runwork 0.25.0 → 0.25.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bundled-types/core-routes.d.ts +25 -0
- package/dist/index.js +623 -301
- package/package.json +1 -1
|
@@ -24,6 +24,31 @@ export interface ClientErrorReport {
|
|
|
24
24
|
level?: 'error' | 'warning' | 'info';
|
|
25
25
|
category?: string;
|
|
26
26
|
}
|
|
27
|
+
/**
|
|
28
|
+
* Decide whether to send the permissive `Permissions-Policy` header for an app
|
|
29
|
+
* that is being embedded in an iframe.
|
|
30
|
+
*
|
|
31
|
+
* A document's own Permissions-Policy can only restrict, never grant: the grant
|
|
32
|
+
* comes from the embedding page's policy plus the iframe `allow` attribute. This
|
|
33
|
+
* header's job is therefore to stop the app self-restricting the features the
|
|
34
|
+
* platform preview delegates to it, and this predicate decides who is trusted
|
|
35
|
+
* enough to be handed that.
|
|
36
|
+
*
|
|
37
|
+
* Hostnames are parsed and compared exactly, never substring-matched against the
|
|
38
|
+
* raw header. The difference is not cosmetic: `origin.endsWith('runwork.ai')`
|
|
39
|
+
* also matches `https://notrunwork.ai`, and `origin.includes(domain)` matches
|
|
40
|
+
* `https://evil-acme.com.attacker.net` against a tenant's `acme.com`, which would
|
|
41
|
+
* hand an attacker's page camera, microphone, geolocation and screen capture over
|
|
42
|
+
* an embedded app.
|
|
43
|
+
*
|
|
44
|
+
* @param origin The `Origin` header, or the `Referer` as a fallback. Origin is a
|
|
45
|
+
* bare origin and Referer is a full URL; both parse the same way.
|
|
46
|
+
* Empty means direct (non-embedded) access.
|
|
47
|
+
* @param allowedOrigins Comma-separated exact hostnames from `ALLOWED_ORIGINS`,
|
|
48
|
+
* injected by the platform as the workspace's active custom
|
|
49
|
+
* domains. Matched exactly; subdomains are deliberately excluded.
|
|
50
|
+
*/
|
|
51
|
+
export declare function shouldGrantIframePermissions(origin: string, allowedOrigins?: string): boolean;
|
|
27
52
|
/**
|
|
28
53
|
* Mount all core platform routes on the Hono app
|
|
29
54
|
* Called from index.ts before user-defined routes
|