@reclaimprotocol/client 0.1.38 → 0.1.39

package/lib/launch/extension.js

@@ -2,6 +2,10 @@ export const RECLAIM_EXTENSION_CHECK = 'RECLAIM_EXTENSION_CHECK';
 export const RECLAIM_EXTENSION_RESPONSE = 'RECLAIM_EXTENSION_RESPONSE';
 export const RECLAIM_START_VERIFICATION = 'RECLAIM_START_VERIFICATION';
 export const RECLAIM_CANCEL_VERIFICATION = 'RECLAIM_CANCEL_VERIFICATION';
+/** `postMessage` target for the page's own window, where the extension's
+ *  content script listens: only a receiver on this page's origin gets the
+ *  session id, never a frame or opener on another origin. */
+const SAME_ORIGIN = '/';
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -39,7 +43,7 @@ export function probeExtension(env, options = {}) {
             action: RECLAIM_EXTENSION_CHECK,
             extensionID: options.extensionID,
             messageId,
-        }, '*');
+        }, SAME_ORIGIN);
     });
 }
 /** Hands the session off to the extension. No navigation, no return value —
@@ -57,7 +61,7 @@ export function sendExtensionStartVerification(env, handoff) {
                 ...(handoff.diag ? { diagnosticMode: true } : {}),
             },
         },
-    }, '*');
+    }, SAME_ORIGIN);
 }
 /** Tears down the extension's in-progress verification UI. This is what
  *  `FlowHandle.close()` does for the extension-handoff mechanism — there's
@@ -68,5 +72,5 @@ export function sendExtensionCancelVerification(env, handoff) {
         action: RECLAIM_CANCEL_VERIFICATION,
         messageId: handoff.sessionId,
         extensionID: handoff.extensionID,
-    }, '*');
+    }, SAME_ORIGIN);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/client",
 	"title": "Reclaim Client",
-	"version": "0.1.38",
+	"version": "0.1.39",
 	"description": "Typed SDK/HTTP client SDK for the Reclaim Protocol — the programmatic way to use Reclaim Protocol to verify **data points** about your users (a follower count, an account balance, an order). Can be directly integrated by apps to request verification for their users using Reclaim Protocol and verify the results.",
 	"type": "module",
 	"sideEffects": false,

package/src/launch/extension.ts

@@ -27,6 +27,11 @@ export interface ExtensionHandoff {
 	extensionID?: string
 }
 
+/** `postMessage` target for the page's own window, where the extension's
+ *  content script listens: only a receiver on this page's origin gets the
+ *  session id, never a frame or opener on another origin. */
+const SAME_ORIGIN = '/'
+
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === 'object' && value !== null
 }
@@ -76,7 +81,7 @@ export function probeExtension(
 				extensionID: options.extensionID,
 				messageId,
 			},
-			'*',
+			SAME_ORIGIN,
 		)
 	})
 }
@@ -101,7 +106,7 @@ export function sendExtensionStartVerification(
 				},
 			},
 		},
-		'*',
+		SAME_ORIGIN,
 	)
 }
 
@@ -119,6 +124,6 @@ export function sendExtensionCancelVerification(
 			messageId: handoff.sessionId,
 			extensionID: handoff.extensionID,
 		},
-		'*',
+		SAME_ORIGIN,
 	)
 }