64 lines
1.9 KiB
TypeScript
64 lines
1.9 KiB
TypeScript
function normalizeOrigin(value: string): string | null {
|
|
if (!value) return null;
|
|
try {
|
|
const u = new URL(value);
|
|
if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
|
|
return u.origin;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
const PARENT_ORIGIN = typeof window !== 'undefined'
|
|
? normalizeOrigin(document.querySelector('meta[name="parent-origin"]')?.getAttribute('content') || '')
|
|
: null;
|
|
|
|
export function isEmbedded(): boolean {
|
|
try {
|
|
return window.self !== window.top;
|
|
} catch {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
export function notifyParent(type: string, payload: Record<string, unknown> = {}) {
|
|
if (!isEmbedded()) return;
|
|
// Refuse to broadcast when the parent origin is unknown. A wildcard
|
|
// targetOrigin would leak the payload (e.g. username) to any frame
|
|
// the parent has open.
|
|
if (!PARENT_ORIGIN) return;
|
|
|
|
try {
|
|
window.parent.postMessage({ source: 'bulwark', type, ...payload }, PARENT_ORIGIN);
|
|
} catch {
|
|
// Cross-origin postMessage may fail in restricted contexts
|
|
}
|
|
}
|
|
|
|
export function listenFromParent(
|
|
handler: (msg: { type: string; [k: string]: unknown }) => void,
|
|
allowedOrigin: string,
|
|
): () => void {
|
|
// Reject installation entirely when the caller cannot pin an origin.
|
|
// Without this gate any cross-origin frame could forge
|
|
// { source: 'portal', type: 'sso:trigger-logout' } and ride the session.
|
|
const normalized = normalizeOrigin(allowedOrigin);
|
|
if (!normalized) {
|
|
if (typeof console !== 'undefined') {
|
|
console.error('[iframe-bridge] listenFromParent requires a valid http(s) allowedOrigin; listener not installed');
|
|
}
|
|
return () => {};
|
|
}
|
|
|
|
const listener = (event: MessageEvent) => {
|
|
if (event.origin !== normalized) return;
|
|
if (event.source !== window.parent) return;
|
|
if (!event.data || event.data.source !== 'portal') return;
|
|
|
|
handler(event.data);
|
|
};
|
|
|
|
window.addEventListener('message', listener);
|
|
return () => window.removeEventListener('message', listener);
|
|
}
|