Uh oh!
There was an error while loading. Please reload this page.
fix(app-shell): action runtime builds sameOriginOnly authenticated fetch - #5767
Merged
Merged
Conversation
…tch (#5702) useConsoleActionRuntime now builds createAuthenticatedFetch with sameOriginOnly: true, matching the provider:'api' data-source lane (ConsoleShell). A metadata type:'api' action whose resolved target is off-origin goes out through the bare global fetch — no Authorization, X-Tenant-ID, or Accept-Language. Same-origin actions are unchanged (pinned by the new regression pair). Maintainer ruling 2026-08-22 / 2026-08-23 (A, sequenced); the #5745 config convergence this was sequenced behind has landed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EuPCi56cnGyykygi3z9w4m
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
os-zhuang
marked this pull request as ready for review
August 23, 2026 06:15
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#5702
Maintainer ruling 2026-08-22 (「同意所有」, item 17), re-affirmed 2026-08-23 as A, sequenced:
useConsoleActionRuntimebuildscreateAuthenticatedFetch({ sameOriginOnly: true }), matching theprovider: 'api'data-source lane (ConsoleShell). A metadatatype: 'api'action whose resolved target is off-origin now goes out through the bare global fetch — noAuthorization, noX-Tenant-ID, noAccept-Language. Same-origin actions are unchanged. Quiet fix, no advisory, per the ruling.The sequencing prerequisite has landed: #5745 (merged as PR #5765) converged the dev stacks on one origin — verified on
origin/mainbc21c704bthat all four committed env files shipVITE_SERVER_URLempty andexamples/console-starter/vite.config.ts:80carries the/apidev proxy — so this change no longer de-authenticates the standard dev stack.Blocked-by: objectui#5745is discharged (#5745 is itself already closed, completed by PR #5765).What changed
packages/app-shell/src/hooks/useConsoleActionRuntime.tsx— the one ruled line at:316plus lane comments stating the off-origin behaviour (the oldapiHandlercomment described the wrapper as unconditional "Bearer + X-Tenant-ID + same-origin cookies").packages/app-shell/src/hooks/__tests__/useConsoleActionRuntime.sameOriginOnly-5702.test.tsx— the regression pin, deliberately a PAIR throughapiHandlerwith the realcreateAuthenticatedFetch(partial auth mock; the wrapper,TokenStorage,ActiveOrganizationStoragestay real): a same-origin target still carriesAuthorizationandX-Tenant-ID; an absolute off-origin target carries neither and the request still executes (pass-through, not a refusal). Either half alone proves nothing — the off-origin half is green on a wrapper that attaches nothing, the same-origin half on the bare wrapper this site built before..changeset/action-runtime-same-origin-only-5702.md— patch, states the behaviour change plainly, including the split-host note and the Dev and split-host configs point VITE_SERVER_URL at an origin the page is not served from — the ruled prerequisite for #5702's sameOriginOnly default #5745 convergence.This is a re-derivation of the earlier pushed branch
claude/issue-5702-action-runtime-same-origin(head074121474, pre-#5744/#5765) onto current main; that branch is left untouched.Re-measurements on
bc21c704b(all line numbers re-derived)sameOriginOnlyshort-circuits atcreateAuthenticatedFetch.ts:81— beforeisApiCall(:84),Authorization(:87),X-Tenant-ID(:128) andAccept-Language(:141). The post-fix(auth): scope the active-organization key per user, and drop the previous user's client state on a session-user change #5744 rewrite (188 lines) preserves this ordering; the option stops all three headers.useConsoleActionRuntime.tsx:308(pre-change), consumed at:399(apiHandler),:534,:592(server-action env),:695(child prop) and returned from the hook at:721— five lanes, four building URLs fromVITE_SERVER_URL(:326,:509,:593,:696). The change at the construction covers all of them; nothing is scoped toapiHandleralone.http(s)action targets in ts/tsx acrosspackages/ apps/ examples/: 5 hits, every one atype: 'url'navigation action in core ActionRunner tests (no fetch, no headers). Controls: 108 relative/api/targets by the same pattern family; JSON/YAML lane 0 files with an api-typed action (control: 268type: 'api'occurrences in TS). The first pass's split-host reliance is repaired on main by Dev and split-host configs point VITE_SERVER_URL at an origin the page is not served from — the ruled prerequisite for #5702's sameOriginOnly default #5745, verified above. The stop does not re-fire.withSettleSignal(the extra wrapper atConsoleShell.tsx's site) is orthogonal here: it manages request settling for the data-source provider lane; the action runtime never had it and adding it is not part of the ruling.createAuthenticatedFetch()construction sites take code-supplied first-party URLs, not author metadata — the axis this card turns on. TheX-Tenant-IDgating question is Confirm whether X-Tenant-ID has a reader: the framework derives the tenant from the session, not the header #5279-side follow-up evidence, not this PR.Verification (union at
17a273779, clean tree, sha echoed by the run itself)useConsoleActionRuntimefiles +packages/authcreateAuthenticatedFetch.test.tsx(the legacy-behaviour pin "without sameOriginOnly, cross-origin /api/ URLs keep the legacy attach behaviour" — stays green, fence not crossed):Test Files 5 passed (5) / Tests 72 passed (72),UNION-VITEST-EXIT=0, lockVERDICT command-exit 0.pnpm --filter @object-ui/app-shell type-checkafter building the dependency closure: script name echoed (@object-ui/app-shell@17.6.0 type-check),TYPECHECK-EXIT=0.trap restore EXIT INT TERM): reverted the one line, disk-confirmed by anchored counts both directions (pre: option-call 1 / bare-call 0 → mutated: 0 / 1 → restored: 1 / 0). No build leg exists on this path and none is needed: vitest aliases@object-ui/authtopackages/auth/srcand the pin imports the hook relatively from source, so both legs execute on-disk source. Observed direction as predicted: off-origin pin RED (AssertionError: expected 'Bearer tok-5702' to be null), same-origin pin survived — correctly, same-origin attach is identical with and without the option — and the legacy wrapper file stayed green (it pins the wrapper, which the ablation never touches).--no-inline-config --format json) on the two touched lintable files:ESLINT-EXIT=0, 2 files linted, 0 errors, 63 warnings all@typescript-eslint/no-explicit-any+ pre-existing hook warnings — the lint gate is errors-only by the workflow's own header. Narrowing declared: population is the root flateslint.config.js(files: ['**/*.{ts,tsx}']), file count from the JSON formatter, and the config enables no type-aware linting (noprojectService/parserOptions.project), so this diff cannot move untouched files' verdicts. The repo-wide farm is CI's run.node scripts/check-changeset-presence.mjs: "2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)", exit 0.Generated by Claude Code