officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

user app publishing system — build, serve, and use personal apps in workspace panels

Browse Source 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-02-27 17:23:24 +00:00
co-authored by Claude Opus 4.6
parent 4d30672adb
commit fd4d77a389
17 changed files with 873 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/api/dev-server/router.ts
+1 -46
View File
@@ -8,6 +8,7 @@ import { CustomError } from '@@/custom-errors';
import * as errors from '@@/custom-errors';
import { verify } from '@@/jwt';
import { isTokenBlacklisted } from 'officerdb';
import { rewriteHtml, rewriteAssetPaths } from '../_shared/html-rewrite';
export const devServerRouter = createRouter();
export const devServerProxyRouter = createRouter();
@@ -311,49 +312,3 @@ devServerProxyRouter.all('/:proxyId/*', async (ctx) => {
return ctx.text('No dev server running', 404);
});
// Injected into proxied HTML to intercept fetch/XHR/WebSocket so absolute paths
// go through the proxy instead of hitting the host server directly.
// Also injects JWT auth headers from localStorage for authenticated requests.
const proxyOverrideScript = (base: string) =>
`<script>(function(){` +
`var b=${JSON.stringify(base)},o=location.origin;` +
`function gt(){try{return localStorage.getItem("BEARER_TOKEN")||localStorage.getItem("PERTENTO_EDITOR_AUTH_TOKEN")}catch(e){return null}}` +
`function rw(u){` +
`if(typeof u==="string"){` +
`if(u.startsWith("/")&&!u.startsWith("//")&&!u.startsWith(b))return b+u;` +
`if(u.startsWith(o+"/")&&!u.startsWith(o+b))return o+b+u.slice(o.length);` +
`return u}` +
`if(u instanceof URL&&u.origin===o&&!u.pathname.startsWith(b))` +
`return new URL(o+b+u.pathname+u.search+u.hash);` +
`if(u instanceof Request){var p=new URL(u.url);` +
`if(p.origin===o&&!p.pathname.startsWith(b))` +
`return new Request(o+b+p.pathname+p.search+p.hash,u)}` +
`return u}` +
`var F=window.fetch;window.fetch=function(i,n){` +
`var t=gt();if(t){n=n||{};var h=new Headers(n.headers||{});` +
`if(!h.has("Authorization"))h.set("Authorization","Bearer "+t);n.headers=h}` +
`return F.call(this,rw(i),n)};` +
`var XO=XMLHttpRequest.prototype.open,XS=XMLHttpRequest.prototype.send;` +
`XMLHttpRequest.prototype.open=function(){arguments[1]=rw(arguments[1]);this._authSet=false;return XO.apply(this,arguments)};` +
`XMLHttpRequest.prototype.send=function(d){` +
`if(!this._authSet){var t=gt();if(t)try{this.setRequestHeader("Authorization","Bearer "+t)}catch(e){}}` +
`return XS.call(this,d)};` +
`var NWS=window.WebSocket;window.WebSocket=function(u,p){` +
`if(typeof u==="string"&&(u.startsWith("ws://"+location.host)||u.startsWith("wss://"+location.host)||u.startsWith("/"))){` +
`var t=gt();if(t){var sep=u.indexOf("?")>-1?"&":"?";u=u+sep+"token="+encodeURIComponent(t)}}` +
`return p!==undefined?new NWS(u,p):new NWS(u)};` +
`window.WebSocket.prototype=NWS.prototype;window.WebSocket.CONNECTING=NWS.CONNECTING;` +
`window.WebSocket.OPEN=NWS.OPEN;window.WebSocket.CLOSING=NWS.CLOSING;window.WebSocket.CLOSED=NWS.CLOSED;` +
`})()</script>`;
// HTML: rewrite src/href/action attributes with absolute paths + inject fetch/XHR override
const rewriteHtml = (html: string, base: string) =>
html
.replace(/<head([^>]*)>/i, `<head$1>${proxyOverrideScript(base)}`)
.replace(/(href|src|action)="\/(?!\/)/g, `$1="${base}/`)
.replace(/(href|src|action)='\/(?!\/)/g, `$1='${base}/`)
.replace(/url\(\//g, `url(${base}/`);
// JS/CSS: only rewrite /_bun/ asset paths (Bun dev server specific)
const rewriteAssetPaths = (text: string, base: string) =>
text.replace(/\/_bun\//g, `${base}/_bun/`);