doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

P3b fixes: the public manifest fetch keeps the default credentials; the share base accepts https (or a local test server); the library index lists publicEmbed.js

Browse source 
check:no-credentials-omit: the default 'same-origin' sends nothing to a
cross-origin public host and keeps a same-origin session. resolvePublicBase now
refuses a plain-http base from profile-config or window (mixed content on an https
page), except 127.0.0.1/localhost for a local test. check:library-index: the
index is regenerated with the new module.
This commit is contained in:
Doxa Maps 2026-10-03 08:08:51 +00:00
parent 5bb88fdaaf
commit 4e5a9c6d8f
3 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
documentation/reference-library-index.md
View file

@ -280,6 +280,8 @@ and a change here can break other maps.
`import … from '@map/utils/peopleGroupName.js'`
- **peopleGroupPoints** — peopleGroupPoints.js — SHARED (@map/utils/peopleGroupPoints.js).
`import … from '@map/utils/peopleGroupPoints.js'`
- **publicEmbed** — publicEmbed.js: the Share menu's Embed codes for THIS plugin, from the tree's PUBLIC address.
`import … from '@map/utils/publicEmbed.js'`
- **scrollport** — findScrollportAncestor — the nearest ancestor that actually scrolls.
`import … from '@map/utils/scrollport.js'`
- **viewportScrim** — viewportScrim.js — make a position:fixed full-screen SCRIM actually cover the VIEWPORT,

9
library/utils/embedBase.js
View file

@ -221,12 +221,11 @@ export function absoluteEmbedUrl(leaf, profileConfig = null) {
* @returns {string}
*/
export function resolvePublicBase(profileConfig) {
// https only (an http base would give mixed-content codes on an https partner page), plus a local test server
const ok = (v) => typeof v === 'string' && /^(https:\/\/|http:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/)/i.test(v.trim())
const fromConfig = profileConfig?.shareBaseUrl
if (typeof fromConfig === 'string' && /^https?:\/\//i.test(fromConfig.trim())) return stripSlashes(fromConfig)
if (typeof window !== 'undefined') {
const fromHost = window.MAP_SHARE_BASE_URL
if (typeof fromHost === 'string' && /^https?:\/\//i.test(fromHost.trim())) return stripSlashes(fromHost)
}
if (ok(fromConfig)) return stripSlashes(fromConfig)
if (typeof window !== 'undefined' && ok(window.MAP_SHARE_BASE_URL)) return stripSlashes(window.MAP_SHARE_BASE_URL)
// typeof-guarded: a build or a test that defines no __DOXA_SHARE_BASE__ reads '' instead of throwing
return stripSlashes(typeof __DOXA_SHARE_BASE__ === 'string' ? __DOXA_SHARE_BASE__ : '')
}

4
library/utils/publicEmbed.js
View file

@ -35,7 +35,9 @@ export const publicLeafUrl = (base, embedPath) => {
function loadManifest(base) {
if (!cache.has(base)) {
const p = fetch(base + '/manifest.json', { credentials: 'omit' })
// the default credentials ('same-origin'): nothing is sent to a cross-origin public host, and behind a login gate
// a same-origin base keeps its session
const p = fetch(base + '/manifest.json')
.then((r) => (r.ok ? r.json() : null))
.catch(() => { cache.delete(base); return undefined }) // a network failure may be retried later
cache.set(base, p)