@fkn/lib/attach-policy

Type Aliases

FrameFetchPolicy

type FrameFetchPolicy = object;

The pure half of the middle page’s frame.fetch gate: everything that can be decided from the attachment’s own facts, with no broker and no UI. The middle page enforces this on EVERY fetch call, because any app can drive the ‘fkn-attach-frame’ channel directly and skip the client library’s copy of the same checks.

Refusals here must surface under a TERMINAL locator error name (the caller maps them through locatorDeniedError), or the shared dispatch loop retries them to its 30 second deadline and reports a timeout that names neither the operation nor the reason.

Properties

approvedOrigins

approvedOrigins: ReadonlySet<string>;

exact origins this attachment has legitimately visited: the attach url plus every goto target

declaredHosts

declaredHosts: string[];

bare hostnames the app declared at attach; matched on hostname alone, any scheme or port

session

session: string;

” means the shared render-proxy jar; non-empty is an isolated per-attach session

---

FrameFetchVerdict

type FrameFetchVerdict =
  | {
  kind: "refuse";
  reason: string;
}
  | {
  kind: "consent";
  promptHosts: string[];
  targetHost: string;
};

Functions

frameFetchVerdict()

function frameFetchVerdict(policy, url): FrameFetchVerdict;

Parameters

policy

FrameFetchPolicy

url

unknown

Returns

FrameFetchVerdict

---

normalizeDeclaredHosts()

function normalizeDeclaredHosts(raw): string[];

Bare hostnames only: lowercase, no scheme, no port, no path. Anything else is dropped rather than repaired, so a malformed declaration narrows the app’s reach instead of widening it.

Parameters

raw

string[]

Returns

string[]