iframe-pubsub 1.0.22 → 1.0.24

package/dist/index.d.mts

@@ -30,10 +30,29 @@ declare class Client {
     private isIframe;
     private isMainApp;
     private boundHandleMessage;
+    /**
+     * Create a new client instance.
+     *
+     * @param pageId The ID of the page or component to register to.
+     */
     constructor(pageId: string, targetAIChatClientId?: string);
+    /**
+     * Unregister the client from the pubsub.
+     */
     unregister(): void;
     cleanAIChat(): boolean;
+    /**
+     * Listen for messages from the parent page with a callback.
+     *
+     * @param callback The callback function to register.
+     */
     onMessage(callback: MessageCallback): void;
+    /**
+     * Send a message to the another page or component.
+     *
+     * @param to The ID of the page or component to send the message to.
+     * @param payload The payload of the message.
+     */
     sendMessage(to: string, payload: any): void;
     /**
      * Check if a client with the given ID exists in the PubSub system.

package/dist/index.d.ts

@@ -30,10 +30,29 @@ declare class Client {
     private isIframe;
     private isMainApp;
     private boundHandleMessage;
+    /**
+     * Create a new client instance.
+     *
+     * @param pageId The ID of the page or component to register to.
+     */
     constructor(pageId: string, targetAIChatClientId?: string);
+    /**
+     * Unregister the client from the pubsub.
+     */
     unregister(): void;
     cleanAIChat(): boolean;
+    /**
+     * Listen for messages from the parent page with a callback.
+     *
+     * @param callback The callback function to register.
+     */
     onMessage(callback: MessageCallback): void;
+    /**
+     * Send a message to the another page or component.
+     *
+     * @param to The ID of the page or component to send the message to.
+     * @param payload The payload of the message.
+     */
     sendMessage(to: string, payload: any): void;
     /**
      * Check if a client with the given ID exists in the PubSub system.

package/dist/index.js

@@ -29,6 +29,11 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/cors.ts
+function isAllowedOrigin(origin) {
+  return origin === "null" || origin.startsWith("http://localhost") || origin.endsWith(".bkpi.co") || origin.endsWith(".bookipi.com");
+}
+
 // src/PubSub.ts
 var _PubSub = class _PubSub {
   constructor() {
@@ -83,7 +88,7 @@ var _PubSub = class _PubSub {
     const subscriber = this.subscribers.get(message.to);
     if (subscriber) {
       if (subscriber.source) {
-        subscriber.source.postMessage(message, "*");
+        subscriber.source.postMessage(message, subscriber.origin || "*");
       } else {
         subscriber.callback(message);
       }
@@ -100,12 +105,15 @@ var _PubSub = class _PubSub {
   handleMessage(event) {
     const data = event.data;
     const source = event.source;
+    const origin = event.origin;
+    if (!isAllowedOrigin(origin)) return;
     if (data?.type === "REGISTER") {
       const registration = data;
       this.subscribers.set(registration.pageId, {
         source,
+        origin: registration.origin,
         callback: (message2) => {
-          source.postMessage(message2, "*");
+          source.postMessage(message2, registration.origin || "*");
         }
       });
       return;
@@ -120,7 +128,7 @@ var _PubSub = class _PubSub {
         type: "CLIENT_EXISTS_RESPONSE",
         requestId: data.requestId,
         exists: this.subscribers.has(data.clientId)
-      }, "*");
+      }, data.origin || "*");
       return;
     }
     if (!data || !data.from || !data.to) return;
@@ -130,8 +138,8 @@ var _PubSub = class _PubSub {
     }
     const subscriber = this.subscribers.get(message.to);
     if (!subscriber) return;
-    if (subscriber.source) {
-      subscriber.source.postMessage(message, "*");
+    if (subscriber?.source) {
+      subscriber.source.postMessage(message, subscriber.origin || "*");
     } else {
       subscriber.callback(message);
     }
@@ -151,6 +159,11 @@ var PubSub = _PubSub;
 
 // src/Client.ts
 var Client = class {
+  /**
+   * Create a new client instance.
+   * 
+   * @param pageId The ID of the page or component to register to.
+   */
   constructor(pageId, targetAIChatClientId = "aichat" /* AI_CHAT_CLIENT_ID */) {
     __publicField(this, "targetAIChatClientId");
     __publicField(this, "pageId");
@@ -175,13 +188,17 @@ var Client = class {
       window.top.postMessage(
         {
           type: "REGISTER",
-          pageId: this.pageId
+          pageId: this.pageId,
+          origin: window.location.origin
         },
         "*"
       );
       window.addEventListener("message", this.boundHandleMessage);
     }
   }
+  /**
+   * Unregister the client from the pubsub.
+   */
   unregister() {
     if (this.isMainApp && this.pubsub) {
       this.pubsub.unregister(this.pageId);
@@ -189,7 +206,8 @@ var Client = class {
       window.top.postMessage(
         {
           type: "UNREGISTER",
-          pageId: this.pageId
+          pageId: this.pageId,
+          origin: window.location.origin
         },
         "*"
       );
@@ -202,9 +220,20 @@ var Client = class {
     console.warn(`\u203C\uFE0F Unsupported operation cleanAIChat has been called from ${this.pageId}.`);
     return false;
   }
+  /**
+   * Listen for messages from the parent page with a callback.
+   * 
+   * @param callback The callback function to register.
+   */
   onMessage(callback) {
     this.callback = callback;
   }
+  /**
+   * Send a message to the another page or component.
+   * 
+   * @param to The ID of the page or component to send the message to.
+   * @param payload The payload of the message.
+   */
   sendMessage(to, payload) {
     const message = {
       from: this.pageId,
@@ -262,6 +291,7 @@ var Client = class {
       } else {
         const requestId = `check-client-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
         const messageHandler = (event) => {
+          if (!isAllowedOrigin(event.origin)) return;
           const data = event.data;
           if (data && data.type === "CLIENT_EXISTS_RESPONSE" && data.requestId === requestId) {
             window.removeEventListener("message", messageHandler);

package/dist/index.mjs

@@ -2,6 +2,11 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
+// src/cors.ts
+function isAllowedOrigin(origin) {
+  return origin === "null" || origin.startsWith("http://localhost") || origin.endsWith(".bkpi.co") || origin.endsWith(".bookipi.com");
+}
+
 // src/PubSub.ts
 var _PubSub = class _PubSub {
   constructor() {
@@ -56,7 +61,7 @@ var _PubSub = class _PubSub {
     const subscriber = this.subscribers.get(message.to);
     if (subscriber) {
       if (subscriber.source) {
-        subscriber.source.postMessage(message, "*");
+        subscriber.source.postMessage(message, subscriber.origin || "*");
       } else {
         subscriber.callback(message);
       }
@@ -73,12 +78,15 @@ var _PubSub = class _PubSub {
   handleMessage(event) {
     const data = event.data;
     const source = event.source;
+    const origin = event.origin;
+    if (!isAllowedOrigin(origin)) return;
     if (data?.type === "REGISTER") {
       const registration = data;
       this.subscribers.set(registration.pageId, {
         source,
+        origin: registration.origin,
         callback: (message2) => {
-          source.postMessage(message2, "*");
+          source.postMessage(message2, registration.origin || "*");
         }
       });
       return;
@@ -93,7 +101,7 @@ var _PubSub = class _PubSub {
         type: "CLIENT_EXISTS_RESPONSE",
         requestId: data.requestId,
         exists: this.subscribers.has(data.clientId)
-      }, "*");
+      }, data.origin || "*");
       return;
     }
     if (!data || !data.from || !data.to) return;
@@ -103,8 +111,8 @@ var _PubSub = class _PubSub {
     }
     const subscriber = this.subscribers.get(message.to);
     if (!subscriber) return;
-    if (subscriber.source) {
-      subscriber.source.postMessage(message, "*");
+    if (subscriber?.source) {
+      subscriber.source.postMessage(message, subscriber.origin || "*");
     } else {
       subscriber.callback(message);
     }
@@ -124,6 +132,11 @@ var PubSub = _PubSub;
 
 // src/Client.ts
 var Client = class {
+  /**
+   * Create a new client instance.
+   * 
+   * @param pageId The ID of the page or component to register to.
+   */
   constructor(pageId, targetAIChatClientId = "aichat" /* AI_CHAT_CLIENT_ID */) {
     __publicField(this, "targetAIChatClientId");
     __publicField(this, "pageId");
@@ -148,13 +161,17 @@ var Client = class {
       window.top.postMessage(
         {
           type: "REGISTER",
-          pageId: this.pageId
+          pageId: this.pageId,
+          origin: window.location.origin
         },
         "*"
       );
       window.addEventListener("message", this.boundHandleMessage);
     }
   }
+  /**
+   * Unregister the client from the pubsub.
+   */
   unregister() {
     if (this.isMainApp && this.pubsub) {
       this.pubsub.unregister(this.pageId);
@@ -162,7 +179,8 @@ var Client = class {
       window.top.postMessage(
         {
           type: "UNREGISTER",
-          pageId: this.pageId
+          pageId: this.pageId,
+          origin: window.location.origin
         },
         "*"
       );
@@ -175,9 +193,20 @@ var Client = class {
     console.warn(`\u203C\uFE0F Unsupported operation cleanAIChat has been called from ${this.pageId}.`);
     return false;
   }
+  /**
+   * Listen for messages from the parent page with a callback.
+   * 
+   * @param callback The callback function to register.
+   */
   onMessage(callback) {
     this.callback = callback;
   }
+  /**
+   * Send a message to the another page or component.
+   * 
+   * @param to The ID of the page or component to send the message to.
+   * @param payload The payload of the message.
+   */
   sendMessage(to, payload) {
     const message = {
       from: this.pageId,
@@ -235,6 +264,7 @@ var Client = class {
       } else {
         const requestId = `check-client-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
         const messageHandler = (event) => {
+          if (!isAllowedOrigin(event.origin)) return;
           const data = event.data;
           if (data && data.type === "CLIENT_EXISTS_RESPONSE" && data.requestId === requestId) {
             window.removeEventListener("message", messageHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iframe-pubsub",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "A PubSub library for iframe communication.",
   "author": "Lap Tran",
   "license": "ISC",