContext, root: resolved.root };
       // A sandbox build stamps pages without a dev server, so configureServer
       // never reads pyric.json for it.
       const isBuild = resolved.command === 'build';
@@ -332,7 +343,10 @@ export function pyric(options: PyricOptions = {}): Plugin & EnvironmentHooks {
       },
 
       transform(code, id, transformOptions) {
-        if (hostedInstanceId === undefined || transformOptions?.ssr === true) return null;
+        if (transformOptions?.ssr === true) return null;
+        const wiredServiceWorker = serviceWorkerWiring.transform(code, id, serviceWorkerContext);
+        if (wiredServiceWorker !== null) return wiredServiceWorker;
+        if (hostedInstanceId === undefined) return null;
         const cleanId = id.split('?')[0];
         if (cleanId === entries.app || cleanId === entries['messaging-sw']) {
           return `globalThis.__PYRIC_HOST_INSTANCE_ID__=${JSON.stringify(hostedInstanceId)};\n${code}`;

package/src/serve/vite-service-worker.ts

@@ -0,0 +1,44 @@
+/**
+ * The Vite plugin's `serviceWorker` option. In dev, the app's own service
+ * worker module gets a fetch listener, ahead of the app's code, that answers
+ * production Storage URLs from the sandbox with `pyric/storage/sw`. The helper
+ * is imported by an absolute path from Pyric's own install, so the app needs
+ * no Pyric import and its production build is untouched.
+ */
+import { isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export interface ServiceWorkerWiringContext {
+  /** Vite's resolved root, which a relative `serviceWorker` path is read from. */
+  readonly root: string;
+  /** Whether this is the dev server; builds and previews are never wired. */
+  readonly devServer: boolean;
+}
+
+export interface ServiceWorkerWiring {
+  /** The wired source of `id`, or null when `id` is not the app's service worker in dev. */
+  transform(code: string, id: string, context: ServiceWorkerWiringContext): string | null;
+}
+
+function storageFetchListener(): string {
+  const helper = fileURLToPath(import.meta.resolve('pyric/storage/sw'));
+  return [
+    `import { sandboxStorageFetch as __pyricSandboxStorageFetch } from ${JSON.stringify(helper)};`,
+    "self.addEventListener('fetch', (event) => {",
+    '  if (__pyricSandboxStorageFetch(event)) event.stopImmediatePropagation();',
+    '});',
+    '',
+  ].join('\n');
+}
+
+export function createServiceWorkerWiring(serviceWorker: string | undefined): ServiceWorkerWiring {
+  return {
+    transform(code, id, { root, devServer }) {
+      if (serviceWorker === undefined || !devServer) return null;
+      const file = (isAbsolute(serviceWorker) ? serviceWorker : resolve(root, serviceWorker)).replaceAll('\\', '/');
+      const isServiceWorker = id.split('?')[0] === file;
+      if (!isServiceWorker) return null;
+      return storageFetchListener() + code;
+    },
+  };
+}

package/src/serve/worker/client/auth.ts

@@ -14,6 +14,7 @@ import type {
   ResolvedIdentity,
   OpMessage,
 } from '../protocol.js';
+import { absolutePhotoUrl, realmOrigin } from 'pyric/sandbox/internal';
 import { closeSubscription, isDisconnectedPort, nextId, nextSubId, openSnapshotSubscription, rpc, wirePort } from './core.js';
 import type { ClientDb, ClientPort, Unsubscribe } from './handles.js';
 
@@ -94,7 +95,7 @@ function makeClientUser(port: ClientPort, raw: SerializedUser): ClientUser {
     email: raw.email,
     emailVerified: raw.emailVerified,
     displayName: raw.displayName,
-    photoURL: raw.photoURL,
+    photoURL: absolutePhotoUrl(raw.photoURL, realmOrigin()),
     phoneNumber: raw.phoneNumber,
     isAnonymous: raw.isAnonymous,
     tenantId: raw.tenantId ?? null,
@@ -373,7 +374,7 @@ export async function updateProfile(
   })) as SerializedUser;
   const mutable = user as { -readonly [K in keyof ClientUser]: ClientUser[K] };
   mutable.displayName = raw.displayName;
-  mutable.photoURL = raw.photoURL;
+  mutable.photoURL = absolutePhotoUrl(raw.photoURL, realmOrigin());
   mutable.providerData = raw.providerData;
 }
 
@@ -384,7 +385,7 @@ export async function reload(user: ClientUser): Promise<void> {
   mutable.email = raw.email;
   mutable.emailVerified = raw.emailVerified;
   mutable.displayName = raw.displayName;
-  mutable.photoURL = raw.photoURL;
+  mutable.photoURL = absolutePhotoUrl(raw.photoURL, realmOrigin());
   mutable.phoneNumber = raw.phoneNumber;
   mutable.providerData = raw.providerData;
   mutable.tenantId = raw.tenantId ?? null;

package/src/serve/worker/host/auth-action-codes.ts

@@ -2,7 +2,7 @@ import { applyActionCode, checkActionCode, confirmPasswordReset, sendEmailVerifi
   sendPasswordResetEmail, sendSignInLinkToEmail, sandbox, verifyBeforeUpdateEmail, verifyPasswordResetCode } from 'pyric/auth';
 import { resolveEmailLinkIdentity } from 'pyric/auth/internal';
 import type { OpMessage } from '../protocol.js';
-import { ensureAuth, portSession, setPortSession } from '../host-auth.js';
+import { ensureAuth, portOriginScope, portSession, setPortSession } from '../host-auth.js';
 import { bestEffortFlush, fail, ok, type HostCtx, type PortLike } from '../host-context.js';
 import { credReply, requireMatchingPortSession } from './auth-session-seeder.js';
 
@@ -32,7 +32,7 @@ export async function handleAuthActionCodeOp(ctx: HostCtx, port: PortLike, messa
       case 'auth.signInWithEmailLink': {
         const { user, isNewUser } = resolveEmailLinkIdentity(auth, message.email, message.link);
         const session = sandbox.mintSession(auth, { kind: 'provider', uid: user.uid,
-          providerId: 'password', tenantId: message.tenantId ?? null });
+          providerId: 'password', tenantId: message.tenantId ?? null, ...portOriginScope(port) });
         await bestEffortFlush(ctx, message.method);
         setPortSession(ctx, port, session);
         ok(port, message.id, credReply(session, null, isNewUser));

package/src/serve/worker/host/auth-custom-token.ts

@@ -1,7 +1,7 @@
 import { sandbox } from 'pyric/auth';
 import { resolveCustomTokenIdentity } from 'pyric/auth/internal';
 import type { OpMessage } from '../protocol.js';
-import { ensureAuth, setPortSession } from '../host-auth.js';
+import { ensureAuth, portOriginScope, setPortSession } from '../host-auth.js';
 import { bestEffortFlush, fail, ok, type HostCtx, type PortLike } from '../host-context.js';
 import { credReply } from './auth-session-seeder.js';
 
@@ -13,7 +13,9 @@ export async function handleCustomTokenSignIn(
   try {
     const auth = ensureAuth(ctx);
     const { user, isNewUser } = resolveCustomTokenIdentity(auth, message.customToken);
-    const session = sandbox.mintSession(auth, { kind: 'custom', uid: user.uid, tenantId: message.tenantId ?? null });
+    const session = sandbox.mintSession(auth, {
+      kind: 'custom', uid: user.uid, tenantId: message.tenantId ?? null, ...portOriginScope(port),
+    });
     await bestEffortFlush(ctx, message.method);
     setPortSession(ctx, port, session);
     ok(port, message.id, credReply(session, null, isNewUser));

package/src/serve/worker/host/dispatch.ts

@@ -39,6 +39,7 @@ import {
   handleAuthSub,
   handleAuthUnsub,
   cleanupPortSession,
+  setPortOrigin,
 } from '../host-auth.js';
 import {
   eventSubsFor,
@@ -218,6 +219,7 @@ export async function handleMessage(
 
   const configuresApp = msg.t === 'appConfig';
   if (configuresApp) {
+    if (msg.origin !== undefined) setPortOrigin(targetPort, msg.origin);
     handleAppConfig(ctx, targetPort, msg, stalePort => cleanupPort(ctx, stalePort));
     return;
   }

package/src/serve/worker/host-auth.ts

@@ -60,6 +60,7 @@ import { reauthenticateSession } from './host/auth-reauthentication.js';
 const _authSubs = new WeakMap<HostCtx, Map<PortLike, Map<string, 'authState' | 'idToken'>>>();
 const _portTenants = new WeakMap<HostCtx, Map<PortLike, string | null>>();
 const _lastAuthStateUid = new WeakMap<PortLike, string | null>();
+const _portOrigins = new WeakMap<PortLike, string>();
 
 export function authSubsFor(ctx: HostCtx): Map<PortLike, Map<string, 'authState' | 'idToken'>> {
   let m = _authSubs.get(ctx);
@@ -83,6 +84,17 @@ export function portTenant(ctx: HostCtx, port: PortLike): string | null {
   return portTenantsFor(ctx).get(port) ?? null;
 }
 
+/** Record the page origin an app port's client stated in its `appConfig`. */
+export function setPortOrigin(port: PortLike, origin: string): void {
+  _portOrigins.set(port, origin);
+}
+
+/** The port's page origin as a mint-request scope, empty when unknown. */
+export function portOriginScope(port: PortLike): { origin?: string } {
+  const origin = _portOrigins.get(port);
+  return origin === undefined ? {} : { origin };
+}
+
 /**
  * Lazily create the ONE shared auth handle — the user pool + admin surface.
  * Calling `getAuth(sandbox)` also (re)registers the auth service with the
@@ -258,7 +270,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
         const tenantId = resolveSignInTenant(ctx, port, msg.tenantId);
         const session = authSandboxOps.mintSession(auth, {
           kind: 'createPassword', email: msg.email, password: msg.password,
-          tenantId,
+          tenantId, ...portOriginScope(port),
         });
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method); // new user record must be durable at ack
@@ -272,7 +284,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
         const tenantId = resolveSignInTenant(ctx, port, msg.tenantId);
         const session = authSandboxOps.mintSession(auth, {
           kind: 'password', email: msg.email, password: msg.password,
-          tenantId,
+          tenantId, ...portOriginScope(port),
         });
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method);
@@ -294,7 +306,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
           break;
         }
         const session = authSandboxOps.mintSession(auth, {
-          kind: 'anonymous', tenantId,
+          kind: 'anonymous', tenantId, ...portOriginScope(port),
         });
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method);
@@ -317,7 +329,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
         let session: MintedSession | null = null;
         try {
           session = authSandboxOps.mintSession(auth, {
-            kind: 'uid', uid: msg.uid, tenantId,
+            kind: 'uid', uid: msg.uid, tenantId, ...portOriginScope(port),
           });
         } catch {
           session = null;
@@ -534,6 +546,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
           uid,
           providerId: cred.providerId,
           tenantId,
+          ...portOriginScope(port),
         });
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method);
@@ -550,7 +563,7 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
           ...identity, providerId, photoURL: photoURL ?? undefined,
         });
         const session = authSandboxOps.mintSession(auth, {
-          kind: 'provider', uid, providerId, tenantId,
+          kind: 'provider', uid, providerId, tenantId, ...portOriginScope(port),
         });
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method);

package/src/serve/worker/inbound-validation.ts

@@ -43,6 +43,7 @@ function assertInboundFields(message: Record<string, unknown>): void {
       requireRecord(message.options, 'options');
       requireOptionalBoolean(message.fromPriorHost, 'fromPriorHost');
       requireOptionalBoolean(message.hostVerified, 'hostVerified');
+      requireOptionalString(message.origin, 'origin');
       return;
     case 'clock-subscribe':
       return;

package/src/serve/worker/protocol/storage.ts

@@ -34,20 +34,8 @@ export const MAX_STORAGE_PART_B64_LENGTH = Math.ceil(MAX_STORAGE_PART_BYTES / 3)
  */
 export const MAX_STORAGE_OBJECT_BYTES = 512 * 1024 * 1024;
 
-/**
- * The Node host's HTTP byte route. Its paths follow Firebase's download paths
- * under the pyric namespace: `<prefix><bucket>/o/<encoded path>` for an object,
- * `<prefix><bucket>/o?name=…` for an upload.
- */
-export const STORAGE_ROUTE_PREFIX = '/__pyric/storage/v0/b/';
-
-/** An object's path on the byte route, with a token when the URL must carry its own authority. */
-export function storageObjectPath(bucket: string, path: string, token?: string): string {
-  const query = new URLSearchParams({ alt: 'media' });
-  const hasToken = token !== undefined;
-  if (hasToken) query.set('token', token);
-  return `${STORAGE_ROUTE_PREFIX}${encodeURIComponent(bucket)}/o/${encodeURIComponent(path)}?${query}`;
-}
+export { STORAGE_ROUTE_PREFIX, storageObjectPath } from 'pyric/storage/internal';
+import { STORAGE_ROUTE_PREFIX } from 'pyric/storage/internal';
 
 /** Where one upload's bytes are sent, carrying the token bound to that upload. */
 export function storageUploadPath(bucket: string, path: string, uploadId: string, token: string): string {

package/src/serve/worker/protocol.ts

@@ -471,6 +471,8 @@ export interface AppConfigMessage {
   fromPriorHost?: boolean;
   /** Set when the attaching client proved compile-time/HTML origin from this running host instance. */
   hostVerified?: boolean;
+  /** The page's `location.origin`; the host resolves relative photo URLs against it. */
+  origin?: string;
 }
 
 /**