From 45656bdd1f1452ebd7d8c70cc68643c325f4bcc3 Mon Sep 17 00:00:00 2001 From: Brendan Dash Date: Fri, 8 May 2026 17:03:10 +0800 Subject: [PATCH] feat(scan): support data-options config on auto.global.js script tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Read configuration from a `data-options` JSON attribute on the loading Existing localStorage merge in setOptions still wins for `enabled`, so user toolbar toggles persist over the script-tag default — same semantics as calling `scan({ enabled: false })` from JS. Refresh the website's bundled copy at packages/website/public/auto.global.js to match. Co-Authored-By: Claude Opus 4.7 (1M context) --- packages/scan/src/auto.ts | 40 ++++++++++++++++++++++++-- packages/website/public/auto.global.js | 2 +- 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/packages/scan/src/auto.ts b/packages/scan/src/auto.ts index d2251b14..e7d54f0f 100644 --- a/packages/scan/src/auto.ts +++ b/packages/scan/src/auto.ts @@ -3,10 +3,46 @@ import './polyfills'; import 'bippy'; import { IS_CLIENT } from '~web/utils/constants'; -import { scan } from './index'; +import { type Options, scan } from './index'; + +const isObjectRecord = (value: unknown): value is Record => + typeof value === 'object' && value !== null; + +// Allowlist + per-field type validation. Mirrors react-grab's +// `parseOptionsFromJson` — never spread untrusted JSON into the options +// object, since that could inject internal/dangerous flags. Add new +// keys here as the need arises. +const parseOptionsFromJson = (raw: unknown): Options => { + const out: Options = {}; + if (!isObjectRecord(raw)) return out; + + if (typeof raw.enabled === 'boolean') out.enabled = raw.enabled; + + return out; +}; + +// Read configuration from a `data-options='{"enabled":false}'` attribute on +// the loading