@xpert-ai/chatkit-web-component 0.5.0 → 0.5.1

package/dist/xpert-chatkit.umd.cjs

@@ -51,7 +51,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
 var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
-  var _a, _b, _setTrainingOptOut_dec, _hideHistory_dec, _showHistory_dec, _sendCustomAction_dec, _shareThread_dec, _setThreadId_dec, _setRuntimeCapabilities_dec, _setComposerValue_dec, _sendUserMessage_dec, _fetchUpdates_dec, _focusComposer_dec, _c, _opts, _frameUrl, _frame, _wrapper, _launcherCloseButton, _launcherOpen, _chatMinimizedToPet, _framePetOptionsOverride, _petClosedByContextMenu, _shadow, _petOverlay, _resolveLoaded, _loaded, _messenger, _ChatKitElementBase_instances, emitAndThrow_fn, setOptionsDataAttributes_fn, getDisplayMode_fn, getConfiguredPetOptions_fn, mergeConfiguredPetPositionDefaults_fn, getOverlayPetOptions_fn, resolvePetAssetUrl_fn, resolveOverlayPetOptions_fn, getFrameOptions_fn, setLauncherOpen_fn, setChatMinimizedToPet_fn, syncPetOverlayOptions_fn, handlePetActivate_fn, handlePetClose_fn, handlePetReply_fn, handlePetThreadSummaryActivate_fn, _handleLauncherClose, getFrameUrl_fn, setFrameUrl_fn, consumeFrameUrl_fn, _handleFrameLoad, _initialized, maybeInit_fn, _init;
+  var _a, _b, _setTrainingOptOut_dec, _hideHistory_dec, _showHistory_dec, _sendCustomAction_dec, _shareThread_dec, _setThreadId_dec, _setRuntimeCapabilities_dec, _setComposerValue_dec, _sendUserMessage_dec, _fetchUpdates_dec, _focusComposer_dec, _c, _opts, _frameUrl, _frame, _wrapper, _launcherCloseButton, _launcherOpen, _chatMinimizedToPet, _framePetOptionsOverride, _petClosedByContextMenu, _shadow, _petOverlay, _resolveLoaded, _loaded, _channelId, _messenger, _ChatKitElementBase_instances, emitAndThrow_fn, setOptionsDataAttributes_fn, getDisplayMode_fn, getConfiguredPetOptions_fn, mergeConfiguredPetPositionDefaults_fn, getOverlayPetOptions_fn, resolvePetAssetUrl_fn, resolveOverlayPetOptions_fn, getFrameOptions_fn, setLauncherOpen_fn, setChatMinimizedToPet_fn, syncPetOverlayOptions_fn, handlePetActivate_fn, handlePetClose_fn, handlePetReply_fn, handlePetThreadSummaryActivate_fn, _handleLauncherClose, getFrameUrl_fn, setFrameUrl_fn, consumeFrameUrl_fn, _handleFrameLoad, _initialized, maybeInit_fn, _init;
   class EventEmitter {
     constructor() {
       __publicField(this, "callbacks", /* @__PURE__ */ new Map());
@@ -370,7 +370,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       }
     });
   };
-  function safeRandomUUID() {
+  function createSecureChannelId() {
     const cryptoRef = globalThis.crypto;
     if (typeof (cryptoRef == null ? void 0 : cryptoRef.randomUUID) === "function") {
       return cryptoRef.randomUUID();
@@ -382,7 +382,30 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       bytes[8] = bytes[8] & 63 | 128;
       return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("").replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/, "$1-$2-$3-$4-$5");
     }
-    return `ck_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+    return null;
+  }
+  function safeRandomUUID() {
+    return createSecureChannelId() ?? `ck_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+  }
+  function isTrustedChatKitMessageEvent(event, { channelId, expectedOrigin, expectedSource }) {
+    const payload = event.data;
+    if (!payload || typeof payload !== "object" || !("__xpaiChatKit" in payload)) {
+      return false;
+    }
+    if (payload.__xpaiChatKit !== true) {
+      return false;
+    }
+    if (expectedOrigin !== "*" && event.origin !== expectedOrigin) {
+      return false;
+    }
+    if (event.source === expectedSource) {
+      return true;
+    }
+    const normalizedChannelId = channelId == null ? void 0 : channelId.trim();
+    if (normalizedChannelId) {
+      return "channelId" in payload && payload.channelId === normalizedChannelId;
+    }
+    return false;
   }
   let IntegrationError$1 = class IntegrationError2 extends Error {
     constructor(message) {
@@ -416,10 +439,12 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       handlers,
       target,
       targetOrigin,
+      channelId,
       fetch: fetch2 = window.fetch
     }) {
       __publicField(this, "targetOrigin");
       __publicField(this, "target");
+      __publicField(this, "channelId");
       __publicField(this, "commandHandlers");
       __publicField(this, "_fetch");
       __publicField(this, "emitter", new EventEmitter());
@@ -450,7 +475,11 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       ));
       __publicField(this, "handleMessage", async (event) => {
         var _a2, _b2, _c2, _d;
-        if (!event.data || event.data.__xpaiChatKit !== true || event.origin !== this.targetOrigin || event.source !== this.target()) {
+        if (!isTrustedChatKitMessageEvent(event, {
+          channelId: this.channelId,
+          expectedOrigin: this.targetOrigin,
+          expectedSource: this.target()
+        })) {
           return;
         }
         const data = event.data;
@@ -591,6 +620,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       this.commandHandlers = handlers;
       this.target = target;
       this.targetOrigin = targetOrigin;
+      this.channelId = (channelId == null ? void 0 : channelId.trim()) || void 0;
       this._fetch = (...args) => fetch2(...args);
     }
     setTargetOrigin(targetOrigin) {
@@ -600,6 +630,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       var _a2;
       const message = {
         __xpaiChatKit: true,
+        ...this.channelId ? { channelId: this.channelId } : {},
         ...data
       };
       (_a2 = this.target()) == null ? void 0 : _a2.postMessage(message, this.targetOrigin, transfer);
@@ -2607,7 +2638,9 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
       __privateAdd(this, _loaded, new Promise((resolve) => {
         __privateSet(this, _resolveLoaded, resolve);
       }));
+      __privateAdd(this, _channelId, createSecureChannelId());
       __privateAdd(this, _messenger, new ChatFrameMessenger({
+        channelId: __privateGet(this, _channelId) ?? void 0,
         fetch: (...args) => {
           var _a2;
           const customFetch = ((_a2 = __privateGet(this, _opts)) == null ? void 0 : _a2.api) && "fetch" in __privateGet(this, _opts).api && __privateGet(this, _opts).api.fetch;
@@ -3106,6 +3139,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
   _petOverlay = new WeakMap();
   _resolveLoaded = new WeakMap();
   _loaded = new WeakMap();
+  _channelId = new WeakMap();
   _messenger = new WeakMap();
   _ChatKitElementBase_instances = new WeakSet();
   emitAndThrow_fn = function(error) {
@@ -3316,7 +3350,8 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
     frameURL.hash = encodeBase64({
       options: getInnerOptions(__privateMethod(this, _ChatKitElementBase_instances, getFrameOptions_fn).call(this, __privateGet(this, _opts))),
       referrer: window.location.origin,
-      profile: this.profile
+      profile: this.profile,
+      ...__privateGet(this, _channelId) ? { channelId: __privateGet(this, _channelId) } : {}
     });
     __privateGet(this, _messenger).connect();
     __privateGet(this, _frame).src = frameURL.toString();