From 4e5a9c6d8fb2ed4e963ca60eab40cbd5587998e5 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Sat, 3 Oct 2026 08:08:51 +0000 Subject: [PATCH] P3b fixes: the public manifest fetch keeps the default credentials; the share base accepts https (or a local test server); the library index lists publicEmbed.js check:no-credentials-omit: the default 'same-origin' sends nothing to a cross-origin public host and keeps a same-origin session. resolvePublicBase now refuses a plain-http base from profile-config or window (mixed content on an https page), except 127.0.0.1/localhost for a local test. check:library-index: the index is regenerated with the new module. --- documentation/reference-library-index.md | 2 ++ library/utils/embedBase.js | 9 ++++----- library/utils/publicEmbed.js | 4 +++- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/documentation/reference-library-index.md b/documentation/reference-library-index.md index 7c33c5c3d..7c6bd82f7 100644 --- a/documentation/reference-library-index.md +++ b/documentation/reference-library-index.md @@ -280,6 +280,8 @@ and a change here can break other maps. `import … from '@map/utils/peopleGroupName.js'` - **peopleGroupPoints** — peopleGroupPoints.js — SHARED (@map/utils/peopleGroupPoints.js). `import … from '@map/utils/peopleGroupPoints.js'` +- **publicEmbed** — publicEmbed.js: the Share menu's Embed codes for THIS plugin, from the tree's PUBLIC address. + `import … from '@map/utils/publicEmbed.js'` - **scrollport** — findScrollportAncestor — the nearest ancestor that actually scrolls. `import … from '@map/utils/scrollport.js'` - **viewportScrim** — viewportScrim.js — make a position:fixed full-screen SCRIM actually cover the VIEWPORT, diff --git a/library/utils/embedBase.js b/library/utils/embedBase.js index d0231a7e2..f8842425a 100644 --- a/library/utils/embedBase.js +++ b/library/utils/embedBase.js @@ -221,12 +221,11 @@ export function absoluteEmbedUrl(leaf, profileConfig = null) { * @returns {string} */ export function resolvePublicBase(profileConfig) { + // https only (an http base would give mixed-content codes on an https partner page), plus a local test server + const ok = (v) => typeof v === 'string' && /^(https:\/\/|http:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/)/i.test(v.trim()) const fromConfig = profileConfig?.shareBaseUrl - if (typeof fromConfig === 'string' && /^https?:\/\//i.test(fromConfig.trim())) return stripSlashes(fromConfig) - if (typeof window !== 'undefined') { - const fromHost = window.MAP_SHARE_BASE_URL - if (typeof fromHost === 'string' && /^https?:\/\//i.test(fromHost.trim())) return stripSlashes(fromHost) - } + if (ok(fromConfig)) return stripSlashes(fromConfig) + if (typeof window !== 'undefined' && ok(window.MAP_SHARE_BASE_URL)) return stripSlashes(window.MAP_SHARE_BASE_URL) // typeof-guarded: a build or a test that defines no __DOXA_SHARE_BASE__ reads '' instead of throwing return stripSlashes(typeof __DOXA_SHARE_BASE__ === 'string' ? __DOXA_SHARE_BASE__ : '') } diff --git a/library/utils/publicEmbed.js b/library/utils/publicEmbed.js index 6f2912949..b6a82afda 100644 --- a/library/utils/publicEmbed.js +++ b/library/utils/publicEmbed.js @@ -35,7 +35,9 @@ export const publicLeafUrl = (base, embedPath) => { function loadManifest(base) { if (!cache.has(base)) { - const p = fetch(base + '/manifest.json', { credentials: 'omit' }) + // the default credentials ('same-origin'): nothing is sent to a cross-origin public host, and behind a login gate + // a same-origin base keeps its session + const p = fetch(base + '/manifest.json') .then((r) => (r.ok ? r.json() : null)) .catch(() => { cache.delete(base); return undefined }) // a network failure may be retried later cache.set(base, p)