hot fixes to utc-6

neode-ui/src/stores/appLauncher.ts

@@ -1,5 +1,6 @@
 import { defineStore } from 'pinia'
-import { ref } from 'vue'
+import { ref, watch } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
 
 /** Apps that set X-Frame-Options or CSP frame-ancestors, blocking iframe embedding.
  *  Verified by checking response headers from each app container.
@@ -10,11 +11,12 @@ import { ref } from 'vue'
  */
 const IFRAME_BLOCKED_HOSTS: string[] = []
 
-/** External sites proxied through nginx to strip X-Frame-Options for iframe embedding */
-const EXTERNAL_PROXY: Record<string, string> = {
-  'botfights.net': '/ext/botfights/',
-  '484.kitchen': '/ext/484-kitchen/',
-  'present.l484.com': '/ext/arch-presentation/',
+/** External sites proxied through nginx on dedicated ports (strips X-Frame-Options).
+ *  Each site gets its own port so SPAs work at root — no subpath rewriting needed. */
+const EXTERNAL_PROXY_PORT: Record<string, number> = {
+  'botfights.net': 8901,
+  '484.kitchen': 8902,
+  'present.l484.com': 8903,
 }
 
 function mustOpenInNewTab(url: string): boolean {
@@ -82,10 +84,10 @@ function toEmbeddableUrl(url: string): string {
     const u = new URL(url)
     const origin = window.location.origin
 
-    // External sites proxied through nginx to strip X-Frame-Options
-    const extProxy = EXTERNAL_PROXY[u.hostname]
-    if (extProxy) {
-      return `${origin}${extProxy}`
+    // External sites proxied through nginx on dedicated ports
+    const extPort = EXTERNAL_PROXY_PORT[u.hostname]
+    if (extPort) {
+      return `${window.location.protocol}//${window.location.hostname}:${extPort}/`
     }
 
     const proxyPath = PORT_TO_PROXY[u.port]
@@ -132,6 +134,42 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
     }
   }
 
+  // NIP-07 postMessage handler — responds to nostr-request from iframe apps
+  async function handleNostrRequest(event: MessageEvent) {
+    if (!event.data || event.data.type !== 'nostr-request') return
+    const { id, method, params } = event.data
+    const source = event.source as Window | null
+    if (!source) return
+
+    try {
+      let result: unknown
+      if (method === 'getPublicKey') {
+        const res = await rpcClient.call<{ nostr_pubkey: string }>({ method: 'node.nostr-pubkey' })
+        result = res.nostr_pubkey
+      } else if (method === 'signEvent') {
+        const res = await rpcClient.call<unknown>({ method: 'identity.nostr-sign', params: { event: params.event } })
+        result = res
+      } else if (method === 'getRelays') {
+        result = {}
+      } else {
+        throw new Error(`Unsupported NIP-07 method: ${method}`)
+      }
+      source.postMessage({ type: 'nostr-response', id, result }, '*')
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error'
+      source.postMessage({ type: 'nostr-response', id, error: message }, '*')
+    }
+  }
+
+  // Listen for NIP-07 requests only while an app is open
+  watch(isOpen, (open) => {
+    if (open) {
+      window.addEventListener('message', handleNostrRequest)
+    } else {
+      window.removeEventListener('message', handleNostrRequest)
+    }
+  })
+
   return {
     isOpen,
     url,