From 3476316e9c450c21321772ac76a2ed66f78f15e9 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Sun, 5 Jul 2026 03:06:20 +0800 Subject: [PATCH] fix(frontend): match calcomblock REST allowlist by location-independent suffix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit calcomblock was extracted from cms/backend/internal/plugins/calcomblock into a standalone repo at plugins/calcomblock. The allowedPluginRESTFiles entries were pinned to the old bundled path, so the standalone plugin's web/{settings,editor}.tsx (which legitimately call the plugin's own HTTPHandler REST routes — no ConnectRPC surface exists) tripped no-fetch-in-plugin. Switch to the suffix plugins/calcomblock/web/... which matches both the standalone and legacy bundled locations (pluginRESTFileAllowed uses HasSuffix). Co-Authored-By: Claude Fable 5 --- frontend.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/frontend.go b/frontend.go index 316e4c2..2ec71ae 100644 --- a/frontend.go +++ b/frontend.go @@ -52,8 +52,11 @@ var allowedFrontendFiles = map[string]bool{ // Plugin web files that are allowed to call plugin-owned REST handlers because // there is no ConnectRPC surface for them yet. Keep this list narrow. var allowedPluginRESTFiles = map[string]bool{ - "backend/internal/plugins/calcomblock/web/settings.tsx": true, // Plugin settings/test endpoints are mounted via HTTPHandler; no generated hooks exist yet - "backend/internal/plugins/calcomblock/web/editor.tsx": true, // Block editor reads plugin /settings + /event-types via HTTPHandler routes + // Suffix-matched (see pluginRESTFileAllowed), so these cover calcomblock both + // as the standalone plugin repo (plugins/calcomblock/web/...) and the legacy + // bundled path (backend/internal/plugins/calcomblock/web/...). + "plugins/calcomblock/web/settings.tsx": true, // Plugin settings/test endpoints are mounted via HTTPHandler; no generated hooks exist yet + "plugins/calcomblock/web/editor.tsx": true, // Block editor reads plugin /settings + /event-types via HTTPHandler routes } // Specific fetch paths that are non-proto REST endpoints (no ConnectRPC equivalent)