@turnkey/iframe-stamper - npm Package Compare versions

Comparing version 1.2.0 to 2.0.0

./dist/index.js

@@ -33,2 +33,5 @@ 'use strict';
     IframeEventType["ExtractKeyEncryptedBundle"] = "EXTRACT_KEY_ENCRYPTED_BUNDLE";
+    // Event sent by the parent to apply settings on the iframe.
+    // Value: the settings to apply in JSON string format.
+    IframeEventType["ApplySettings"] = "APPLY_SETTINGS";
     // Event sent by the iframe to its parent when `InjectBundle` is successful
@@ -40,2 +43,5 @@ // Value: true (boolean)
     IframeEventType["EncryptedBundleExtracted"] = "ENCRYPTED_BUNDLE_EXTRACTED";
+    // Event sent by the iframe to its parent when `ApplySettings` is successful
+    // Value: true (boolean)
+    IframeEventType["SettingsApplied"] = "SETTINGS_APPLIED";
     // Event sent by the parent page to request a signature
@@ -81,2 +87,5 @@ // Value: payload to sign
         let iframe = window.document.createElement("iframe");
+        // See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox
+        // We do not need any other permission than running scripts for import/export/auth frames.
+        iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
         iframe.id = config.iframeElementId;
@@ -155,7 +164,8 @@ iframe.src = config.iframeUrl;
      */
-    async injectKeyExportBundle(bundle, keyFormat) {
+    async injectKeyExportBundle(bundle, organizationId, keyFormat) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectKeyExportBundle,
             value: bundle,
-            keyFormat: keyFormat,
+            keyFormat,
+            organizationId,
         }, "*");
@@ -184,6 +194,7 @@ return new Promise((resolve, reject) => {
      */
-    async injectWalletExportBundle(bundle) {
+    async injectWalletExportBundle(bundle, organizationId) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectWalletExportBundle,
             value: bundle,
+            organizationId,
         }, "*");
@@ -210,6 +221,8 @@ return new Promise((resolve, reject) => {
      */
-    async injectImportBundle(bundle) {
+    async injectImportBundle(bundle, organizationId, userId) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectImportBundle,
             value: bundle,
+            organizationId,
+            userId,
         }, "*");
@@ -287,2 +300,28 @@ return new Promise((resolve, reject) => {
     /**
+     * Function to apply settings on allowed parameters in the iframe
+     * This is used to style the HTML element used for plaintext in wallet and private key import.
+     */
+    async applySettings(settings) {
+        const settingsStr = JSON.stringify(settings);
+        this.iframe.contentWindow?.postMessage({
+            type: exports.IframeEventType.ApplySettings,
+            value: settingsStr,
+        }, "*");
+        return new Promise((resolve, reject) => {
+            window.addEventListener("message", (event) => {
+                if (event.origin !== this.iframeOrigin) {
+                    // There might be other things going on in the window, for example: react dev tools, other extensions, etc.
+                    // Instead of erroring out we simply return. Not our event!
+                    return;
+                }
+                if (event.data?.type === exports.IframeEventType.SettingsApplied) {
+                    resolve(event.data["value"]);
+                }
+                if (event.data?.type === exports.IframeEventType.Error) {
+                    reject(event.data["value"]);
+                }
+            }, false);
+        });
+    }
+    /**
      * Function to sign a payload with the underlying iframe
@@ -289,0 +328,0 @@ */

CHANGELOG.md

 # @turnkey/iframe-stamper
 
+## 2.0.0
+
+### Major Changes
+
+- 5d0bfde: Include organizationId and userId in injected import and export bundles.
+
+### Minor Changes
+
+- 2f2d09a: Add applySettings.
+
+### Patch Changes
+
+- 976663e: Add `sandbox` attribute to iframe element
+
 ## 1.2.0
@@ -4,0 +18,0 @@

dist/index.d.ts

@@ -10,4 +10,6 @@ /// <reference lib="dom" />
     ExtractKeyEncryptedBundle = "EXTRACT_KEY_ENCRYPTED_BUNDLE",
+    ApplySettings = "APPLY_SETTINGS",
     BundleInjected = "BUNDLE_INJECTED",
     EncryptedBundleExtracted = "ENCRYPTED_BUNDLE_EXTRACTED",
+    SettingsApplied = "SETTINGS_APPLIED",
     StampRequest = "STAMP_REQUEST",
@@ -30,2 +32,28 @@ Stamp = "STAMP",
 };
+export type TIframeStyles = {
+    padding?: string;
+    margin?: string;
+    borderWidth?: string;
+    borderStyle?: string;
+    borderColor?: string;
+    borderRadius?: string;
+    fontSize?: string;
+    fontWeight?: string;
+    fontFamily?: string;
+    color?: string;
+    backgroundColor?: string;
+    width?: string;
+    height?: string;
+    maxWidth?: string;
+    maxHeight?: string;
+    lineHeight?: string;
+    boxShadow?: string;
+    textAlign?: string;
+    overflowWrap?: string;
+    wordWrap?: string;
+    resize?: string;
+};
+export type TIframeSettings = {
+    styles?: TIframeStyles;
+};
 /**
@@ -71,3 +99,3 @@ * Stamper to use with `@turnkey/http`'s `TurnkeyClient`
      */
-    injectKeyExportBundle(bundle: string, keyFormat?: KeyFormat): Promise<boolean>;
+    injectKeyExportBundle(bundle: string, organizationId: string, keyFormat?: KeyFormat): Promise<boolean>;
     /**
@@ -79,3 +107,3 @@ * Function to inject an export bundle into the iframe
      */
-    injectWalletExportBundle(bundle: string): Promise<boolean>;
+    injectWalletExportBundle(bundle: string, organizationId: string): Promise<boolean>;
     /**
@@ -85,3 +113,3 @@ * Function to inject an import bundle into the iframe
      */
-    injectImportBundle(bundle: string): Promise<boolean>;
+    injectImportBundle(bundle: string, organizationId: string, userId: string): Promise<boolean>;
     /**
@@ -103,2 +131,7 @@ * Function to extract an encrypted bundle from the iframe
     /**
+     * Function to apply settings on allowed parameters in the iframe
+     * This is used to style the HTML element used for plaintext in wallet and private key import.
+     */
+    applySettings(settings: TIframeSettings): Promise<boolean>;
+    /**
      * Function to sign a payload with the underlying iframe
@@ -105,0 +138,0 @@ */

dist/index.js

@@ -33,2 +33,5 @@ 'use strict';
     IframeEventType["ExtractKeyEncryptedBundle"] = "EXTRACT_KEY_ENCRYPTED_BUNDLE";
+    // Event sent by the parent to apply settings on the iframe.
+    // Value: the settings to apply in JSON string format.
+    IframeEventType["ApplySettings"] = "APPLY_SETTINGS";
     // Event sent by the iframe to its parent when `InjectBundle` is successful
@@ -40,2 +43,5 @@ // Value: true (boolean)
     IframeEventType["EncryptedBundleExtracted"] = "ENCRYPTED_BUNDLE_EXTRACTED";
+    // Event sent by the iframe to its parent when `ApplySettings` is successful
+    // Value: true (boolean)
+    IframeEventType["SettingsApplied"] = "SETTINGS_APPLIED";
     // Event sent by the parent page to request a signature
@@ -81,2 +87,5 @@ // Value: payload to sign
         let iframe = window.document.createElement("iframe");
+        // See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox
+        // We do not need any other permission than running scripts for import/export/auth frames.
+        iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
         iframe.id = config.iframeElementId;
@@ -155,7 +164,8 @@ iframe.src = config.iframeUrl;
      */
-    async injectKeyExportBundle(bundle, keyFormat) {
+    async injectKeyExportBundle(bundle, organizationId, keyFormat) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectKeyExportBundle,
             value: bundle,
-            keyFormat: keyFormat,
+            keyFormat,
+            organizationId,
         }, "*");
@@ -184,6 +194,7 @@ return new Promise((resolve, reject) => {
      */
-    async injectWalletExportBundle(bundle) {
+    async injectWalletExportBundle(bundle, organizationId) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectWalletExportBundle,
             value: bundle,
+            organizationId,
         }, "*");
@@ -210,6 +221,8 @@ return new Promise((resolve, reject) => {
      */
-    async injectImportBundle(bundle) {
+    async injectImportBundle(bundle, organizationId, userId) {
         this.iframe.contentWindow?.postMessage({
             type: exports.IframeEventType.InjectImportBundle,
             value: bundle,
+            organizationId,
+            userId,
         }, "*");
@@ -287,2 +300,28 @@ return new Promise((resolve, reject) => {
     /**
+     * Function to apply settings on allowed parameters in the iframe
+     * This is used to style the HTML element used for plaintext in wallet and private key import.
+     */
+    async applySettings(settings) {
+        const settingsStr = JSON.stringify(settings);
+        this.iframe.contentWindow?.postMessage({
+            type: exports.IframeEventType.ApplySettings,
+            value: settingsStr,
+        }, "*");
+        return new Promise((resolve, reject) => {
+            window.addEventListener("message", (event) => {
+                if (event.origin !== this.iframeOrigin) {
+                    // There might be other things going on in the window, for example: react dev tools, other extensions, etc.
+                    // Instead of erroring out we simply return. Not our event!
+                    return;
+                }
+                if (event.data?.type === exports.IframeEventType.SettingsApplied) {
+                    resolve(event.data["value"]);
+                }
+                if (event.data?.type === exports.IframeEventType.Error) {
+                    reject(event.data["value"]);
+                }
+            }, false);
+        });
+    }
+    /**
      * Function to sign a payload with the underlying iframe
@@ -289,0 +328,0 @@ */

package.json

 {
   "name": "@turnkey/iframe-stamper",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "main": "./dist/index.js",
@@ -5,0 +5,0 @@ "module": "./dist/index.mjs",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

92346

increased by12.09%

Lines of code

1187

increased by14.46%

No dependency changes