yelda-webchat 1.1.24 → 1.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yelda-webchat",
-  "version": "1.1.24",
+  "version": "1.1.25",
   "description": "Website Chat Plugin",
   "main": "./dist/js/yeldaWebchatInjector.min.js",
   "license": "MIT",
@@ -51,7 +51,7 @@
     "less-loader": "^4.1.0",
     "mime": "^2.4.6",
     "mini-css-extract-plugin": "^0.4.1",
-    "mocha": "^8.3.0",
+    "mocha": "^12.0.1",
     "optimize-css-assets-webpack-plugin": "^5.0.8",
     "postcss-import": "^12.0.0",
     "postcss-loader": "^3.0.0",

package/src/config/index.js

@@ -4,6 +4,8 @@ module.exports = {
   YELDA_PARAMETER: 'yparam',
   DEFAULT_PUBLICATION_STATUS: true,
   ALWAYS_ALLOWED_SITES_REGEX : /^([a-z-]*.yelda.ai|localhost|0.0.0.0|127.0.0.1)$/,
+  // Prefix of an allowed domain that allows all its subdomains, but not the domain itself
+  ALLOWED_DOMAIN_WILDCARD_PREFIX: '*.',
   REGEX_HOST: {
     STAGING: /staging.yelda.ai/,
     YELDA: /.yelda.ai/

package/src/js/yeldaWebchatInjector.js

@@ -1136,9 +1136,27 @@ class YeldaChat {
       return false
     }
 
+    // allowedDomains is only sent when the admins restricted the webchat to some websites
+    if (webchatSettings.allowedDomains && !this.isHostAllowed(currentHost, webchatSettings.allowedDomains)) {
+      return false
+    }
+
     return true
   }
 
+  /**
+   * Check the current website is in the webchat allowed domains
+   * @param {String} host - hostname of the current website, e.g. 'www.site.com'
+   * @param {Array<String>} allowedDomains - e.g. ['www.site.com', '*.site.com'], '*.site.com' allows the subdomains only
+   * @returns {Boolean}
+   */
+  isHostAllowed(host, allowedDomains) {
+    return allowedDomains.some(domain => domain.startsWith(config.ALLOWED_DOMAIN_WILDCARD_PREFIX)
+      // '*.site.com' gives '.site.com', matched by 'www.site.com' but not by 'site.com' or 'mysite.com'
+      ? host.endsWith(domain.slice(config.ALLOWED_DOMAIN_WILDCARD_PREFIX.length - 1))
+      : host === domain)
+  }
+
   /**
    * Return if the webchat loadChat settings are different from the yeldaChat global assistant settings
    *