@sjcrh/proteinpaint-server 2.135.2 → 2.136.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -165,7 +165,7 @@ if (serverconfig.debugmode && !serverconfig.binpath.includes('sjcrh/')) {
165
165
 
166
166
  if (serverconfig.allow_env_overrides) {
167
167
  if (process.env.PP_URL) {
168
- serverconfig.URL = process.env.URL
168
+ serverconfig.URL = process.env.PP_URL
169
169
  }
170
170
 
171
171
  if ('PP_BASEPATH' in process.env) {
@@ -186,6 +186,22 @@ if (serverconfig.allow_env_overrides) {
186
186
  }
187
187
  }
188
188
 
189
+ // detect or set up whitelisted embedder hostnames to support;
190
+ // historically, the single prod instance at proteinpaint.stjude.org was allowed to be embedded anywhere;
191
+ // with increasing numbers of PP servers supporting different portals, the `allowedEmbedders[]` option
192
+ // improves security for more restrictive prod instances such as GDC, or maybe later,
193
+ // for the survivorship server instance to allow only vizcom as embedder
194
+ if (!serverconfig.allowedEmbedders) {
195
+ serverconfig.allowedEmbedders =
196
+ !serverconfig.backend_only || serverconfig.debugmode
197
+ ? ['*'] // historical default to allow any embedder
198
+ : serverconfig.URL
199
+ ? [serverconfig.URL.split('://')[1]] // if serverconfig.URL is set for backend_only containers, use it as the default embedder;
200
+ : [] // otherwise, do not specify a default embedder
201
+ } else if (!Array.isArray(serverconfig.allowedEmbedders)) {
202
+ throw `serverconfig.allowedEmbedders must be an array`
203
+ }
204
+
189
205
  if (serverconfig.URL?.endsWith('/')) serverconfig.URL = serverconfig.URL.slice(0, -1)
190
206
 
191
207
  // always change selected configuration paths in a container