block/check-safety
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allowlist CMS registry browse/detail fetch() to orchestrator endpoints

Browse Source 
The CMS registry browse tab and new Phase-5 detail view call the
orchestrator's public Connect endpoints (PluginRegistryService /
PluginReviewService) on a different origin. The CMS transport and generated
hooks only cover the CMS's own proto surface, so these are plain JSON POSTs
to the registry URL — same rationale routes/admin/plugins.tsx carried before
the BrowseRegistryTab extraction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-07-05 10:42:08 +08:00
parent 3476316e9c
commit 8418d2535b
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
frontend.go
View File

@ -47,6 +47,14 @@ var allowedFrontendFiles = map[string]bool{
// with `for await` — generated Connect Query hooks are unary-only and // with `for await` — generated Connect Query hooks are unary-only and
// cannot express a streaming turn (same reason as use-restart-operation). // cannot express a streaming turn (same reason as use-restart-operation).
"components/site-agent/use-site-agent-stream.ts": true, "components/site-agent/use-site-agent-stream.ts": true,
// Registry browse/detail call the ORCHESTRATOR's public Connect endpoints
// (PluginRegistryService/PluginReviewService) on a different origin. The
// CMS transport and generated hooks only cover the CMS's own proto surface,
// so these are plain JSON POSTs to the registry URL from GetAuthConfig
// (same reason routes/admin/plugins.tsx carried before the extraction).
"components/plugins/browse-registry-tab.tsx": true,
"components/plugins/registry-detail.tsx": true,
} }
// Plugin web files that are allowed to call plugin-owned REST handlers because // Plugin web files that are allowed to call plugin-owned REST handlers because