Merge pull request #1298 from dealerweb/fix/push-preferences-sandboxed-frame

fix: stop the push preference mirror from throwing in sandboxed plugin frames

lib/__tests__/push-preferences.test.ts

@@ -31,6 +31,20 @@ describe('writePushPreferences', () => {
     await expect(writePushPreferences({ sound: true })).resolves.toBeUndefined();
     expect(put).not.toHaveBeenCalled();
   });
+
+  it('does nothing where reading the Cache store throws', async () => {
+    // A plugin sandbox frame has an opaque origin: reading `caches` there,
+    // typeof included, throws a SecurityError.
+    Object.defineProperty(globalThis, 'caches', {
+      configurable: true,
+      get() {
+        throw new DOMException('Cache storage is disabled because the context is sandboxed', 'SecurityError');
+      },
+    });
+    const { writePushPreferences } = await import('../push-preferences');
+    await expect(writePushPreferences({ sound: true })).resolves.toBeUndefined();
+    expect(put).not.toHaveBeenCalled();
+  });
 });
 
 describe('settings store push preference mirror', () => {

lib/push-preferences.ts

@@ -21,8 +21,11 @@ export function pushPreferencesKey(origin: string): string {
 }
 
 export async function writePushPreferences(prefs: PushPreferences): Promise<void> {
-  if (typeof window === 'undefined' || typeof caches === 'undefined') return;
+  if (typeof window === 'undefined') return;
   try {
+    // A frame sandboxed without allow-same-origin (the plugin sandbox loads
+    // the settings store too) throws on any read of `caches`, typeof included.
+    if (typeof caches === 'undefined') return;
     const cache = await caches.open(PUSH_STATE_CACHE);
     await cache.put(
       pushPreferencesKey(window.location.origin),