attached: pass host_origin to reauth popup to fix cross-origin postMessage

Author: Ryz0nd

apps/user_dashboard/src/app/export_private_key/page.tsx

@@ -539,7 +539,7 @@ const Page = () => {
         `width=${popupWidth},height=${popupHeight},left=${popupLeft},top=${popupTop},resizable=yes`,
       );
       if (popup) {
-        popup.location.href = `${attachedOrigin}/export/reauth?auth_type=${authType}&email=${encodeURIComponent(email ?? "")}`;
+        popup.location.href = `${attachedOrigin}/export/reauth?auth_type=${authType}&email=${encodeURIComponent(email ?? "")}&host_origin=${encodeURIComponent(window.location.origin)}`;
       }
 
       // 2. Send export request to attached iframe

embed/oko_attached/src/components/export/use_export_reauth.ts

@@ -32,6 +32,15 @@ export function findEmbeddedIframe(): Window | null {
   return null;
 }
 
+function getHostOrigin(): string {
+  const params = new URLSearchParams(window.location.search);
+  const hostOrigin = params.get("host_origin");
+  if (hostOrigin) {
+    return hostOrigin;
+  }
+  return window.location.origin;
+}
+
 export function sendReauthParamsToIframe(
   iframe: Window,
   params: { nonce?: string; code_verifier?: string },
@@ -55,7 +64,7 @@ function buildGoogleOAuthUrl(nonce: string): string {
 
   const oauthState: OAuthState = {
     apiKey: "export_key_reauth",
-    targetOrigin: window.location.origin,
+    targetOrigin: getHostOrigin(),
     provider: "google",
   };
 
@@ -76,7 +85,7 @@ function buildXOAuthUrl(codeChallenge: string): string {
 
   const oauthState: OAuthState = {
     apiKey: "export_key_reauth",
-    targetOrigin: window.location.origin,
+    targetOrigin: getHostOrigin(),
     provider: "x",
   };
   const oauthStateString = btoa(JSON.stringify(oauthState));
@@ -98,7 +107,7 @@ function buildDiscordOAuthUrl(codeChallenge: string): string {
 
   const oauthState: OAuthState = {
     apiKey: "export_key_reauth",
-    targetOrigin: window.location.origin,
+    targetOrigin: getHostOrigin(),
     provider: "discord",
   };
   const oauthStateString = btoa(JSON.stringify(oauthState));
@@ -120,7 +129,7 @@ function buildGithubOAuthUrl(codeChallenge: string): string {
 
   const oauthState: OAuthState = {
     apiKey: "export_key_reauth",
-    targetOrigin: window.location.origin,
+    targetOrigin: getHostOrigin(),
     provider: "github",
   };
   const oauthStateString = btoa(JSON.stringify(oauthState));