fix(electron): add refer/origin to api requests (#9880)

related to BS-2181

packages/frontend/apps/electron/scripts/dev.ts

@@ -40,7 +40,7 @@ function spawnOrReloadElectron() {
     process.env.NODE_OPTIONS = NODE_OPTIONS.replace(/--import=[^\s]*/, '');
   }
 
-  spawnProcess = spawn(exe, ['.'], {
+  spawnProcess = spawn(exe, ['.', '--inspect'], {
     cwd: electronDir,
     env: process.env,
     shell: true,

packages/frontend/apps/electron/src/main/constants.ts

@@ -1,4 +1,4 @@
-export const mainWindowOrigin = process.env.DEV_SERVER_URL || 'file://.';
+export const mainWindowOrigin = 'file://.';
 export const onboardingViewUrl = `${mainWindowOrigin}${mainWindowOrigin.endsWith('/') ? '' : '/'}onboarding`;
 export const shellViewUrl = `${mainWindowOrigin}${mainWindowOrigin.endsWith('/') ? '' : '/'}shell.html`;
 export const backgroundWorkerViewUrl = `${mainWindowOrigin}${mainWindowOrigin.endsWith('/') ? '' : '/'}background-worker.html`;

packages/frontend/apps/electron/src/main/protocol.ts

@@ -41,10 +41,19 @@ function isNetworkResource(pathname: string) {
 }
 
 async function handleFileRequest(request: Request) {
+  const urlObject = new URL(request.url);
+
+  // Redirect to webpack dev server if defined
+  if (process.env.DEV_SERVER_URL) {
+    const devServerUrl = new URL(
+      urlObject.pathname,
+      process.env.DEV_SERVER_URL
+    );
+    return net.fetch(devServerUrl.toString(), request);
+  }
   const clonedRequest = Object.assign(request.clone(), {
     bypassCustomProtocolHandlers: true,
   });
-  const urlObject = new URL(request.url);
   // this will be file types (in the web-static folder)
   let filepath = '';
   // if is a file type, load the file in resources
@@ -181,6 +190,12 @@ export function registerProtocol() {
           .join('; ');
         delete details.requestHeaders['cookie'];
         details.requestHeaders['Cookie'] = cookieString;
+
+        // mitigate the issue of the worker not being able to access the origin
+        if (isNetworkResource(pathname)) {
+          details.requestHeaders['origin'] = url.origin;
+          details.requestHeaders['referer'] = url.origin;
+        }
       }
     })()
       .catch(err => {

packages/frontend/apps/electron/src/main/security-restrictions.ts

@@ -2,12 +2,7 @@ import { app, shell } from 'electron';
 
 app.on('web-contents-created', (_, contents) => {
   const isInternalUrl = (url: string) => {
-    return (
+    return url.startsWith('file://.');
-      (process.env.DEV_SERVER_URL &&
-        url.startsWith(process.env.DEV_SERVER_URL)) ||
-      url.startsWith('affine://') ||
-      url.startsWith('file://.')
-    );
   };
   /**
    * Block navigation to origins not on the allowlist.