discovery-media-player 0.1.8 → 0.1.9

package/README.md

@@ -189,6 +189,11 @@ the player, not the people plugging into it.
 [`CONTRIBUTING.md`](CONTRIBUTING.md) — how to run the tests, what the review looks for, and the
 one rule that matters: a behaviour worth keeping is worth a test that fails without it.
 
+Your first pull request asks you to sign the [CLA](CLA.md) — one reply, once, for good. You keep
+the copyright in your work; you grant a licence that may be sublicensed, so that the core can stay
+AGPL while a commercial licence remains possible for organisations that cannot live with the
+network clause. Better said before you write the patch than after.
+
 The code comments are in French. The project was built in a French company and the reasoning
 behind each decision is written where the decision is; translating it would have meant either
 losing it or maintaining two versions. Everything an integrator needs is in English.

package/context/standalone.js

@@ -11,7 +11,7 @@
 //     déléguées à des routes de l'hôte, ou refusées si elles ne sont pas configurées.
 //
 // ⚠️ Il ne remplace pas un câblage : il ne sait rien de vos rôles. Ce qu'il ne sait pas, il le
-// REFUSE — jamais il n'accorde par défaut. Cf. CONTRAT.md, « Le câblage d'une instance ».
+// REFUSE — jamais il n'accorde par défaut. Cf. docs/CONFIGURATION.md, « Decisions that are yours ».
 
 const storage = require("./storage");
 
@@ -289,6 +289,12 @@ function createStandaloneContext(env = process.env) {
       supabasePublishableKey: env.SUPABASE_PUBLISHABLE_KEY || "",
       mapsKey: env.GOOGLE_MAPS_API_KEY || "",
       extraFrameAncestors: String(env.DOC_FRAME_ANCESTORS || "").split(/\s+/).filter(Boolean),
+      // ⚠️ Un BOOLÉEN, jamais l'URL. La carte d'identité doit pouvoir dire « un émetteur distinct
+      // est configuré » sans dire lequel : c'est le dernier endroit où un hôte devait deviner.
+      // `host-auth` dit que le code SAIT faire la séparation ; ceci dit qu'elle est POSÉE. Sans
+      // les deux, une variable oubliée redonne exactement le symptôme que 0.1.8 a retiré — des
+      // membres « non authentifiés », ce qui ressemble à un droit manquant.
+      separateIssuer: !!sansBarreFinale(env.PLAYER_AUTH_URL),
     },
   };
 }

package/docs/HOST-CONTRACT.md

@@ -25,9 +25,10 @@ need.
 {
   "product": "discovery-media-player",
   "contract": 1,
-  "version": "0.1.8",
+  "version": "0.1.9",
   "capabilities": ["docshare", "presentations", "embed-denied", "host-fetch", "brand-reference", "host-auth"],
   "frameAncestors": ["'self'", "https://*.vercel.app", "https://app.example.com"],
+  "separateIssuer": true,
   "plugins": { "bot": false, "visitors": false, "brandIntro": false, "botBrowser": false, "providerQuotas": false }
 }
 ```
@@ -67,8 +68,14 @@ things. They are the same project while the player and your application share a
 different by construction once the instance is separate. Point `PLAYER_AUTH_URL` at the project
 that issues your members' tokens (with its own publishable key in `PLAYER_AUTH_KEY`), or every
 member action is refused in a way that reads like a missing permission. Unset, it falls back to
-the player's own project, so a shared deployment changes by not one character. The `host-auth`
-capability tells you an instance supports the split.
+the player's own project, so a shared deployment changes by not one character.
+
+Two signals, and you need both: **`host-auth` in `capabilities`** says this instance *can* target
+a separate issuer; **`separateIssuer: true`** says one *is configured*. A version that supports
+the split with the variable left unset fails exactly like the version before it — members come
+back unauthenticated, which reads like a missing permission — and you would conclude the upgrade
+changed nothing. The card answers with a boolean and never the issuer itself: you already know
+which one is yours.
 
 ### 2. What a client's brand is
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discovery-media-player",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Self-hosted document viewer: per-recipient tracked links, reading analytics, live presentation. The core knows nothing about the application hosting it — everything it borrows arrives through an injected context.",
   "keywords": [
     "pdf-viewer",
@@ -66,12 +66,12 @@
     "node": ">=22"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.4",
-    "esbuild": "^0.25.12",
-    "eslint": "^9.39.4",
+    "@eslint/js": "^10.0.1",
+    "esbuild": "^0.28.2",
+    "eslint": "^10.8.1",
     "jsdom": "^25.0.1",
     "typescript": "^5.5.4",
     "typescript-eslint": "^8.46.4",
-    "vitest": "^3.2.7"
+    "vitest": "^4.1.10"
   }
 }

package/server/handler.js

@@ -1172,7 +1172,7 @@ const LEGAL_CSS = `
 function sendHtml(res, status, html, scriptSrc, imgExtra, frameAncestors) {
   res.statusCode = status;
   // Origine Supabase Storage (voix ElevenLabs mise en cache dans le bucket public tts-cache) → autorisée en media-src.
-  let supaOrigin = ""; try { supaOrigin = new URL(process.env.SUPABASE_URL || "").origin; } catch { supaOrigin = ""; }
+  let supaOrigin; try { supaOrigin = new URL(process.env.SUPABASE_URL || "").origin; } catch { supaOrigin = ""; }
   res.setHeader("Content-Type", "text/html; charset=utf-8");
   res.setHeader("Cache-Control", "no-store, max-age=0");
   res.setHeader("X-Content-Type-Options", "nosniff");
@@ -2595,6 +2595,11 @@ async function handler(req, res) {
         // autrement — le navigateur bloque avant tout script, et rien ne peut lui être émis.
         // Ce n'est pas un secret : ces mêmes valeurs partent dans chaque en-tête CSP servi.
         frameAncestors: ["'self'", "https://*.vercel.app"].concat(PLAYER.config.extraFrameAncestors || []),
+        // Même besoin que `frameAncestors`, l'inverse de la réponse : là on nomme les origines
+        // parce qu'un hôte doit voir que LA SIENNE manque ; ici un booléen suffit, parce que
+        // l'hôte connaît déjà son émetteur — il veut seulement savoir si l'instance le regarde.
+        // Dire lequel n'aiderait personne et renseignerait qui sonde.
+        separateIssuer: !!(PLAYER.config && PLAYER.config.separateIssuer),
         // Greffons de l'hôte : présents ou coupés (PLAYER_PLUGINS_OFF). Booléens uniquement.
         plugins: {
           bot: !!p.bot, visitors: !!p.visitors, brandIntro: !!p.brandIntro,