Release/26.3.30 by skyflow-bharti · Pull Request #685 · skyflowapi/skyflow-js

skyflow-bharti · 2026-03-30T08:08:04Z

No description provided.

github-actions · 2026-03-30T08:08:19Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-03-30T08:08:45Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T08:44:35Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T08:45:00Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T08:45:13Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T08:45:38Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T09:15:12Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T09:15:39Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T09:15:46Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T09:16:17Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T10:46:46Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T10:47:14Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T10:47:16Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T10:47:38Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T10:54:34Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T10:54:56Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T10:55:03Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T10:55:29Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T12:02:12Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T12:02:32Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-01T12:02:44Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-01T12:03:07Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

Copilot

Pull request overview

This PR appears to harden cross-frame communication by scoping Framebus traffic to explicit target origins and adding postMessage origin checks, with corresponding test updates.

Changes:

Add .target(...) to Framebus emit calls (primarily targeting properties.IFRAME_SECURE_ORIGIN or client domain).
Add MessageEvent.origin validation in internal iframe message handlers.
Update Jest tests/mocks to include emit on bus.target() mocks and set origin in synthetic MessageEvents; bump package version.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tests/skyflow.test.ts	Updates Framebus target mocks to include `emit` and adjusts delete test flow.
tests/skyflow.test.js	Updates Framebus target mocks to include `emit` and minor formatting cleanup.
tests/core/internal/skyflow-frame/skyflow-frame-controller.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/skyflow-frame/skyflow-frame-controller.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/skyflow-frame/skyflow-frame-controller-upload-tokenize.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/skyflow-frame/skyflow-frame-controller-upload-tokenize.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/reveal/reveal-frame.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/internal-index.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/iframe-form/iframe-form.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/internal/frame-element-init.test.js	Adds `origin` to a synthetic `MessageEvent` for multi-file upload flow.
tests/core/internal/frame-element-init.additional.test.js	Adds `origin` on synthetic events passed into private handler calls.
tests/core/internal/composable-frame-element-init.test.js	Adds `origin` to synthetic `MessageEvent`s used to drive composable height/reveal flows.
tests/core/external/reveal/reveal-element.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-element.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-container.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-container.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-composable-internal.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-composable-element.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/reveal/reveal-composable-container.test.js	Adds `properties` import and sets `origin` in `MessageEvent`s to match production origin checks.
tests/core/external/collect/composable-container.test.ts	Adds `properties` import, adds `emit` to bus mock, and sets `origin` in events.
tests/core/external/collect/composable-container.test.js	Adds `properties` import, adds `emit` to bus mock, sets `origin` in events, and guards callback extraction.
tests/core/external/collect/collect-element.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/collect/collect-element.test.js	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/collect/collect-container.test.ts	Adds `emit` to `bus.target()` mock return objects.
tests/core/external/collect/collect-container.test.js	Adds `emit` to `bus.target()` mock return objects.
src/utils/bus-events/index.ts	Refactors `getAccessToken()` emits (formatting/chain style) but keeps dual-emits behavior.
src/core/internal/skyflow-frame/skyflow-frame-controller.ts	Targets Framebus emits to `#clientDomain` for controller readiness/frame-ready events.
src/core/internal/frame-element-init.ts	Targets Framebus `COMPOSABLE_CONTAINER` emit and adds origin validation for inbound `message` events.
src/core/internal/composable-frame-element-init.ts	Adds origin validation for inbound composable reveal/height `message` events.
src/core/external/skyflow-container.ts	Targets Framebus PureJS requests to `properties.IFRAME_SECURE_ORIGIN` consistently.
src/core/external/reveal/reveal-element.ts	Targets Framebus reveal calls to `properties.IFRAME_SECURE_ORIGIN`.
src/core/external/reveal/reveal-container.ts	Targets Framebus reveal request emit to `properties.IFRAME_SECURE_ORIGIN`.
src/core/external/reveal/composable-reveal-container.ts	Adds origin checks for inbound `message` events from composable iframes.
src/core/external/collect/compose-collect-container.ts	Adds origin checks for inbound `message` events from composable iframes.
package.json	Bumps SDK version string with a `-dev.<sha>` suffix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-17T04:58:57Z

+    bus
+      // .target(properties.IFRAME_SECURE_ORIGIN)
+      .emit(ELEMENT_EVENTS_TO_IFRAME.GET_BEARER_TOKEN + clientId, {},
+        (data:any) => {
+          if (data?.error) {
+            reject(data.error);
+          }
+          resolve(data.authToken);
+        });

-    bus.emit(ELEMENT_EVENTS_TO_IFRAME.GET_BEARER_TOKEN, {},
-      (data:any) => {
-        if (data?.error) {
-          reject(data.error);
-        }
-        resolve(data.authToken);
-      });
+    bus
+      // .target(properties.IFRAME_SECURE_ORIGIN)
+      .emit(ELEMENT_EVENTS_TO_IFRAME.GET_BEARER_TOKEN, {},
+        (data:any) => {
+          if (data?.error) {
+            reject(data.error);
+          }
+          resolve(data.authToken);
+        });


getAccessToken() emits both GET_BEARER_TOKEN + clientId and GET_BEARER_TOKEN unconditionally. If clientId is empty this will emit the same event twice; even when non-empty it triggers unnecessary cross-frame traffic. Consider emitting only one event (prefer the suffixed one when clientId is present) and target properties.IFRAME_SECURE_ORIGIN to match the listener in src/skyflow.ts.

Copilot · 2026-04-17T04:58:57Z

+        (data:any) => {
+          if (data?.error) {
+            reject(data.error);
+          }
+          resolve(data.authToken);
+        });


In both callbacks, reject(data.error) is followed by resolve(data.authToken) without an early return/else. This is confusing and can mask mistakes (e.g., resolving undefined if the promise is already settled). Add return reject(...) or wrap resolve in an else branch.

github-actions · 2026-04-17T06:42:00Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-17T06:42:30Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

github-actions · 2026-04-17T06:42:36Z

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

github-actions · 2026-04-17T06:43:00Z

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

SK-2675 add origin check

128463d

SK-2682 add target in bus events

bc77c0c

skyflow-bharti force-pushed the release/26.3.30 branch from cdd2f3b to bc77c0c Compare April 1, 2026 08:44

[AUTOMATED] Release - 2.7.4-dev.bc77c0c

92d4284

SK-2682 add target in bus events

73a206e

[AUTOMATED] Release - 2.7.4-dev.73a206e

d02eaf4

SK-2682 fix the unit tests

689c150

[AUTOMATED] Release - 2.7.4-dev.689c150

ac3770f

SK-2682 fix the unit tests

b36fc55

[AUTOMATED] Release - 2.7.4-dev.b36fc55

5819c17

SK-2682 fix the unit tests

81aa0e9

[AUTOMATED] Release - 2.7.4-dev.81aa0e9

efca6bf

skyflow-bharti requested a review from Copilot April 17, 2026 04:54

Copilot started reviewing on behalf of skyflow-bharti April 17, 2026 04:54 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

SK-2682 fix the origin check

7a9dd9e

[AUTOMATED] Release - 2.7.4-dev.7a9dd9e

9450798

Conversation

skyflow-bharti commented Mar 30, 2026

Uh oh!

github-actions Bot commented Mar 30, 2026

Uh oh!

github-actions Bot commented Mar 30, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants