@volter/world-runtime 2.0.35 → 2.0.37

package/dist/src/world-view.d.ts

@@ -21,5 +21,7 @@ export declare function serveWorldView(name: string, opts?: {
     host?: string;
     console?: ViewConsole;
     announce?: (line: string) => void; /** each World a browser steps into at an origin of its own (on by default on loopback) */
-    origins?: boolean;
+    origins?: boolean; /** the World's own origin as a browser reaches it through a proxy on this machine (a desktop serving it as an app):
+       *  a request the proxy forwards from that host (X-Forwarded-Host) is answered as at that origin, its local session included */
+    origin?: string;
 }): Promise<WorldView>;

package/dist/src/world-view.js

@@ -39,7 +39,15 @@ export async function serveWorldView(name, opts = {}) {
     // a non-loopback --host turns origins off by default: say so (the World and its branches then share one origin)
     if (opts.origins === undefined && !origins)
         opts.announce?.(`origins  off (bound to ${host}): the World and its branches share one origin, where a browser session is only path-scoped; bind loopback for an origin per World`);
-    const browserOrigin = origins ? (served) => (port ? localWorldOrigin(served, port) : null) : undefined;
+    const proxied = opts.origin ? new URL(opts.origin) : null;
+    if (proxied && (proxied.origin !== opts.origin || !/^https?:$/.test(proxied.protocol)))
+        throw new Error(`--origin is an origin (http(s)://host[:port]), got ${opts.origin}`);
+    if (proxied && !(loopbackBind && origins))
+        throw new Error('--origin is for a World served on loopback with origins on, behind a proxy on this machine');
+    // the World itself at the proxy's origin; its branches keep their own *.localhost origins
+    // (the first World mounted is the World; every later one is a branch of it)
+    let base = null;
+    const browserOrigin = origins ? (served) => (proxied && (base === null || served === base) ? proxied.origin : port ? localWorldOrigin(served, port) : null) : undefined;
     const mountAt = (at) => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}) });
     const branches = new LocalBranches({ dir: join(root, stateDirName(), 'branches'), origin: () => loopback, worlds, mount: mountAt, ...(opts.announce ? { announce: opts.announce } : {}) });
     // THE WORLD'S OWN BRANCHES, one served at a time: serving another stops this one's twins and starts that one's under the
@@ -84,17 +92,25 @@ export async function serveWorldView(name, opts = {}) {
     };
     const mountOpts = { root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}), serveBranch };
     let world = await mountWorld(name, mountOpts);
+    base = world.served;
     worlds.set(world.served, world);
     const server = await serveHttp({
         // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, as `serve` takes them
         hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024,
         // this front serves a World and its branches; each World's own twins journal their requests
         twinRequestJournal: false,
-        async fetch(request) {
+        async fetch(incoming) {
+            // forwarded from the proxy's host: answered as at the World's own origin there (only that exact host; the proxy is
+            // on this machine, as everything that reaches a loopback front is)
+            const addressed = new URL(incoming.url).hostname.replace(/^\[|\]$/g, '');
+            const fromProxy = proxied && incoming.headers.get('x-forwarded-host') === proxied.host && ['localhost', '127.0.0.1', '::1'].includes(addressed);
+            const request = fromProxy
+                ? new Request(`${proxied.origin}${new URL(incoming.url).pathname}${new URL(incoming.url).search}`, incoming)
+                : incoming;
             const at = new URL(request.url);
             const path = at.pathname;
             // a World's own origin serves that World (and the ping and the console) and no other
-            const own = origins ? worldOfHost(at.hostname, worlds.keys()) : undefined;
+            const own = origins ? (proxied && at.host === proxied.host ? base : worldOfHost(at.hostname, worlds.keys())) : undefined;
             if (own === null)
                 return Response.json({ error: `no world at ${at.host}` }, { status: 404 });
             // the bare address, typed into a browser, is the World's page: at its own origin when it has one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.35",
+  "version": "2.0.37",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.20",
-    "@volter/world-console": "2.0.12"
+    "@volter/world-core": "2.0.21",
+    "@volter/world-console": "2.0.13"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.20",
+    "@volter/world-core": "2.0.21",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.20"
+    "@volter/twin-mongodb": "0.1.21"
   }
 }

package/src/world-view.ts

@@ -28,7 +28,8 @@ function branchRoots(dir: string): string[] {
   return out.sort();
 }
 
-export async function serveWorldView(name: string, opts: { root?: string; port?: number; host?: string; console?: ViewConsole; announce?: (line: string) => void; /** each World a browser steps into at an origin of its own (on by default on loopback) */ origins?: boolean } = {}): Promise<WorldView> {
+export async function serveWorldView(name: string, opts: { root?: string; port?: number; host?: string; console?: ViewConsole; announce?: (line: string) => void; /** each World a browser steps into at an origin of its own (on by default on loopback) */ origins?: boolean; /** the World's own origin as a browser reaches it through a proxy on this machine (a desktop serving it as an app):
+   *  a request the proxy forwards from that host (X-Forwarded-Host) is answered as at that origin, its local session included */ origin?: string } = {}): Promise<WorldView> {
   const root = resolve(opts.root ?? process.cwd());
   const host = opts.host ?? '127.0.0.1';
   const worlds = new Map<string, MountedWorld>();
@@ -41,7 +42,13 @@ export async function serveWorldView(name: string, opts: { root?: string; port?:
   const local = loopbackBind && origins;
   // a non-loopback --host turns origins off by default: say so (the World and its branches then share one origin)
   if (opts.origins === undefined && !origins) opts.announce?.(`origins  off (bound to ${host}): the World and its branches share one origin, where a browser session is only path-scoped; bind loopback for an origin per World`);
-  const browserOrigin = origins ? (served: string) => (port ? localWorldOrigin(served, port) : null) : undefined;
+  const proxied = opts.origin ? new URL(opts.origin) : null;
+  if (proxied && (proxied.origin !== opts.origin || !/^https?:$/.test(proxied.protocol))) throw new Error(`--origin is an origin (http(s)://host[:port]), got ${opts.origin}`);
+  if (proxied && !(loopbackBind && origins)) throw new Error('--origin is for a World served on loopback with origins on, behind a proxy on this machine');
+  // the World itself at the proxy's origin; its branches keep their own *.localhost origins
+  // (the first World mounted is the World; every later one is a branch of it)
+  let base: string | null = null;
+  const browserOrigin = origins ? (served: string) => (proxied && (base === null || served === base) ? proxied.origin : port ? localWorldOrigin(served, port) : null) : undefined;
   const mountAt = (at: string): Promise<MountedWorld> => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}) });
   const branches: LocalBranches = new LocalBranches({ dir: join(root, stateDirName(), 'branches'), origin: () => loopback, worlds, mount: mountAt, ...(opts.announce ? { announce: opts.announce } : {}) });
   // THE WORLD'S OWN BRANCHES, one served at a time: serving another stops this one's twins and starts that one's under the
@@ -75,16 +82,24 @@ export async function serveWorldView(name: string, opts: { root?: string; port?:
   };
   const mountOpts = { root, branches: (served: string) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}), serveBranch };
   let world = await mountWorld(name, mountOpts);
+  base = world.served;
   worlds.set(world.served, world);
   const server = await serveHttp({
     // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, as `serve` takes them
     hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024,
     // this front serves a World and its branches; each World's own twins journal their requests
     twinRequestJournal: false,
-    async fetch(request) {
+    async fetch(incoming) {
+      // forwarded from the proxy's host: answered as at the World's own origin there (only that exact host; the proxy is
+      // on this machine, as everything that reaches a loopback front is)
+      const addressed = new URL(incoming.url).hostname.replace(/^\[|\]$/g, '');
+      const fromProxy = proxied && incoming.headers.get('x-forwarded-host') === proxied.host && ['localhost', '127.0.0.1', '::1'].includes(addressed);
+      const request = fromProxy
+        ? new Request(`${proxied.origin}${new URL(incoming.url).pathname}${new URL(incoming.url).search}`, incoming)
+        : incoming;
       const at = new URL(request.url); const path = at.pathname;
       // a World's own origin serves that World (and the ping and the console) and no other
-      const own = origins ? worldOfHost(at.hostname, worlds.keys()) : undefined;
+      const own = origins ? (proxied && at.host === proxied.host ? base! : worldOfHost(at.hostname, worlds.keys())) : undefined;
       if (own === null) return Response.json({ error: `no world at ${at.host}` }, { status: 404 });
       // the bare address, typed into a browser, is the World's page: at its own origin when it has one
       if (opts.console && path === '/' && request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html')) {