ugly-app 0.1.507 → 0.1.508

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,2 +1,2 @@
1
- export declare const CLI_VERSION = "0.1.507";
1
+ export declare const CLI_VERSION = "0.1.508";
2
2
  //# sourceMappingURL=version.d.ts.map
@@ -1,3 +1,3 @@
1
1
  // Auto-generated by prebuild — do not edit manually
2
- export const CLI_VERSION = "0.1.507";
2
+ export const CLI_VERSION = "0.1.508";
3
3
  //# sourceMappingURL=version.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"wrapWithAssets.d.ts","sourceRoot":"","sources":["../../../../src/server/adapter/workers/wrapWithAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,YAAY,GACnB,UAAU,CAgEZ"}
1
+ {"version":3,"file":"wrapWithAssets.d.ts","sourceRoot":"","sources":["../../../../src/server/adapter/workers/wrapWithAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AA8FD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,YAAY,GACnB,UAAU,CAiEZ"}
@@ -27,6 +27,8 @@
27
27
  * `/{buildId}/*`, and the SPA fallback (any non-base, non-asset
28
28
  * GET that the base would 404).
29
29
  */
30
+ import { getUglyBotUrl } from '../../../shared/uglyBotUrl.js';
31
+ import { getAppContext } from './createWorkersApp.js';
30
32
  const ASSET_CACHE_CONTROL = 'public, max-age=31536000, immutable';
31
33
  const HTML_CACHE_CONTROL = 'no-cache, no-store, must-revalidate';
32
34
  function guessContentType(path) {
@@ -62,15 +64,71 @@ function guessContentType(path) {
62
64
  return 'application/json; charset=utf-8';
63
65
  return 'application/octet-stream';
64
66
  }
65
- function htmlResponse(html) {
67
+ function htmlResponse(html, extraHeaders) {
66
68
  return new Response(html, {
67
69
  status: 200,
68
70
  headers: {
69
71
  'content-type': 'text/html; charset=utf-8',
70
72
  'cache-control': HTML_CACHE_CONTROL,
73
+ ...extraHeaders,
71
74
  },
72
75
  });
73
76
  }
77
+ function readAuthCookie(request) {
78
+ const cookieHeader = request.headers.get('Cookie');
79
+ if (!cookieHeader)
80
+ return null;
81
+ for (const part of cookieHeader.split(';')) {
82
+ const [name, ...rest] = part.trim().split('=');
83
+ if (name === 'auth_token')
84
+ return rest.join('=');
85
+ }
86
+ return null;
87
+ }
88
+ /**
89
+ * Mirror Node `App.ts`'s `injectScript` flow: read the `auth_token`
90
+ * cookie, verify it via ugly.bot, and inject `window.__AUTH_TOKEN__`
91
+ * before `</head>` so the framework client's `bootstrapApp` boots in
92
+ * the authenticated state on the first paint.
93
+ *
94
+ * Without this injection the client always sees `__AUTH_TOKEN__` as
95
+ * undefined, the `AutoLoginGate` kicks in on every page load, the
96
+ * iframe-auth handshake gets a fresh code, `/auth/verify` re-sets the
97
+ * (HttpOnly) cookie, `window.location.reload()` fires, and we loop
98
+ * forever because the cookie is invisible to JavaScript.
99
+ *
100
+ * Also injects `__UGLY_BOT_URL__` so the AutoLoginGate's iframe-auth
101
+ * postMessage handshake uses the correct origin.
102
+ */
103
+ async function buildAuthInjection(request) {
104
+ let injectedToken = null;
105
+ const cookieToken = readAuthCookie(request);
106
+ if (cookieToken) {
107
+ try {
108
+ await getAppContext().verifyToken(cookieToken);
109
+ injectedToken = cookieToken;
110
+ }
111
+ catch {
112
+ // Cookie invalid/expired — leave the token slot empty; the
113
+ // SPA's AutoLoginGate will silently re-acquire. The Set-Cookie
114
+ // delete header below clears the bad cookie so the loop ends.
115
+ }
116
+ }
117
+ const parts = [];
118
+ if (injectedToken) {
119
+ parts.push(`<script>window.__AUTH_TOKEN__=${JSON.stringify(injectedToken)}</script>`);
120
+ }
121
+ parts.push(`<script>window.__UGLY_BOT_URL__=${JSON.stringify(getUglyBotUrl())}</script>`);
122
+ return parts.join('');
123
+ }
124
+ function injectIntoHead(html, scripts) {
125
+ if (!scripts)
126
+ return html;
127
+ const idx = html.indexOf('</head>');
128
+ if (idx === -1)
129
+ return scripts + html; // no head — prepend
130
+ return html.slice(0, idx) + scripts + html.slice(idx);
131
+ }
74
132
  export function wrapWithAssets(base, config) {
75
133
  const { indexHtml, buildId } = config;
76
134
  const assetPrefix = `/${buildId}/`;
@@ -113,7 +171,8 @@ export function wrapWithAssets(base, config) {
113
171
  // index document. Client-side routing takes it from here.
114
172
  // POST/PUT/DELETE on unrecognized paths get the base's 404.
115
173
  if (method === 'GET' || method === 'HEAD') {
116
- return htmlResponse(indexHtml);
174
+ const injection = await buildAuthInjection(request);
175
+ return htmlResponse(injectIntoHead(indexHtml, injection));
117
176
  }
118
177
  return baseRes;
119
178
  },
@@ -1 +1 @@
1
- {"version":3,"file":"wrapWithAssets.js","sourceRoot":"","sources":["../../../../src/server/adapter/workers/wrapWithAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAqBH,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AAEjE,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,kBAAkB;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,MAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,OAAO,GAAG,CAAC;IAEnC,OAAO;QACL,KAAK,CAAC,KAAK,CACT,OAAgB,EAChB,GAAe,EACf,GAAqB;YAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAE5C,iEAAiE;YACjE,4DAA4D;YAC5D,aAAa;YACb,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;gBAC7E,MAAM,GAAG,GAAG,UAAU,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,MAAM,WAAW,GACf,GAAG,CAAC,YAAY,EAAE,WAAW,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAC1D,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAiC,EAAE;oBACzD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,WAAW;wBAC3B,eAAe,EAAE,mBAAmB;wBACpC,2DAA2D;wBAC3D,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YAED,iEAAiE;YACjE,4DAA4D;YAC5D,0DAA0D;YAC1D,4DAA4D;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,iEAAiE;YACjE,+DAA+D;YAC/D,0DAA0D;YAC1D,4DAA4D;YAC5D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"wrapWithAssets.js","sourceRoot":"","sources":["../../../../src/server/adapter/workers/wrapWithAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAgBtD,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AAEjE,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrE,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,YAAqC;IACvE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,kBAAkB;YACnC,GAAG,YAAY;SAChB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IAChD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,aAAa,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,aAAa,GAAG,WAAW,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,+DAA+D;YAC/D,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACR,iCAAiC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAC1E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,mCAAmC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,WAAW,CAC9E,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,MAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,OAAO,GAAG,CAAC;IAEnC,OAAO;QACL,KAAK,CAAC,KAAK,CACT,OAAgB,EAChB,GAAe,EACf,GAAqB;YAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAE5C,iEAAiE;YACjE,4DAA4D;YAC5D,aAAa;YACb,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;gBAC7E,MAAM,GAAG,GAAG,UAAU,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,MAAM,WAAW,GACf,GAAG,CAAC,YAAY,EAAE,WAAW,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAC1D,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAiC,EAAE;oBACzD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,WAAW;wBAC3B,eAAe,EAAE,mBAAmB;wBACpC,2DAA2D;wBAC3D,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YAED,iEAAiE;YACjE,4DAA4D;YAC5D,0DAA0D;YAC1D,4DAA4D;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,iEAAiE;YACjE,+DAA+D;YAC/D,0DAA0D;YAC1D,4DAA4D;YAC5D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,YAAY,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ugly-app",
3
- "version": "0.1.507",
3
+ "version": "0.1.508",
4
4
  "type": "module",
5
5
  "main": "./dist/server/index.js",
6
6
  "exports": {
@@ -1,2 +1,2 @@
1
1
  // Auto-generated by prebuild — do not edit manually
2
- export const CLI_VERSION = "0.1.507";
2
+ export const CLI_VERSION = "0.1.508";
@@ -30,8 +30,10 @@
30
30
 
31
31
  import type { ExecutionContext } from '@cloudflare/workers-types';
32
32
 
33
+ import { getUglyBotUrl } from '../../../shared/uglyBotUrl.js';
33
34
  import type { WorkersEnv } from './cf-types.js';
34
35
  import type { WorkersApp } from './createWorkersApp.js';
36
+ import { getAppContext } from './createWorkersApp.js';
35
37
 
36
38
  export interface AssetsConfig {
37
39
  /**
@@ -71,16 +73,74 @@ function guessContentType(path: string): string {
71
73
  return 'application/octet-stream';
72
74
  }
73
75
 
74
- function htmlResponse(html: string): Response {
76
+ function htmlResponse(html: string, extraHeaders?: Record<string, string>): Response {
75
77
  return new Response(html, {
76
78
  status: 200,
77
79
  headers: {
78
80
  'content-type': 'text/html; charset=utf-8',
79
81
  'cache-control': HTML_CACHE_CONTROL,
82
+ ...extraHeaders,
80
83
  },
81
84
  });
82
85
  }
83
86
 
87
+ function readAuthCookie(request: Request): string | null {
88
+ const cookieHeader = request.headers.get('Cookie');
89
+ if (!cookieHeader) return null;
90
+ for (const part of cookieHeader.split(';')) {
91
+ const [name, ...rest] = part.trim().split('=');
92
+ if (name === 'auth_token') return rest.join('=');
93
+ }
94
+ return null;
95
+ }
96
+
97
+ /**
98
+ * Mirror Node `App.ts`'s `injectScript` flow: read the `auth_token`
99
+ * cookie, verify it via ugly.bot, and inject `window.__AUTH_TOKEN__`
100
+ * before `</head>` so the framework client's `bootstrapApp` boots in
101
+ * the authenticated state on the first paint.
102
+ *
103
+ * Without this injection the client always sees `__AUTH_TOKEN__` as
104
+ * undefined, the `AutoLoginGate` kicks in on every page load, the
105
+ * iframe-auth handshake gets a fresh code, `/auth/verify` re-sets the
106
+ * (HttpOnly) cookie, `window.location.reload()` fires, and we loop
107
+ * forever because the cookie is invisible to JavaScript.
108
+ *
109
+ * Also injects `__UGLY_BOT_URL__` so the AutoLoginGate's iframe-auth
110
+ * postMessage handshake uses the correct origin.
111
+ */
112
+ async function buildAuthInjection(request: Request): Promise<string> {
113
+ let injectedToken: string | null = null;
114
+ const cookieToken = readAuthCookie(request);
115
+ if (cookieToken) {
116
+ try {
117
+ await getAppContext().verifyToken(cookieToken);
118
+ injectedToken = cookieToken;
119
+ } catch {
120
+ // Cookie invalid/expired — leave the token slot empty; the
121
+ // SPA's AutoLoginGate will silently re-acquire. The Set-Cookie
122
+ // delete header below clears the bad cookie so the loop ends.
123
+ }
124
+ }
125
+ const parts: string[] = [];
126
+ if (injectedToken) {
127
+ parts.push(
128
+ `<script>window.__AUTH_TOKEN__=${JSON.stringify(injectedToken)}</script>`,
129
+ );
130
+ }
131
+ parts.push(
132
+ `<script>window.__UGLY_BOT_URL__=${JSON.stringify(getUglyBotUrl())}</script>`,
133
+ );
134
+ return parts.join('');
135
+ }
136
+
137
+ function injectIntoHead(html: string, scripts: string): string {
138
+ if (!scripts) return html;
139
+ const idx = html.indexOf('</head>');
140
+ if (idx === -1) return scripts + html; // no head — prepend
141
+ return html.slice(0, idx) + scripts + html.slice(idx);
142
+ }
143
+
84
144
  export function wrapWithAssets(
85
145
  base: WorkersApp,
86
146
  config: AssetsConfig,
@@ -135,7 +195,8 @@ export function wrapWithAssets(
135
195
  // index document. Client-side routing takes it from here.
136
196
  // POST/PUT/DELETE on unrecognized paths get the base's 404.
137
197
  if (method === 'GET' || method === 'HEAD') {
138
- return htmlResponse(indexHtml);
198
+ const injection = await buildAuthInjection(request);
199
+ return htmlResponse(injectIntoHead(indexHtml, injection));
139
200
  }
140
201
  return baseRes;
141
202
  },