2899058b5f
https://github.com/user-attachments/assets/af3fb042-d066-4e0c-9348-f86ea92a6fcd Front component anchors render a real host `<a>`, so clicking a link to another domain performed an uncontrolled full-page navigation. This adds a phishing-resistant "you're leaving Twenty" confirmation modal before navigating to an external origin (Fixes [#23260](https://github.com/twentyhq/twenty/issues/23260)). The renderer intercepts external anchor clicks in `createHtmlHostWrapper` and hands the destination to a host callback via context; twenty-front owns the modal (reuses `ConfirmationModal`) and a per-application list of trusted origins persisted in localStorage. A "Don't ask again for this site" checkbox (checked by default) skips the modal next time for that app. Scope is external cross-origin http(s) links only; same-origin links keep native behavior. External links always open in a new tab, so a component can never navigate the Twenty tab away, even once its origin is trusted. The modal is rendered by the trusted host, so components cannot style or suppress it. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/23270?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
175 lines
6.0 KiB
TypeScript
175 lines
6.0 KiB
TypeScript
import { FrontComponentApplicationTokenPairEffect } from '@/front-components/components/FrontComponentApplicationTokenPairEffect';
|
|
import { FrontComponentLoadErrorSnackBarEffect } from '@/front-components/components/FrontComponentLoadErrorSnackBarEffect';
|
|
import { FrontComponentRendererProvider } from '@/front-components/components/FrontComponentRendererProvider';
|
|
import { useFrontComponentExecutionContext } from '@/front-components/hooks/useFrontComponentExecutionContext';
|
|
import { useOnApplicationSdkClientChecksumsUpdated } from '@/front-components/hooks/useOnApplicationSdkClientChecksumsUpdated';
|
|
import { useOnFrontComponentUpdated } from '@/front-components/hooks/useOnFrontComponentUpdated';
|
|
import { useRequestFrontComponentExternalNavigation } from '@/front-components/hooks/useRequestFrontComponentExternalNavigation';
|
|
import { getFrontComponentUrl } from '@/front-components/utils/getFrontComponentUrl';
|
|
import { getSdkClientUrls } from '@/front-components/utils/getSdkClientUrls';
|
|
import { useGetLogicFunctionHttpUrl } from '@/settings/logic-functions/hooks/useGetLogicFunctionHttpUrl';
|
|
import { useSnackBar } from '@/ui/feedback/snack-bar-manager/hooks/useSnackBar';
|
|
import { useQuery } from '@apollo/client/react';
|
|
import { t } from '@lingui/core/macro';
|
|
import { type ReactNode, useCallback, useContext, useMemo } from 'react';
|
|
import { FrontComponentRenderer as SharedFrontComponentRenderer } from 'twenty-front-component-renderer';
|
|
import { isDefined } from 'twenty-shared/utils';
|
|
import { ThemeContext } from 'twenty-ui/theme-constants';
|
|
import { REACT_APP_SERVER_BASE_URL } from '~/config';
|
|
import {
|
|
FindOneFrontComponentDocument,
|
|
type FindOneFrontComponentQuery,
|
|
GetApplicationSdkClientChecksumsDocument,
|
|
} from '~/generated-metadata/graphql';
|
|
|
|
type FrontComponentRendererProps = {
|
|
frontComponentId: string;
|
|
commandMenuItemId?: string;
|
|
selectedRecordIds?: string[];
|
|
loadingFallback?: ReactNode;
|
|
};
|
|
|
|
type ResolvedFrontComponent = NonNullable<
|
|
FindOneFrontComponentQuery['frontComponent']
|
|
>;
|
|
|
|
type FrontComponentRendererContentProps = {
|
|
frontComponent: ResolvedFrontComponent;
|
|
commandMenuItemId?: string;
|
|
selectedRecordIds?: string[];
|
|
loadingFallback?: ReactNode;
|
|
};
|
|
|
|
export const FrontComponentRenderer = ({
|
|
frontComponentId,
|
|
commandMenuItemId,
|
|
selectedRecordIds,
|
|
loadingFallback,
|
|
}: FrontComponentRendererProps) => {
|
|
const { data, loading, error } = useQuery(FindOneFrontComponentDocument, {
|
|
variables: { id: frontComponentId },
|
|
});
|
|
|
|
useOnFrontComponentUpdated({
|
|
frontComponentId,
|
|
});
|
|
|
|
const frontComponent = data?.frontComponent;
|
|
|
|
return (
|
|
<>
|
|
<FrontComponentLoadErrorSnackBarEffect errorMessage={error?.message} />
|
|
{loading && loadingFallback}
|
|
{!loading && isDefined(frontComponent) && (
|
|
<FrontComponentRendererContent
|
|
frontComponent={frontComponent}
|
|
commandMenuItemId={commandMenuItemId}
|
|
selectedRecordIds={selectedRecordIds}
|
|
loadingFallback={loadingFallback}
|
|
/>
|
|
)}
|
|
</>
|
|
);
|
|
};
|
|
|
|
const FrontComponentRendererContent = ({
|
|
frontComponent,
|
|
commandMenuItemId,
|
|
selectedRecordIds,
|
|
loadingFallback,
|
|
}: FrontComponentRendererContentProps) => {
|
|
const { colorScheme } = useContext(ThemeContext);
|
|
const { enqueueErrorSnackBar } = useSnackBar();
|
|
const { functionsBaseUrl } = useGetLogicFunctionHttpUrl();
|
|
|
|
const { id: frontComponentId, applicationId, usesSdkClient } = frontComponent;
|
|
|
|
const { executionContext, frontComponentHostCommunicationApi } =
|
|
useFrontComponentExecutionContext({
|
|
frontComponentId,
|
|
commandMenuItemId,
|
|
selectedRecordIds,
|
|
colorScheme,
|
|
});
|
|
|
|
const requestExternalNavigation = useRequestFrontComponentExternalNavigation({
|
|
applicationId,
|
|
});
|
|
|
|
const handleError = useCallback(
|
|
(error?: Error) => {
|
|
if (!isDefined(error)) {
|
|
return;
|
|
}
|
|
|
|
enqueueErrorSnackBar({
|
|
message: t`Failed to load front component: ${error.message}`,
|
|
});
|
|
},
|
|
[enqueueErrorSnackBar],
|
|
);
|
|
|
|
const applicationTokenPair = frontComponent.applicationTokenPair ?? null;
|
|
|
|
const { data: sdkClientChecksumsData, loading: sdkClientChecksumsLoading } =
|
|
useQuery(GetApplicationSdkClientChecksumsDocument, {
|
|
variables: { applicationId },
|
|
skip: !usesSdkClient,
|
|
});
|
|
|
|
useOnApplicationSdkClientChecksumsUpdated({
|
|
applicationId,
|
|
skip: !usesSdkClient,
|
|
});
|
|
|
|
const sdkClientChecksums =
|
|
sdkClientChecksumsData?.applicationSdkClientChecksums;
|
|
|
|
const sdkClientUrls = useMemo(
|
|
() => getSdkClientUrls(applicationId, sdkClientChecksums),
|
|
[applicationId, sdkClientChecksums],
|
|
);
|
|
|
|
const componentUrl = getFrontComponentUrl({
|
|
frontComponentId,
|
|
checksum: frontComponent.builtComponentChecksum,
|
|
});
|
|
|
|
const applicationVariables = frontComponent.applicationVariables ?? undefined;
|
|
|
|
const isSdkClientReady = !usesSdkClient || !sdkClientChecksumsLoading;
|
|
const isReadyToRender = isDefined(applicationTokenPair) && isSdkClientReady;
|
|
|
|
return (
|
|
<>
|
|
<FrontComponentApplicationTokenPairEffect
|
|
frontComponentId={frontComponentId}
|
|
applicationTokenPair={applicationTokenPair}
|
|
/>
|
|
{!isReadyToRender && loadingFallback}
|
|
{isReadyToRender && (
|
|
<FrontComponentRendererProvider frontComponentId={frontComponentId}>
|
|
<SharedFrontComponentRenderer
|
|
colorScheme={colorScheme}
|
|
componentUrl={componentUrl}
|
|
applicationAccessToken={
|
|
applicationTokenPair.applicationAccessToken.token
|
|
}
|
|
apiUrl={REACT_APP_SERVER_BASE_URL}
|
|
functionsBaseUrl={functionsBaseUrl}
|
|
sdkClientUrls={sdkClientUrls}
|
|
executionContext={executionContext}
|
|
frontComponentHostCommunicationApi={
|
|
frontComponentHostCommunicationApi
|
|
}
|
|
onRequestExternalNavigation={requestExternalNavigation}
|
|
applicationVariables={applicationVariables}
|
|
onError={handleError}
|
|
loadingFallback={loadingFallback}
|
|
/>
|
|
</FrontComponentRendererProvider>
|
|
)}
|
|
</>
|
|
);
|
|
};
|