@trackunit/react-core-contexts 2.7.12 → 2.7.13

package/index.cjs.js

@@ -422,23 +422,31 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
     };
 };
 
+// `location.hostname` carries no port, serializes IPv6 loopback with brackets, and can be
+// `0.0.0.0` when the Iris App dev server is started with `--host`. Mirrors the host-side check
+// in iris-app-sdk/components IrisAppIframe.tsx.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]", "0.0.0.0"];
 const useApolloClient = () => {
     const { graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, environment, tracingHeaders } = reactCoreHooks.useEnvironment();
     const { token: currentToken } = reactCoreHooks.useToken();
     const errorHandler = reactCoreHooks.useErrorHandler();
     const { addToast } = reactCoreHooks.useToast();
-    const { permissions } = reactCoreHooks.useCurrentUser();
     const showErrorToast = react.useCallback((error) => {
         // Only a developer running an Iris App locally can act on a missing scope, since only
         // they can edit the manifest. The server throws the same message for real customer
         // sessions and for token clients that have no manifest at all, so surfacing it outside
         // local mode tells users to fix something they cannot reach.
         //
-        // Read from storage rather than through useIrisAppsSDK().developerMode: that context is
-        // created below this provider (it queries GraphQL, so it needs this Apollo client) and
-        // lives in a visibility:host library this one cannot import.
-        const isDeveloper = permissions?.some(permission => permission === "FAKE_PERMISSION");
-        if (!isDeveloper) {
+        // Every Iris App mounts this provider inside its own iframe via TrackunitProviders, so a
+        // loopback hostname means *this app* is being served by a local dev server — precisely the
+        // person who owns the manifest. useIrisAppsSDK().developerMode cannot be used instead:
+        // useDeveloperMode lives in core-contexts-host (visibility:host) and this library is
+        // visibility:shared, so nx blocks the import.
+        //
+        // Read inside the callback rather than at module scope so nothing touches `window` at
+        // import time and tests can stub the hostname per case.
+        const isServedLocally = LOOPBACK_HOSTNAMES.includes(window.location.hostname);
+        if (!isServedLocally) {
             return;
         }
         void addToast({
@@ -453,7 +461,7 @@ const useApolloClient = () => {
             behavior: "persistent",
             description: `${error.message} - you must add the scope to your iris app manifest`,
         });
-    }, [addToast, permissions]);
+    }, [addToast]);
     const [client] = react.useState(() => {
         return createApolloClient({
             /* DON'T CHANGE THIS ! its there to ensure we don't recreate apollo client just because the token changes,

package/index.esm.js

@@ -3,7 +3,7 @@ import { FeatureFlagRuntime, ToastRuntime, AnalyticsRuntime, registerHostChangeH
 import { FeatureFlagContextProvider, ToastProvider, AnalyticsContextProvider, AssetSortingProvider, ConfirmationDialogProvider, EnvironmentContextProvider, ErrorHandlingContextProvider, ExportDataContext, FilterBarProvider, GeolocationProvider, ModalDialogContextProvider, NavigationContextProvider, OemBrandingContextProvider, TimeRangeProvider, TokenProvider, CurrentUserProvider, CurrentUserPreferenceProvider, UserSubscriptionProvider, WidgetConfigProvider } from '@trackunit/react-core-contexts-api';
 import { useState, useEffect, useCallback, useMemo, useReducer, Suspense } from 'react';
 import { ApolloLink, Observable, createHttpLink, from, split, ApolloClient, InMemoryCache, ApolloProvider } from '@apollo/client';
-import { useEnvironment, useToken, useErrorHandler, useToast, useCurrentUser } from '@trackunit/react-core-hooks';
+import { useEnvironment, useToken, useErrorHandler, useToast } from '@trackunit/react-core-hooks';
 import { setContext } from '@apollo/client/link/context';
 import { removeTypenameFromVariables } from '@apollo/client/link/remove-typename';
 import { getMainDefinition, Observable as Observable$1 } from '@apollo/client/utilities';
@@ -420,23 +420,31 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
     };
 };
 
+// `location.hostname` carries no port, serializes IPv6 loopback with brackets, and can be
+// `0.0.0.0` when the Iris App dev server is started with `--host`. Mirrors the host-side check
+// in iris-app-sdk/components IrisAppIframe.tsx.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]", "0.0.0.0"];
 const useApolloClient = () => {
     const { graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, environment, tracingHeaders } = useEnvironment();
     const { token: currentToken } = useToken();
     const errorHandler = useErrorHandler();
     const { addToast } = useToast();
-    const { permissions } = useCurrentUser();
     const showErrorToast = useCallback((error) => {
         // Only a developer running an Iris App locally can act on a missing scope, since only
         // they can edit the manifest. The server throws the same message for real customer
         // sessions and for token clients that have no manifest at all, so surfacing it outside
         // local mode tells users to fix something they cannot reach.
         //
-        // Read from storage rather than through useIrisAppsSDK().developerMode: that context is
-        // created below this provider (it queries GraphQL, so it needs this Apollo client) and
-        // lives in a visibility:host library this one cannot import.
-        const isDeveloper = permissions?.some(permission => permission === "FAKE_PERMISSION");
-        if (!isDeveloper) {
+        // Every Iris App mounts this provider inside its own iframe via TrackunitProviders, so a
+        // loopback hostname means *this app* is being served by a local dev server — precisely the
+        // person who owns the manifest. useIrisAppsSDK().developerMode cannot be used instead:
+        // useDeveloperMode lives in core-contexts-host (visibility:host) and this library is
+        // visibility:shared, so nx blocks the import.
+        //
+        // Read inside the callback rather than at module scope so nothing touches `window` at
+        // import time and tests can stub the hostname per case.
+        const isServedLocally = LOOPBACK_HOSTNAMES.includes(window.location.hostname);
+        if (!isServedLocally) {
             return;
         }
         void addToast({
@@ -451,7 +459,7 @@ const useApolloClient = () => {
             behavior: "persistent",
             description: `${error.message} - you must add the scope to your iris app manifest`,
         });
-    }, [addToast, permissions]);
+    }, [addToast]);
     const [client] = useState(() => {
         return createApolloClient({
             /* DON'T CHANGE THIS ! its there to ensure we don't recreate apollo client just because the token changes,

package/migrations/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../../../../libs/react/core-contexts/migrations/entry.ts"],"names":[],"mappings":"","sourcesContent":["export {};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/react-core-contexts",
-  "version": "2.7.12",
+  "version": "2.7.13",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "engines": {