block/check-safety
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(frontend): match calcomblock REST allowlist by location-independent suffix

Browse Source 
calcomblock was extracted from cms/backend/internal/plugins/calcomblock into a
standalone repo at plugins/calcomblock. The allowedPluginRESTFiles entries were
pinned to the old bundled path, so the standalone plugin's web/{settings,editor}.tsx
(which legitimately call the plugin's own HTTPHandler REST routes — no ConnectRPC
surface exists) tripped no-fetch-in-plugin. Switch to the suffix
plugins/calcomblock/web/... which matches both the standalone and legacy bundled
locations (pluginRESTFileAllowed uses HasSuffix).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-07-05 03:06:20 +08:00
parent 2c7fe9aa62
commit 3476316e9c
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
frontend.go
View File

@ -52,8 +52,11 @@ var allowedFrontendFiles = map[string]bool{
// Plugin web files that are allowed to call plugin-owned REST handlers because
// there is no ConnectRPC surface for them yet. Keep this list narrow.
var allowedPluginRESTFiles = map[string]bool{
"backend/internal/plugins/calcomblock/web/settings.tsx": true, // Plugin settings/test endpoints are mounted via HTTPHandler; no generated hooks exist yet
"backend/internal/plugins/calcomblock/web/editor.tsx": true, // Block editor reads plugin /settings + /event-types via HTTPHandler routes
// Suffix-matched (see pluginRESTFileAllowed), so these cover calcomblock both
// as the standalone plugin repo (plugins/calcomblock/web/...) and the legacy
// bundled path (backend/internal/plugins/calcomblock/web/...).
"plugins/calcomblock/web/settings.tsx": true, // Plugin settings/test endpoints are mounted via HTTPHandler; no generated hooks exist yet
"plugins/calcomblock/web/editor.tsx": true, // Block editor reads plugin /settings + /event-types via HTTPHandler routes
}
// Specific fetch paths that are non-proto REST endpoints (no ConnectRPC equivalent)