iframe.io 1.0.6 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iframe.io",
-  "version": "1.0.6",
+  "version": "1.2.0",
   "description": "Easy and friendly API to connect and interact between content window and its containing iframe",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -45,5 +45,5 @@
     "events",
     "io"
   ],
-  "author": "Fabrice K.M.E"
+  "author": "Fabrice K.E.M"
 }

package/src/index.ts

@@ -12,6 +12,16 @@ export type Options = {
   maxMessagesPerSecond?: number
   autoReconnect?: boolean
   messageQueueSize?: number
+  /**
+   * Optional allowlist of incoming application-level events.
+   * Reserved internal events (ping/pong/heartbeats) are always allowed.
+   */
+  allowedIncomingEvents?: string[]
+  /**
+   * Optional custom validator for incoming messages.
+   * Return false to drop a message; an 'error' event will be emitted.
+   */
+  validateIncoming?: ( event: string, payload: any, origin: string ) => boolean
 }
 
 export interface RegisteredEvents {
@@ -68,13 +78,32 @@ function sanitizePayload( payload: any, maxSize: number ): any {
 }
 
 const ackId = () => {
+  // Prefer cryptographically strong randomness when available
+  try {
+    const globalCrypto = (typeof crypto !== 'undefined'
+      ? crypto
+      : (typeof window !== 'undefined' && (window as any).crypto)
+        || (typeof globalThis !== 'undefined' && (globalThis as any).crypto))
+
+    if( globalCrypto && typeof globalCrypto.getRandomValues === 'function' ){
+      const buffer = new Uint32Array(4)
+      globalCrypto.getRandomValues( buffer )
+
+      const randomPart = Array.from( buffer ).map( n => n.toString( 16 ) ).join('')
+      return `${Date.now()}_${randomPart}`
+    }
+  }
+  catch{
+    // Fall back to Math.random-based implementation below
+  }
+
   const
   rmin = 100000,
   rmax = 999999,
-  timestamp = Date.now(),
-  random = Math.floor( Math.random() * ( rmax - rmin + 1 ) + rmin )
+  timestampFallback = Date.now(),
+  randomFallback = Math.floor( Math.random() * ( rmax - rmin + 1 ) + rmin )
 
-  return `${timestamp}_${random}`
+  return `${timestampFallback}_${randomFallback}`
 }
 
 const RESERVED_EVENTS = [
@@ -89,8 +118,8 @@ export default class IOF {
   peer: Peer
   options: Options
   private messageListener?: ( event: MessageEvent ) => void
-  private heartbeatTimer?: NodeJS.Timeout
-  private reconnectTimer?: NodeJS.Timeout
+  private heartbeatTimer?: number
+  private reconnectTimer?: number
   private messageQueue: QueuedMessage[] = []
   private messageRateTracker: number[] = []
   private reconnectAttempts: number = 0
@@ -312,11 +341,38 @@ export default class IOF {
           this.peer.connected = true
           this.reconnectAttempts = 0
           this.peer.lastHeartbeat = Date.now()
+          
           this.startHeartbeat()
           this.fire('connect')
           this.processMessageQueue()
+          this.debug(`[${this.peer.type}] connected`)
 
-          return this.debug(`[${this.peer.type}] connected`)
+          return
+        }
+
+        // Optional application-level incoming validation (non-reserved events only)
+        if( !RESERVED_EVENTS.includes( _event ) ){
+          if( this.options.allowedIncomingEvents
+              && !this.options.allowedIncomingEvents.includes( _event ) ){
+            this.fire('error', {
+              type: 'DISALLOWED_EVENT',
+              direction: 'incoming',
+              event: _event,
+              origin
+            })
+            return
+          }
+
+          if( this.options.validateIncoming
+              && !this.options.validateIncoming( _event, payload, origin ) ){
+            this.fire('error', {
+              type: 'INVALID_MESSAGE',
+              direction: 'incoming',
+              event: _event,
+              origin
+            })
+            return
+          }
         }
 
         // Fire available event listeners
@@ -347,6 +403,7 @@ export default class IOF {
     this.peer.type = 'IFRAME' // iframe.io connection listener is automatically set as IFRAME
     this.peer.connected = false
     this.reconnectAttempts = 0
+
     this.debug(`[${this.peer.type}] Listening to connect${hostOrigin ? `: Host <${hostOrigin}>` : ''}`)
 
     // Clean up existing listener if any
@@ -414,7 +471,8 @@ export default class IOF {
           this.fire('connect')
           this.processMessageQueue()
 
-          return this.debug(`[${this.peer.type}] connected`)
+          this.debug(`[${this.peer.type}] connected`)
+          return
         }
 
         // Fire available event listeners
@@ -437,8 +495,10 @@ export default class IOF {
 
   fire( _event: string, payload?: MessageData['payload'], cid?: string ){
     // Volatile event - check if any listeners exist
-    if( !this.Events[_event] && !this.Events[_event + '--@once'] )
-      return this.debug(`[${this.peer.type}] No <${_event}> listener defined`)
+    if( !this.Events[_event] && !this.Events[_event + '--@once'] ){
+      this.debug(`[${this.peer.type}] No <${_event}> listener defined`)
+      return
+    }
 
     const ackFn = cid
       ? ( error: boolean | string, ...args: any[] ): void => {
@@ -590,7 +650,7 @@ export default class IOF {
     return new Promise(( resolve, reject ) => {
       const timeoutId = setTimeout(() => {
         reject( new Error(`Event '${_event}' acknowledgment timeout after ${timeout}ms`) )
-      }, timeout)
+      }, timeout )
 
       try {
         this.emit( _event, payload, ( error, ...args ) => {
@@ -646,7 +706,7 @@ export default class IOF {
   }
 
   disconnect( fn?: () => void ){
-    // Clean disconnect method
+    // Cleanup on disconnect
     this.cleanup()
 
     this.peer.connected = false
@@ -656,6 +716,7 @@ export default class IOF {
     this.messageQueue = []
     this.messageRateTracker = []
     this.reconnectAttempts = 0
+
     this.removeListeners()
 
     typeof fn == 'function' && fn()