@vertesia/ui 1.5.0-dev.20260807.073259Z → 1.5.0-dev.20260901.005903Z

package/src/session/auth/composable.ts

@@ -92,6 +92,9 @@ function isVertesiaIssuedToken(token: string | undefined): token is string {
 
 function canUseVertesiaTokenDirectly(token: string, accountId?: string, projectId?: string): boolean {
     const decoded = decodeToken(token);
+    if (!decoded.exp || decoded.exp <= Date.now() / 1000 + 300) {
+        return false;
+    }
     const hasAuthorizationClaims = Boolean(
         decoded.permissions?.length ||
             decoded.account_roles?.length ||
@@ -117,8 +120,7 @@ export async function fetchComposableToken(
     ttl?: number,
     retryCount = 0,
 ): Promise<string> {
-    console.log(`Getting/refreshing composable token for account ${accountId} and project ${projectId} `);
-    Env.logger.info('Getting/refreshing composable token', {
+    Env.logger.debug('Getting/refreshing composable token', {
         vertesia: {
             account_id: accountId,
             project_id: projectId,
@@ -128,14 +130,12 @@ export async function fetchComposableToken(
 
     const idToken = await getIdToken(); //get from firebase
     if (!idToken) {
-        console.log('No id token found - using cookie auth');
         throw new Error('No id token found');
     }
 
     // Use STS endpoint - either configured or default to sts.vertesia.io
     const stsEndpoint = Env.endpoints.sts;
-    console.log('Using STS for token generation:', stsEndpoint);
-    Env.logger.info('Using STS for token generation', {
+    Env.logger.debug('Using STS for token generation', {
         vertesia: {
             account_id: accountId,
             project_id: projectId,
@@ -176,8 +176,7 @@ export async function fetchComposableToken(
 
         if (idToken && stsRes?.status === 404) {
             // User not found in token-server - call ensure-user endpoint
-            console.log('404: User not found - calling ensure-user endpoint');
-            Env.logger.info('404: User not found - calling ensure-user endpoint', {
+            Env.logger.debug('404: User not found - calling ensure-user endpoint', {
                 vertesia: {
                     account_id: accountId,
                     project_id: projectId,
@@ -195,8 +194,7 @@ export async function fetchComposableToken(
 
             if (ensureResponse.status === 412) {
                 // No invite - trigger signup
-                console.log('412: No invite found - signup required');
-                Env.logger.info('412: No invite found - signup required', {
+                Env.logger.debug('412: No invite found - signup required', {
                     vertesia: {
                         account_id: accountId,
                         project_id: projectId,
@@ -234,8 +232,7 @@ export async function fetchComposableToken(
             }
 
             // User created/exists - retry token generation
-            console.log('User ensured - retrying token generation');
-            Env.logger.info('User ensured - retrying token generation', {
+            Env.logger.debug('User ensured - retrying token generation', {
                 vertesia: {
                     account_id: accountId,
                     project_id: projectId,
@@ -245,8 +242,7 @@ export async function fetchComposableToken(
         }
 
         if (idToken && stsRes?.status === 412) {
-            console.log("412: auth succeeded but user doesn't exist - signup required", stsRes?.status);
-            Env.logger.error("412: auth succeeded but user doesn't exist - signup required", {
+            Env.logger.info("412: auth succeeded but user doesn't exist - signup required", {
                 vertesia: {
                     account_id: accountId,
                     project_id: projectId,
@@ -258,7 +254,7 @@ export async function fetchComposableToken(
                 Env.logger.error('No email found in id token');
                 throw new Error('No email found in id token');
             }
-            Env.logger.error('User not found', {
+            Env.logger.info('User not found', {
                 vertesia: {
                     account_id: accountId,
                     project_id: projectId,
@@ -354,8 +350,7 @@ export async function fetchComposableToken(
         }
 
         const { token } = await stsRes.json();
-        console.log('Successfully got token from STS');
-        Env.logger.info('Successfully got token from STS');
+        Env.logger.debug('Successfully got token from STS');
         return token;
     } catch (error) {
         if (
@@ -460,13 +455,24 @@ export async function getComposableToken(
         if (!devAuthToken && !useInternalAuth && getFirebaseAuth().currentUser) {
             //we have a firebase user, get the token from there
             AUTH_TOKEN_RAW = await fetchComposableTokenFromFirebaseToken(selectedAccount, selectedProject);
-        } else if (!devAuthToken && (initToken || AUTH_TOKEN_RAW)) {
-            // we have a token already and no firebase user, refresh it
-            AUTH_TOKEN_RAW = await fetchComposableToken(
-                () => Promise.resolve(initToken ?? AUTH_TOKEN_RAW),
-                selectedAccount,
-                selectedProject,
-            );
+        } else if (!devAuthToken) {
+            // Embedded apps can reacquire a fresh credential from their host after their cached token expires.
+            const refreshCredential = (await Env.authTokenProvider?.()) ?? initToken ?? AUTH_TOKEN_RAW;
+            if (
+                refreshCredential &&
+                isVertesiaIssuedToken(refreshCredential) &&
+                canUseVertesiaTokenDirectly(refreshCredential, selectedAccount, selectedProject)
+            ) {
+                AUTH_TOKEN_RAW = refreshCredential;
+            } else if (refreshCredential) {
+                AUTH_TOKEN_RAW = await fetchComposableToken(
+                    () => Promise.resolve(refreshCredential),
+                    selectedAccount,
+                    selectedProject,
+                );
+            } else {
+                AUTH_TOKEN_RAW = undefined;
+            }
         } else if (devAuthToken) {
             AUTH_TOKEN_RAW = devAuthToken;
         }

package/src/session/auth/domainRouting.test.ts

@@ -1,5 +1,10 @@
 import { afterEach, describe, expect, it } from 'vitest';
-import { mountRootUrl, shouldRedirectToCentralAuth, shouldUseFirebaseAuth } from './domainRouting';
+import {
+    centralAuthRedirectUrl,
+    mountRootUrl,
+    shouldRedirectToCentralAuth,
+    shouldUseFirebaseAuth,
+} from './domainRouting';
 
 // Stub document.baseURI to simulate the served `<base href>` (deep gateway mount) or its absence.
 function setBaseURI(baseURI: string) {
@@ -30,6 +35,24 @@ describe('domainRouting', () => {
         expect(shouldRedirectToCentralAuth()).toBe(true);
     });
 
+    it('carries the selected account and project through central auth for a gateway-mounted app', () => {
+        const redirect = centralAuthRedirectUrl({
+            centralAuthUrl: 'https://internal-auth.vertesia.app/',
+            stsEndpoint: 'https://sts.example.test',
+            returnUrl: new URL('https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid'),
+            state: 'state-1',
+            accountId: 'account-1',
+            projectId: 'project-1',
+        });
+        const returnUrl = new URL(redirect.searchParams.get('redirect_uri') || '');
+
+        expect(redirect.searchParams.get('sts')).toBe('https://sts.example.test');
+        expect(redirect.searchParams.get('state')).toBe('state-1');
+        expect(returnUrl.toString()).toBe(
+            'https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid&p=project-1&a=account-1',
+        );
+    });
+
     describe('mountRootUrl', () => {
         it('returns the deep gateway mount root (dropping any deep route / query / hash)', () => {
             const mount = 'https://gw.example.com/tenants/05948c_5ed5f4/apps/furniture-catalog/versions/v1/app/';

package/src/session/auth/domainRouting.ts

@@ -12,6 +12,35 @@ export function shouldRedirectToCentralAuth(_hostname?: string) {
     return !shouldUseFirebaseAuth();
 }
 
+interface CentralAuthRedirectOptions {
+    centralAuthUrl: string;
+    stsEndpoint: string;
+    returnUrl: URL;
+    state: string;
+    accountId?: string;
+    projectId?: string;
+}
+
+/** Build a central-auth round trip without losing the app's requested account/project selection. */
+export function centralAuthRedirectUrl({
+    centralAuthUrl,
+    stsEndpoint,
+    returnUrl,
+    state,
+    accountId,
+    projectId,
+}: CentralAuthRedirectOptions): URL {
+    const selectedReturnUrl = new URL(returnUrl);
+    if (projectId) selectedReturnUrl.searchParams.set('p', projectId);
+    if (accountId) selectedReturnUrl.searchParams.set('a', accountId);
+
+    const url = new URL(centralAuthUrl);
+    url.searchParams.set('sts', stsEndpoint);
+    url.searchParams.set('redirect_uri', selectedReturnUrl.toString());
+    url.searchParams.set('state', state);
+    return url;
+}
+
 /**
  * The page URL to return to after a central-auth round-trip (`redirect_uri`).
  *

package/src/session/auth/firebase.ts

@@ -139,7 +139,7 @@ export async function getFirebaseAuthToken(refresh?: boolean) {
         return user
             .getIdToken(refresh)
             .then((token) => {
-                Env.logger.info('Got Firebase token', {
+                Env.logger.debug('Got Firebase token', {
                     vertesia: {
                         user_email: user.email,
                         user_name: user.displayName,

package/src/session/useUXTracking.tsx

@@ -23,7 +23,12 @@ export function useUXTracking() {
             console.debug('track event', eventName, eventProperties);
         }
 
-        //GA via firebase
+        // GA via firebase — needs a complete Firebase config. A partial one (no apiKey, as in
+        // central-auth deployments and local setups) would make the Installations SDK log an
+        // async FirebaseError on every event, so analytics is a no-op there.
+        if (!Env.firebase?.apiKey) {
+            return;
+        }
         logEvent(getFirebaseAnalytics(), eventName, { ...eventProperties, debug_mode: !Env.isProd });
     };
 

package/src/shell/VertesiaShell.tsx

@@ -3,6 +3,7 @@ import { TypeRegistryProvider, UserPermissionProvider } from '@vertesia/ui/featu
 import { LanguageBoundI18nProvider, LanguageProvider, type SupportedLanguage } from '@vertesia/ui/i18n';
 import { DevSessionProvider, UserSessionProvider } from '@vertesia/ui/session';
 import type { ReactNode } from 'react';
+import { IframeAppContextSync } from './apps/IframeAppContextSync.js';
 import { SigninScreen } from './login/SigninScreen';
 import { SplashScreen } from './SplashScreen';
 
@@ -35,6 +36,7 @@ export function VertesiaShell({
             <ThemeProvider defaultTheme="system" storageKey="vite-ui-theme">
                 <LanguageProvider defaultLanguage={defaultLanguage}>
                     <LanguageBoundI18nProvider>
+                        <IframeAppContextSync />
                         {!authToken && (
                             <>
                                 <SplashScreen icon={loadingIcon} />

package/src/shell/apps/IframeAppContextSync.test.tsx

@@ -0,0 +1,196 @@
+// @vitest-environment jsdom
+
+import { act, cleanup, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { ThemeProvider, useTheme } from '../../core/index.js';
+import { LanguageProvider, useLanguage } from '../../i18n/index.js';
+import { IframeAppContextSync } from './IframeAppContextSync.js';
+import {
+    IFRAME_APP_CONTEXT,
+    IFRAME_APP_CONTEXT_REQUEST,
+    IFRAME_APP_HOST_ORIGIN_PARAM,
+    IFRAME_APP_LOCATION_CHANGE,
+    IFRAME_APP_NAVIGATE,
+} from './iframe-auth.js';
+
+const originalParent = Object.getOwnPropertyDescriptor(window, 'parent');
+const originalReferrer = Object.getOwnPropertyDescriptor(document, 'referrer');
+
+afterEach(() => {
+    cleanup();
+    window.history.replaceState(null, '', '/');
+    localStorage.clear();
+    sessionStorage.clear();
+    document.documentElement.classList.remove('light', 'dark');
+    if (originalParent) Object.defineProperty(window, 'parent', originalParent);
+    else Reflect.deleteProperty(window, 'parent');
+    if (originalReferrer) Object.defineProperty(document, 'referrer', originalReferrer);
+    else Reflect.deleteProperty(document, 'referrer');
+});
+
+function ContextProbe() {
+    const { theme } = useTheme();
+    const { language } = useLanguage();
+    return <div>{`${theme}:${language}`}</div>;
+}
+
+describe('IframeAppContextSync', () => {
+    it('requests and applies host presentation state without overwriting standalone preferences', async () => {
+        const postMessage = vi.fn();
+        const parentWindow = { postMessage } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        Object.defineProperty(document, 'referrer', {
+            configurable: true,
+            value: 'https://cloud.vertesia.io/app/sample',
+        });
+        localStorage.setItem('custom-theme', 'dark');
+        localStorage.setItem('custom-language', 'en');
+
+        render(
+            <ThemeProvider storageKey="custom-theme">
+                <LanguageProvider storageKey="custom-language">
+                    <IframeAppContextSync />
+                    <ContextProbe />
+                </LanguageProvider>
+            </ThemeProvider>,
+        );
+
+        expect(parentWindow.postMessage).toHaveBeenCalledWith(
+            { type: IFRAME_APP_CONTEXT_REQUEST },
+            'https://cloud.vertesia.io',
+        );
+
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_APP_CONTEXT, theme: 'light', language: 'fr' },
+                origin: 'https://attacker.example.com',
+                source: parentWindow,
+            }),
+        );
+        expect(screen.getByText('dark:en')).toBeTruthy();
+
+        act(() => {
+            window.dispatchEvent(
+                new MessageEvent('message', {
+                    data: { type: IFRAME_APP_CONTEXT, theme: 'light', language: 'fr' },
+                    origin: 'https://cloud.vertesia.io',
+                    source: parentWindow,
+                }),
+            );
+        });
+
+        await waitFor(() => expect(screen.getByText('light:fr')).toBeTruthy());
+        expect(localStorage.getItem('custom-theme')).toBe('dark');
+        expect(localStorage.getItem('custom-language')).toBe('en');
+        expect(postMessage.mock.calls.filter(([message]) => message.type === IFRAME_APP_CONTEXT_REQUEST)).toHaveLength(
+            1,
+        );
+    });
+
+    it('applies same-origin host navigation without reloading the document', () => {
+        const parentWindow = { postMessage: vi.fn() } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        Object.defineProperty(document, 'referrer', {
+            configurable: true,
+            value: 'https://cloud.vertesia.io/app/sample',
+        });
+        localStorage.setItem('vite-ui-theme', 'dark');
+        localStorage.setItem('vertesia-ui-language', 'en');
+        window.history.replaceState(null, '', '/app/');
+        const popstate = vi.fn();
+        window.addEventListener('popstate', popstate);
+
+        render(
+            <ThemeProvider>
+                <LanguageProvider>
+                    <IframeAppContextSync />
+                </LanguageProvider>
+            </ThemeProvider>,
+        );
+
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_APP_NAVIGATE, url: 'https://attacker.example.com/stolen' },
+                origin: 'https://cloud.vertesia.io',
+                source: parentWindow,
+            }),
+        );
+        expect(window.location.pathname).toBe('/app/');
+
+        const target = `${window.location.origin}/app/reports?__vertesia_slot=content`;
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_APP_NAVIGATE, url: target },
+                origin: 'https://cloud.vertesia.io',
+                source: parentWindow,
+            }),
+        );
+
+        expect(window.location.pathname).toBe('/app/reports');
+        expect(window.location.search).toBe('?__vertesia_slot=content');
+        expect(popstate).toHaveBeenCalledTimes(1);
+        window.removeEventListener('popstate', popstate);
+    });
+
+    it('acknowledges host navigation when the iframe is already at the requested URL', () => {
+        const parentWindow = { postMessage: vi.fn() } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        localStorage.setItem('vite-ui-theme', 'dark');
+        window.history.replaceState(
+            null,
+            '',
+            `/app/reports?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fcloud.vertesia.io`,
+        );
+
+        render(
+            <ThemeProvider>
+                <LanguageProvider>
+                    <IframeAppContextSync />
+                </LanguageProvider>
+            </ThemeProvider>,
+        );
+        parentWindow.postMessage = vi.fn();
+
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_APP_NAVIGATE, url: window.location.href },
+                origin: 'https://cloud.vertesia.io',
+                source: parentWindow,
+            }),
+        );
+
+        expect(parentWindow.postMessage).toHaveBeenCalledWith(
+            { type: IFRAME_APP_LOCATION_CHANGE, url: window.location.href },
+            'https://cloud.vertesia.io',
+        );
+    });
+
+    it('reports app-initiated history navigation to the embedding Studio', () => {
+        const parentWindow = { postMessage: vi.fn() } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/app/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fcloud.vertesia.io`);
+        localStorage.setItem('vite-ui-theme', 'dark');
+        localStorage.setItem('vertesia-ui-language', 'en');
+
+        render(
+            <ThemeProvider>
+                <LanguageProvider>
+                    <IframeAppContextSync />
+                </LanguageProvider>
+            </ThemeProvider>,
+        );
+        parentWindow.postMessage = vi.fn();
+
+        window.history.pushState(null, '', '/app/reports?period=week');
+
+        expect(parentWindow.postMessage).toHaveBeenCalledWith(
+            {
+                type: IFRAME_APP_LOCATION_CHANGE,
+                url:
+                    `${window.location.origin}/app/reports?period=week&` +
+                    `${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fcloud.vertesia.io`,
+            },
+            'https://cloud.vertesia.io',
+        );
+    });
+});

package/src/shell/apps/IframeAppContextSync.tsx

@@ -0,0 +1,101 @@
+import { useEffect } from 'react';
+import { useTheme } from '../../core/components/shadcn/theme/ThemeProvider.js';
+import { useLanguage } from '../../i18n/LanguageProvider.js';
+import {
+    IFRAME_APP_CONTEXT_REQUEST,
+    IFRAME_APP_HOST_ORIGIN_PARAM,
+    IFRAME_APP_LOCATION_CHANGE,
+    type IframeAppContextRequest,
+    type IframeAppLocationChange,
+    isIframeAppContext,
+    isIframeAppNavigate,
+    resolveIframeHostOrigin,
+} from './iframe-auth.js';
+
+function preserveIframeHostOrigin(url: string | URL | null | undefined): string | URL | null | undefined {
+    if (url === null || url === undefined) return url;
+    const hostOrigin = new URL(window.location.href).searchParams.get(IFRAME_APP_HOST_ORIGIN_PARAM);
+    if (!hostOrigin) return url;
+
+    try {
+        const target = new URL(url, window.location.href);
+        if (target.origin !== window.location.origin) return url;
+        target.searchParams.set(IFRAME_APP_HOST_ORIGIN_PARAM, hostOrigin);
+        return target;
+    } catch {
+        return url;
+    }
+}
+
+/** Applies context and navigation supplied by an embedding Studio without changing standalone preferences. */
+export function IframeAppContextSync() {
+    const { setTheme } = useTheme();
+    const { setLanguage } = useLanguage();
+
+    useEffect(() => {
+        const parentOrigin = resolveIframeHostOrigin();
+        if (!parentOrigin) return;
+
+        const reportLocation = () => {
+            const message = {
+                type: IFRAME_APP_LOCATION_CHANGE,
+                url: window.location.href,
+            } satisfies IframeAppLocationChange;
+            window.parent.postMessage(message, parentOrigin);
+        };
+
+        const originalPushState = window.history.pushState;
+        const originalReplaceState = window.history.replaceState;
+        const pushState: History['pushState'] = (data, unused, url) => {
+            originalPushState.call(window.history, data, unused, preserveIframeHostOrigin(url));
+            reportLocation();
+        };
+        const replaceState: History['replaceState'] = (data, unused, url) => {
+            originalReplaceState.call(window.history, data, unused, preserveIframeHostOrigin(url));
+            reportLocation();
+        };
+        window.history.pushState = pushState;
+        window.history.replaceState = replaceState;
+
+        const onMessage = (event: MessageEvent<unknown>) => {
+            if (event.source !== window.parent || event.origin !== parentOrigin) return;
+            if (isIframeAppContext(event.data)) {
+                const context = event.data;
+                setTheme(context.theme, { persist: false });
+                setLanguage(context.language, { persist: false });
+                return;
+            }
+            if (isIframeAppNavigate(event.data)) {
+                let target: URL;
+                try {
+                    target = new URL(event.data.url, window.location.href);
+                } catch {
+                    return;
+                }
+                if (target.origin !== window.location.origin) return;
+                if (target.href === window.location.href) {
+                    // Acknowledge no-op navigation so the host does not wait forever and suppress later app routing.
+                    reportLocation();
+                    return;
+                }
+                window.history.replaceState(window.history.state, '', target);
+                window.dispatchEvent(new PopStateEvent('popstate', { state: window.history.state }));
+            }
+        };
+        const request = { type: IFRAME_APP_CONTEXT_REQUEST } satisfies IframeAppContextRequest;
+        window.addEventListener('message', onMessage);
+        window.addEventListener('popstate', reportLocation);
+        window.addEventListener('hashchange', reportLocation);
+        window.parent.postMessage(request, parentOrigin);
+        reportLocation();
+        return () => {
+            window.removeEventListener('message', onMessage);
+            window.removeEventListener('popstate', reportLocation);
+            window.removeEventListener('hashchange', reportLocation);
+            if (window.history.pushState === pushState) window.history.pushState = originalPushState;
+            if (window.history.replaceState === replaceState) window.history.replaceState = originalReplaceState;
+        };
+    }, [setLanguage, setTheme]);
+
+    return null;
+}

package/src/shell/apps/iframe-auth.test.ts

@@ -0,0 +1,118 @@
+// @vitest-environment jsdom
+
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+    IFRAME_APP_HOST_ORIGIN_PARAM,
+    IFRAME_AUTH_REQUEST,
+    IFRAME_AUTH_RESPONSE,
+    requestIframeHostAuthToken,
+    resolveIframeHostOrigin,
+} from './iframe-auth.js';
+
+const originalParent = Object.getOwnPropertyDescriptor(window, 'parent');
+const originalReferrer = Object.getOwnPropertyDescriptor(document, 'referrer');
+
+afterEach(() => {
+    window.history.replaceState(null, '', '/');
+    window.sessionStorage.clear();
+    if (originalParent) Object.defineProperty(window, 'parent', originalParent);
+    else Reflect.deleteProperty(window, 'parent');
+    if (originalReferrer) Object.defineProperty(document, 'referrer', originalReferrer);
+    else Reflect.deleteProperty(document, 'referrer');
+});
+
+describe('iframe host authentication', () => {
+    it('resolves an explicit trusted host origin', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fcloud.vertesia.io`);
+
+        expect(resolveIframeHostOrigin()).toBe('https://cloud.vertesia.io');
+    });
+
+    it('accepts a branch Studio UI origin', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(
+            null,
+            '',
+            `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fdev-feat-iframe.ui.dev1.vertesia.io`,
+        );
+
+        expect(resolveIframeHostOrigin()).toBe('https://dev-feat-iframe.ui.dev1.vertesia.io');
+    });
+
+    it('rejects untrusted query and referrer origins', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fevil.example.com`);
+        Object.defineProperty(document, 'referrer', {
+            configurable: true,
+            value: 'https://referrer.example.com/embed',
+        });
+
+        expect(resolveIframeHostOrigin()).toBeUndefined();
+    });
+
+    it('rejects a shared Vertesia app-gateway origin', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fapps.dev1.vertesia.io`);
+
+        expect(resolveIframeHostOrigin()).toBeUndefined();
+    });
+
+    it('rejects an origin containing embedded credentials', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(
+            null,
+            '',
+            `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fuser%3Asecret%40cloud.vertesia.io`,
+        );
+
+        expect(resolveIframeHostOrigin()).toBeUndefined();
+    });
+
+    it('accepts a loopback host for a loopback child app', () => {
+        const parentWindow = { postMessage: () => undefined } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=http%3A%2F%2Flocalhost%3A5173`);
+
+        expect(resolveIframeHostOrigin()).toBe('http://localhost:5173');
+    });
+
+    it('ignores an empty early response and waits for a usable host token', async () => {
+        const requests: unknown[] = [];
+        const parentWindow = { postMessage: (message: unknown) => requests.push(message) } as unknown as Window;
+        Object.defineProperty(window, 'parent', { configurable: true, value: parentWindow });
+        window.history.replaceState(null, '', `/?${IFRAME_APP_HOST_ORIGIN_PARAM}=https%3A%2F%2Fcloud.vertesia.io`);
+
+        let settled = false;
+        const tokenPromise = requestIframeHostAuthToken().then((token) => {
+            settled = true;
+            return token;
+        });
+        const request = requests[0] as { type: string; requestId: string };
+        expect(request.type).toBe(IFRAME_AUTH_REQUEST);
+
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_AUTH_RESPONSE, requestId: request.requestId },
+                origin: 'https://cloud.vertesia.io',
+                source: parentWindow,
+            }),
+        );
+        await Promise.resolve();
+        expect(settled).toBe(false);
+
+        window.dispatchEvent(
+            new MessageEvent('message', {
+                data: { type: IFRAME_AUTH_RESPONSE, requestId: request.requestId, token: 'fresh-token' },
+                origin: 'https://cloud.vertesia.io',
+                source: parentWindow,
+            }),
+        );
+        await expect(tokenPromise).resolves.toBe('fresh-token');
+    });
+});