From 4544379b3b30fea1ceb4e6c0e43debd154c5965c Mon Sep 17 00:00:00 2001 From: Codeman maintainer Date: Tue, 13 Oct 2026 17:12:02 +0200 Subject: [PATCH] style(auth): put hasValidWebviewCapability's JSDoc back above it The html-view helper had been inserted between the web-tab function's JSDoc and the function, so that doc block described the wrong function. The helper now sits after hasValidWebviewCapability with its own doc. No behaviour change. Co-Authored-By: Claude Opus 5.5 (1M context) --- src/web/middleware/auth.ts | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/web/middleware/auth.ts b/src/web/middleware/auth.ts index 0816c2ab..19cff3c1 100644 --- a/src/web/middleware/auth.ts +++ b/src/web/middleware/auth.ts @@ -150,18 +150,6 @@ function isPasswordChangeExempt(req: FastifyRequest): boolean { * match the prefix at all. The Host allowlist is NOT bypassed, so DNS-rebinding * protection still applies to these requests. */ -/** - * Whether a request is a GET for a rendered HTML file (`/html-view//...`) with - * a live capability. Same reasoning as the web-tab proxy: the page is sandboxed into - * an opaque origin, so its asset requests carry no session cookie. Read-only by - * construction (safe methods only), and the Host allowlist still applies. - */ -function hasValidHtmlViewCapability(req: FastifyRequest): boolean { - if (req.method !== 'GET' && req.method !== 'HEAD') return false; - const cap = capabilityFromHtmlViewPath((req.url ?? '').split('?')[0]); - return !!cap && htmlViewCapabilities.resolve(cap) !== undefined; -} - function hasValidWebviewCapability(req: FastifyRequest, basePath = ''): boolean { // req.url is already base-stripped by the server's rewriteUrl, so the path form // needs no base; the Referer form below is browser-supplied and does. @@ -196,6 +184,18 @@ function hasValidWebviewCapability(req: FastifyRequest, basePath = ''): boolean return !!fromReferer && webviewCapabilities.resolve(fromReferer) !== undefined; } +/** + * Whether a request is a GET for a rendered HTML file (`/html-view//...`) with + * a live capability. Same reasoning as the web-tab proxy: the page is sandboxed into + * an opaque origin, so its asset requests carry no session cookie. Read-only by + * construction (safe methods only), and the Host allowlist still applies. + */ +function hasValidHtmlViewCapability(req: FastifyRequest): boolean { + if (req.method !== 'GET' && req.method !== 'HEAD') return false; + const cap = capabilityFromHtmlViewPath((req.url ?? '').split('?')[0]); + return !!cap && htmlViewCapabilities.resolve(cap) !== undefined; +} + /** * A web-tab frame that navigated itself off the proxy prefix (see * isLostWebviewFrameNavigation). It cannot authenticate: opaque origin, no cookie,