Carlos Florêncio
123 lines
4.9 KiB
Markdown
123 lines
4.9 KiB
Markdown
---
|
|
id: "01-runtime"
|
|
title: "Enable trusted same-origin runtime requests"
|
|
status: done
|
|
wave: 1
|
|
depends_on: []
|
|
plan: "plan.md"
|
|
requirements:
|
|
- REQ-PLUGINS-ISOLATED-WEB-APPS-001
|
|
- REQ-PLUGINS-ISOLATED-WEB-APPS-003
|
|
- REQ-PLUGINS-ISOLATED-WEB-APPS-007
|
|
- REQ-PLUGINS-ISOLATED-WEB-APPS-012
|
|
- REQ-PLUGINS-ISOLATED-WEB-APPS-013
|
|
acceptance_criteria:
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-001.2
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-001.3
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-003.1
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-003.2
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-003.5
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-007.1
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-007.2
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-007.3
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-007.7
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-012.1
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-012.2
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-012.3
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-012.4
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-013.1
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-013.3
|
|
- AC-PLUGINS-ISOLATED-WEB-APPS-013.5
|
|
system_design:
|
|
- ../../specs/plugins/system-design/isolated-web-app-contributions.md
|
|
---
|
|
|
|
# Task 01: Enable trusted same-origin runtime requests
|
|
|
|
## Summary
|
|
|
|
Update both browser sandbox declarations and the host-owned startup request.
|
|
Keep runtime capability validation and all ordinary backend checks effective.
|
|
|
|
## In scope
|
|
|
|
- Use TDD for exact iframe/CSP sandbox token sets and startup credential behavior.
|
|
- Add `allow-same-origin` to `WebAppFrame` and `BuildContentSecurityPolicy` together.
|
|
- Use `credentials: "same-origin"` in `hostRuntimeBootstrap.checkContext`.
|
|
- Replace comments and assertions that describe an opaque browser boundary.
|
|
- Test cookies alongside invalid, expired, and stale tokens and denied writes.
|
|
- Preserve immutable artifacts, startup messages, CSP sources, and exact ancestors.
|
|
|
|
## Out of scope
|
|
|
|
- Broad CORS changes, cross-origin cookie forwarding, fetch interception, and a bridge.
|
|
- Editing retained canvas packages or adding a mode/feature toggle.
|
|
- New UI composition and Cloudflare account changes.
|
|
|
|
## Acceptance
|
|
|
|
1. Framed and top-level runtime documents retain their served origin; both policy layers agree.
|
|
2. Startup uses same-origin cookies; a cookie cannot replace a token or bypass capability grant/input validation.
|
|
3. Existing startup, retry, source validation, and artifact immutability tests pass with the revised trust assertions.
|
|
|
|
## Verification
|
|
|
|
Run focused RED tests before changing production code. Do not weaken unrelated assertions.
|
|
Run each command from the repository root:
|
|
|
|
```bash
|
|
(cd apps/backend && go test ./internal/plugins/webapp ./internal/plugins ./internal/backendapp)
|
|
(cd apps/web && pnpm exec vitest run components/plugins/web-app-frame.test.tsx components/plugins/web-app-startup.test.ts components/plugins/canvas-page.test.tsx components/settings/canvas-host-route.test.tsx components/settings/canvas-host-components.test.tsx)
|
|
(cd apps/web && pnpm run typecheck)
|
|
git diff --check
|
|
```
|
|
|
|
Add `TestRuntimeCookieDoesNotReplaceCapability` and a protocol test named
|
|
`TestWebAppProtocolCookieDoesNotExpandPermissions`. Extend the existing policy
|
|
test to compare the parsed sandbox token set, rather than a substring that
|
|
would also pass with unintended permissions.
|
|
|
|
## Files likely touched
|
|
|
|
- `apps/web/components/plugins/web-app-frame.tsx` and its component test.
|
|
- `apps/backend/internal/plugins/webapp/policy.go` and `policy_test.go`.
|
|
- `apps/backend/internal/plugins/webapp/runtime_bootstrap.go` and `runtime_test.go`.
|
|
- `apps/backend/internal/plugins/webapp_protocol_test.go`.
|
|
- `apps/backend/internal/backendapp/middleware_test.go`, if same-origin request coverage is missing.
|
|
|
|
## Dependencies
|
|
|
|
None. Read scoped backend and web `AGENTS.md` before implementation.
|
|
|
|
## Risks
|
|
|
|
Same-origin code gains ordinary user-session authority. Capability tests must
|
|
not falsely assert that the runtime limits every possible action of that code.
|
|
|
|
## Parallelism
|
|
|
|
`sequential`
|
|
|
|
## Inputs
|
|
|
|
- [Runtime design](../../specs/plugins/system-design/isolated-web-app-contributions.md#same-origin-transport-and-trust).
|
|
- [Decision](../../decisions/2026-09-19-trusted-same-origin-canvases.md).
|
|
- Existing `Runtime.Serve`, `corsMiddleware`, and `handleWebAppProtocol` tests.
|
|
|
|
## Results
|
|
|
|
Implemented trusted same-origin runtime transport. The iframe and runtime
|
|
response CSP both declare `allow-same-origin`, and the host startup bootstrap
|
|
uses `credentials: "same-origin"` for its relative context request. Runtime
|
|
token validation, scope checks, protocol grants, and input validation remain
|
|
unchanged. Added regressions for the exact CSP sandbox token set, startup
|
|
credentials, cookie-plus-capability behavior, and cookie-plus-protocol
|
|
permissions.
|
|
|
|
Checks passed:
|
|
|
|
- `go test ./internal/plugins/webapp ./internal/plugins ./internal/backendapp`
|
|
- `pnpm exec vitest run components/plugins/web-app-frame.test.tsx components/plugins/web-app-startup.test.ts components/plugins/canvas-page.test.tsx components/settings/canvas-host-route.test.tsx components/settings/canvas-host-components.test.tsx`
|
|
- `pnpm run typecheck`
|
|
- `git diff --check`
|