@stravica-ai/digital-operator-pa 0.1.37 → 0.1.38

package/dist/engineering-pa-workspace/src/server.mjs

@@ -393,14 +393,24 @@ const server = createServer(async (req, res) => {
   // outer pass has already validated the Host header, so this call is
   // effectively the state-changing-method sweep.
   if (pathname.startsWith('/__api/') || pathname.startsWith('/api/')) {
-    const guard = checkRequestGuards(req, ALLOWED_HOSTS, ALLOWED_ORIGINS);
-    if (!guard.ok) {
-      warn('[workspace] guard refused ' + req.method + ' ' + pathname + ' (' + guard.reason + ')');
-      res.writeHead(guard.status, { 'Content-Type': 'text/plain; charset=utf-8' });
-      res.end('Forbidden');
-      return;
-    }
+    // Extension routes may opt into cross-origin acceptance via
+    // addRoute(..., { crossOrigin: true }). Look the route up before the
+    // state-changing sweep so an opted-in route can accept a POST from a
+    // foreign origin (e.g. the Dave Review bookmarklet firing on any web
+    // page). The outer per-request pass has already validated the Host
+    // header, so a crossOrigin route is still protected against DNS
+    // rebinding; it takes over Origin/CSRF policy through its own auth
+    // (a per-install token, in the case of the review submit route).
     const extRoute = extRoutes.find(r => r.method === req.method && r.pathname === pathname);
+    if (!extRoute || extRoute.crossOrigin !== true) {
+      const guard = checkRequestGuards(req, ALLOWED_HOSTS, ALLOWED_ORIGINS);
+      if (!guard.ok) {
+        warn('[workspace] guard refused ' + req.method + ' ' + pathname + ' (' + guard.reason + ')');
+        res.writeHead(guard.status, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('Forbidden');
+        return;
+      }
+    }
     if (extRoute) { extRoute.handler(req, res, url, REPO_ROOT); return; }
 
     // GET /__api/nav -- merged core + extension nav manifest, team-scoped to
@@ -577,13 +587,22 @@ async function loadExtensions() {
   try {
     const extApi = await import(extApiPath);
     if (typeof extApi.register === 'function') {
-      extApi.register(function addRoute(method, pathname, handler) {
+      extApi.register(function addRoute(method, pathname, handler, options) {
+        // options.crossOrigin === true opts this route out of the API-branch
+        // Origin/Sec-Fetch-Site sweep. The outer Host allowlist still runs
+        // on every request, so a crossOrigin route accepts requests from a
+        // foreign browser Origin as long as the Host addresses this
+        // workspace via one of its own allowlisted names. The extension
+        // owns auth (a per-install token, say) and its own CORS response.
+        // Default is unchanged: undefined/false keeps the full guard.
+        const opts = (options && typeof options === 'object') ? options : {};
+        const crossOrigin = opts.crossOrigin === true;
         const shadows = extRoutes.some(r => r.method === method && r.pathname === pathname);
         if (!shadows) {
           // Check if it shadows a core route (informational only).
-          log('[workspace] Extension route registered: ' + method + ' ' + pathname);
+          log('[workspace] Extension route registered: ' + method + ' ' + pathname + (crossOrigin ? ' [crossOrigin]' : ''));
         }
-        extRoutes.push({ method: method, pathname: pathname, handler: handler });
+        extRoutes.push({ method: method, pathname: pathname, handler: handler, crossOrigin: crossOrigin });
       });
     }
   } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",