Fechamento da versão 1.0.11

page-bridge.js

@@ -7,6 +7,8 @@
 
   const MESSAGE_SOURCE = "arch-panel-extension";
   const API_PATH_FRAGMENT = "/oalcrm/web/api/";
+  const CRM_ORIGIN = "https://eeho.fa.us2.oraclecloud.com";
+  const CRM_SCOPE = `scope:crm-rest:${CRM_ORIGIN}`;
   const EXTRA_CAPTURE_ORIGINS = new Set([
     "https://comcipapic-oalprod.integration.ocp.oraclecloud.com",
   ]);
@@ -147,7 +149,7 @@
       return false;
     }
 
-    if (url.includes(API_PATH_FRAGMENT)) {
+    if (isCrmRestUrl(url) || url.includes(API_PATH_FRAGMENT)) {
       return true;
     }
 
@@ -158,6 +160,15 @@
     }
   }
 
+  function isCrmRestUrl(url) {
+    try {
+      const parsedUrl = new URL(url, window.location.origin);
+      return parsedUrl.origin === CRM_ORIGIN && parsedUrl.pathname.startsWith("/crmRestApi/");
+    } catch {
+      return false;
+    }
+  }
+
   function normalizeHeaders(input) {
     const normalized = new Map();
 
@@ -194,6 +205,10 @@
     try {
       const parsedUrl = new URL(normalizedUrl);
       const path = parsedUrl.pathname;
+      if (isCrmRestUrl(normalizedUrl)) {
+        // CRM credentials belong to the Fusion origin, not to the SPA provider.
+        return [CRM_SCOPE, `crm-path:${parsedUrl.origin}${path}`];
+      }
       const keys = [`path:${path}`];
       const providerProxyMatch = path.match(
         /\/provider-proxy\/([^/]+)\//
@@ -258,7 +273,7 @@
     }
 
     headers.forEach((value, key) => {
-      if (!isAuthorizationLikeHeader(key)) {
+      if (!isCrmRestUrl(url) && !isAuthorizationLikeHeader(key)) {
         bridgeState.globalHeaders.set(key, value);
       }
     });
@@ -273,6 +288,9 @@
   }
 
   function publishCapturedAuthHeaders(url, headers) {
+    if (isCrmRestUrl(url)) {
+      return;
+    }
     const authHeaders = {};
 
     headers.forEach((value, key) => {
@@ -299,9 +317,11 @@
     const merged = new Headers();
     const activeScopeKeys = getScopeKeys(url);
 
-    bridgeState.globalHeaders.forEach((value, key) => {
-      merged.set(key, value);
-    });
+    if (!isCrmRestUrl(url)) {
+      bridgeState.globalHeaders.forEach((value, key) => {
+        merged.set(key, value);
+      });
+    }
 
     for (const scopeKey of activeScopeKeys) {
       const bucket = bridgeState.scopedHeaders.get(scopeKey);
@@ -395,8 +415,11 @@
       snapshot.set(key, value);
     });
 
-    if (options.includeAllAuth) {
-      bridgeState.scopedHeaders.forEach((bucket) => {
+    if (options.includeAllAuth && !isCrmRestUrl(scopeUrl)) {
+      bridgeState.scopedHeaders.forEach((bucket, scopeKey) => {
+        if (scopeKey === CRM_SCOPE || scopeKey.startsWith("crm-path:")) {
+          return;
+        }
         bucket.forEach((value, key) => {
           if (isAuthorizationLikeHeader(key)) {
             snapshot.set(key, value);